# TimeToUnsealTheBook schema

**Schema:** `aziel.unseal-site.v1`  
**Status:** LOCKED  
**Date:** 2026-10-24  
**Author:** Aziel Eliab  
**License:** Apache-2.0  
**Domain name (deferred):** TimeToUnsealTheBook.net  

This file is the locked site schema for the public test-lattice surface. A later HTML shell implements against this document. This repository does not ship that shell, does not purchase the domain, does not change DNS, and does not deploy. The site is not live.

The requirements source is Aziel Eliab’s Grok Bot Brief (schema `aziel.unseal-site.v1`, 2026-10-24, Apache-2.0). Public library and mesh responses cited below were read only to name fields and query parameters those surfaces already publish. This file stores no live census, no receipt body, and no private identifier.

A conforming change that relaxes a prohibition in this file uses a new schema id. `aziel.unseal-site.v1` stays as written here.

## Purpose

The site is a public, hash-chained surface for structural tests. Prep exists so the surface can be served when the domain is acquired. All data on the surface is public. The surface carries no private store and makes no completion claim.

The lattice tip stays open until the domain resolves and the first public test is chained. This prep artifact does not append a tip.

## Identity lock

| Field | Locked value |
| --- | --- |
| Public author | `Aziel Eliab` |
| Mesh identity | GodLock.AZ mesh only |
| Anchor `author` | `Aziel Eliab` |
| Anchor `carrier` | `AzielTether` |

The public surface publishes that pair and nothing further about the person. It includes no legal name and no personal or county location.

## Prohibited on the public surface

These are conformance rules for every later shell:

- No IP gate.
- No Node Gate panel.
- No operator tooling.
- No reading, display, or storage of `node_gate` or `get_is_node_gate`, from either mesh URL or from any other response.
- No invented user counts and no private identifiers.
- No second database for views, downloads, tests, or lattice entries. Citations point at the public endpoints in this schema.
- `decryption_complete` is `false` on every record this schema defines.

## Five record types

| `type` | Role | Persistence |
| --- | --- | --- |
| `active_nodes` | Live public count | Read-through display. Not a stored roster. |
| `prior_views` | Public view citations | Hash-chained citations of existing public counters and receipts. |
| `prior_downloads` | Public download citations | Receipt-linked list drawn from existing library surfaces. |
| `tests` | One public structural test | Public test card with confidence and a next-test suggestion. |
| `lattice` | Hash-chained action | An `aziel.lattice.anchor.v1` object carried by AzielTether. |

Every record carries `"schema": "aziel.unseal-site.v1"` and `"public": true`.

## 1. `active_nodes`

Active nodes are users actively using any Aziel site or ecosystem tool, including azielcorpuslibrary.net, azieleliab.com, godlock.uk, aziel-runtime, FragGate, AZ-OS, AZInterface, the Softwares catalog, and related public surfaces. The count is live, current sessions or public interactions already reported by the mesh endpoint. Missing telemetry stays missing. This schema does not fill a gap with a guess.

### Sources

Read `live_nodes` and no other field:

- `GET https://www.azielcorpuslibrary.net/v1/mesh`
- `GET https://www.azielcorpuslibrary.net/runtime/v1/mesh`

Display the integer `live_nodes` from `GET /v1/mesh`. `GET /runtime/v1/mesh` is the runtime mirror on the same host. When both responses include `live_nodes` and the integers differ, show the `/v1/mesh` value and record both observed integers on the in-memory projection. When `live_nodes` is absent, the display state is unavailable. A displayed `0` occurs only when the endpoint returns `0`.

Do not paint `software_nodes`, `registered_nodes`, `human_live_nodes`, `site_registered_viewers`, path-use counters, or a library-only viewer tally as the active-node count. `GET /runtime/v1/uses` is not an active-node source.

The projection is ephemeral. It is not written to the lattice. A lattice anchor does not carry `live_nodes`, a node roster, an IP address, a bearer, or a node id.

### Projection

```json
{
  "schema": "aziel.unseal-site.v1",
  "type": "active_nodes",
  "public": true,
  "source": "https://www.azielcorpuslibrary.net/v1/mesh",
  "mirror": "https://www.azielcorpuslibrary.net/runtime/v1/mesh",
  "field": "live_nodes",
  "live_nodes": null,
  "mirror_live_nodes": null,
  "display": "unavailable",
  "fetched_at": null,
  "stored": false
}
```

`display` is `"count"` when `live_nodes` is an integer, and `"unavailable"` when it is not. `stored` is locked `false`.

## 2. `prior_views`

Prior views are public views of this site and of linked Aziel surfaces, stored as hash-chained, re-referenceable citations. Until TimeToUnsealTheBook.net resolves and serves, the site-local view count is empty. It is not backfilled.

### Sources

- `GET https://www.azielcorpuslibrary.net/v1/library-index` — public aggregate `views`, plus `records[]` for linked surfaces.
- `GET https://www.azielcorpuslibrary.net/runtime/v1/uses` — public interaction counters `uses` and `by_path`. These are counters, not unique people, and they are not the active-node count.
- Lattice anchors of kind `timetounsealthebook.view_cite` once a citation is chained.

### Projection

```json
{
  "schema": "aziel.unseal-site.v1",
  "type": "prior_views",
  "public": true,
  "site_views": null,
  "library_index_views": null,
  "uses": null,
  "items": [],
  "anchor_kind": "timetounsealthebook.view_cite"
}
```

`site_views` stays `null` until the domain serves this site. `items[]` entries are citations, each with `surface`, `href`, and `record_id` when the index published one. A chained citation also carries `receipt_href`. Numbers are copied from the live response at read time. This file does not freeze a count.

## 3. `prior_downloads`

Prior downloads are public downloads from Aziel surfaces. Each listed download is receipt-linked and publicly listable.

### Sources

- `GET https://www.azielcorpuslibrary.net/v1/library-index` — aggregate `downloads` and `records[].record_id`.
- `GET https://www.azielcorpuslibrary.net/download?record={record_id}` — byte download for a `record_id` already present in that index. Listing downloads does not require fetching every file.
- `GET https://www.azielcorpuslibrary.net/v1/document-chain?record_id={record_id}` — hash chain for that record. The query name is `record_id`. The live surface rejects a `record` query.
- `GET https://www.azielcorpuslibrary.net/receipt/{id}` — public receipt. `{id}` is an identifier that surface, or the document chain `entry_hash`, already published.
- `GET https://www.azielcorpuslibrary.net/runtime/v1/uses` — interaction counters only.
- Lattice anchors of kind `timetounsealthebook.download_cite` once a citation is chained.

A download citation names `record_id`, `href` (`/download?record=`), `chain_href` (`/v1/document-chain?record_id=`), and `receipt_href` (`/receipt/{id}`) using ids taken from those responses. This schema mints no receipt id.

### Projection

```json
{
  "schema": "aziel.unseal-site.v1",
  "type": "prior_downloads",
  "public": true,
  "library_index_downloads": null,
  "items": [],
  "anchor_kind": "timetounsealthebook.download_cite"
}
```

### Document-chain entry (existing surface)

A chain entry the shell may cite already has this public shape:

| Field | Use |
| --- | --- |
| `sequence` | Order on that record’s chain. |
| `timestamp_utc` | When the entry was published. |
| `action` | Published action name, such as `INGEST`. |
| `previous_hash` | Prior entry hash, or the zero hash on the first entry. |
| `entry_hash` | This entry’s hash. Eligible as `/receipt/{id}`. |
| `payload.record_id` | Public library record id. |
| `payload.sha256` | Content hash already on the entry. |

## 4. `tests`

Tests use public data only. Each test is a public card. Execution is chained with kind `timetounsealthebook.test_run`. A test advances structural progress. The card’s confidence percent is that structural progress. It is not a claim that decryption is complete.

### Fields

| Field | Type | Rule |
| --- | --- | --- |
| `schema` | string | `aziel.unseal-site.v1` |
| `type` | string | `tests` |
| `public` | boolean | `true` |
| `test_id` | string | Public slug: `[a-z0-9][a-z0-9._-]{0,63}` |
| `title` | string | Public title. |
| `status` | string | `proposed`, `blocked_receipts`, or `ran` |
| `confidence_pct` | integer or null | `0`–`100`, or `null` when this test has no public score yet. |
| `confidence_basis` | string or null | Required when `confidence_pct` is an integer. Names the public inputs that produced the percent. |
| `next_test` | object or null | See the next-test rule. |
| `prior_receipts` | array | Receipts re-read before execution. |
| `earlier_receipts_checked` | boolean | `true` only after the public chain was queried for earlier receipts. |
| `decryption_complete` | boolean | Locked `false`. |
| `overclaim_cap` | string | Locked sentence below. |
| `anchor_kind` | string | `timetounsealthebook.test_run` |

Locked overclaim cap, copied onto every test and every test-run anchor:

> Tests advance structural progress; they do not assert decryption complete.

`confidence_pct` is scored only from public inputs named in `confidence_basis`. An absent score stays `null`. A library triad display, a mesh count, or a path-use counter is not copied into `confidence_pct` unless that test’s public basis says so, and even then the overclaim cap still applies.

`next_test` object:

| Field | Rule |
| --- | --- |
| `test_id` | Public slug of the suggested test. |
| `reason` | Public sentence explaining the suggestion. |

### Next-test rule

- When no run exists for this `test_id`, `next_test` may be `null`. The card is the test available to run.
- When a run already exists, `next_test` is required and `next_test.test_id` is a different slug from this `test_id`.
- The suggestion is not an automatic execution.
- A later run of the same `test_id` uses a new `run_id`, re-references the earlier run’s receipt, keeps `decryption_complete` false, and still names a distinct `next_test`.

### Receipt re-reference rule

Every test re-references earlier receipts before execution.

1. Query the public lattice citations and, for any cited library record, `GET /v1/document-chain?record_id={record_id}`.
2. Build `prior_receipts` from every earlier receipt those responses already publish, including any earlier `timetounsealthebook.test_run` for this `test_id`.
3. `GET` each `/receipt/{id}` (and the document-chain URL when the receipt names a library record). A re-read succeeds when the response is readable and identifies the same id that was cited.
4. Set `earlier_receipts_checked` to `true`. If the query found none, `prior_receipts` is `[]` and the check still stands.
5. If any cited receipt fails to re-read, set `status` to `blocked_receipts` and write no anchor.
6. Execution is allowed only when `earlier_receipts_checked` is `true` and every `prior_receipts[].reread` is `true`.

`prior_receipts[]`:

| Field | Rule |
| --- | --- |
| `id` | Public receipt id or document-chain `entry_hash`. |
| `href` | `https://www.azielcorpuslibrary.net/receipt/{id}` |
| `record_id` | Library record id when the chain published one; otherwise `null`. |
| `chain_href` | Document-chain URL when `record_id` is set; otherwise `null`. |
| `reread` | `true` only after step 3 succeeds for this execution. |

### Test card

```json
{
  "schema": "aziel.unseal-site.v1",
  "type": "tests",
  "public": true,
  "test_id": "structural-progress-0",
  "title": "Structural progress check",
  "status": "proposed",
  "confidence_pct": null,
  "confidence_basis": null,
  "next_test": null,
  "prior_receipts": [],
  "earlier_receipts_checked": false,
  "decryption_complete": false,
  "overclaim_cap": "Tests advance structural progress; they do not assert decryption complete.",
  "anchor_kind": "timetounsealthebook.test_run"
}
```

The `test_id` above is a shape example. It is not a chained run.

## 5. `lattice`

Every stored action is hash-chained into the Aziel lattice (runtime, AZ-OS, Interface) as an existing `aziel.lattice.anchor.v1` object. AzielTether is the carrier. The public HTTPS site is not itself a mesh. The tether carries the tip.

This prep pass leaves the tip open. No anchor in this repository is a live chain entry.

### Test-event anchor

A test execution uses the existing envelope with these fields fixed:

| Field | Locked value |
| --- | --- |
| `schema` | `aziel.lattice.anchor.v1` |
| `kind` | `timetounsealthebook.test_run` |
| `author` | `Aziel Eliab` |
| `carrier` | `AzielTether` |

Other public actions on this site use the same envelope and the same author and carrier, with these kinds:

| Action | `kind` |
| --- | --- |
| Test run | `timetounsealthebook.test_run` |
| View citation | `timetounsealthebook.view_cite` |
| Download citation | `timetounsealthebook.download_cite` |

### Inherited envelope

Keep these fields in the positions the public library anchors already use. Copy an engine advisory object only when a public scoring pass returned it. Omit an engine object when that pass did not run. Do not invent `spre`, `clce`, `plr`, `triad`, `bayesian`, `possibility`, or `zsolver` values.

| Field | Rule |
| --- | --- |
| `record_id` | Public id. A library-linked test uses the published `AZDOC-…` id. A site-only test uses its public `test_id`. |
| `run_id` | Public run id for this execution; `null` on a citation that is not a run. |
| `media_kind` | `null` unless the cited public record has a media kind. |
| `vibe_digest` | `null` unless a public digest already exists. |
| `library` | `aziel` when citing a library record. `timetounsealthebook` for a site-only test record. |
| `content_sha256` | SHA-256 of the public content this anchor cites. |
| `structure` | Public structure check. `ok` is true only when that check passed. |
| `ledger_entry_hash` | Hash of this ledger entry once chained. Absent on an unchained draft. |
| `verified_utc` | Verification time once chained. |
| `note` | Includes the overclaim cap. |
| `previous_hash` | `entry_hash` or `ledger_entry_hash` of the receipt this action re-referenced. The zero hash is allowed only when `earlier_receipts_checked` is true and no earlier receipt exists. |

The site block sits beside those fields. Older readers that understand only `schema`, `kind`, `author`, and `carrier` can ignore `unseal`.

```json
{
  "schema": "aziel.lattice.anchor.v1",
  "kind": "timetounsealthebook.test_run",
  "carrier": "AzielTether",
  "author": "Aziel Eliab",
  "record_id": null,
  "run_id": null,
  "media_kind": null,
  "vibe_digest": null,
  "library": "timetounsealthebook",
  "content_sha256": null,
  "structure": { "ok": false, "file_count": 0 },
  "ledger_entry_hash": null,
  "verified_utc": null,
  "previous_hash": null,
  "note": "Public HTTPS site is not a mesh. AzielTether carries this tip. Tests advance structural progress; they do not assert decryption complete. Tip remains open until the domain resolves and the first public test is chained.",
  "unseal": {
    "site_schema": "aziel.unseal-site.v1",
    "test_id": null,
    "confidence_pct": null,
    "confidence_basis": null,
    "next_test": null,
    "prior_receipts": [],
    "earlier_receipts_checked": false,
    "decryption_complete": false,
    "overclaim_cap": "Tests advance structural progress; they do not assert decryption complete."
  }
}
```

The skeleton above is the field lock. Null hashes are unchained. They are not a lattice tip.

### Lattice record

```json
{
  "schema": "aziel.unseal-site.v1",
  "type": "lattice",
  "public": true,
  "anchor_schema": "aziel.lattice.anchor.v1",
  "carrier": "AzielTether",
  "author": "Aziel Eliab",
  "tip": "open",
  "anchors": []
}
```

`tip` stays `"open"` until the domain resolves and the first public test anchor is chained. `anchors` lists only anchors that were actually published.

## Public endpoints

Host for every path below: `https://www.azielcorpuslibrary.net`

| Method and path | Record types | What a shell may use |
| --- | --- | --- |
| `GET /v1/mesh` | `active_nodes` | `live_nodes` only. |
| `GET /runtime/v1/mesh` | `active_nodes` | `live_nodes` only, as the mirror. |
| `GET /v1/library-index` | `prior_views`, `prior_downloads` | `views`, `downloads`, `records[].record_id`, record `href`. |
| `GET /v1/document-chain?record_id={record_id}` | `prior_downloads`, `tests`, `lattice` | `entries[]` hashes and actions for a published record. |
| `GET /download?record={record_id}` | `prior_downloads` | Byte download URL for a published record. |
| `GET /receipt/{id}` | `prior_views`, `prior_downloads`, `tests`, `lattice` | Re-read of a published receipt id. |
| `GET /runtime/v1/uses` | `prior_views`, `prior_downloads` | `uses` and `by_path` interaction counters. Not active nodes. Not unique people. |

No other host is a source of record data for v1. No private store is added beside these surfaces.

## Domain, DNS, and deploy

TimeToUnsealTheBook.net will be purchased later. Registration is deferred. This schema does not block on it.

Later steps, documented here and not executed:

1. Purchase and register TimeToUnsealTheBook.net.
2. Choose a public host and publish DNS for that name.
3. Serve the HTML shell that implements this schema.
4. After the name resolves, chain the first public test. The lattice tip stays open until that chain exists.

Nothing in this repository performs those steps. Nothing here claims the site is live.

## Conformance for a later HTML shell

A shell conforms to `aziel.unseal-site.v1` when all of the following hold:

- It renders the five record types with the fields in this file.
- Active nodes show `live_nodes` from the two mesh URLs and drop every other mesh field.
- Views and downloads are citations of the library endpoints above.
- A test shows `confidence_pct` and `next_test`, re-references earlier receipts before it runs, and names a different next test when a run already exists.
- Test anchors use `aziel.lattice.anchor.v1`, kind `timetounsealthebook.test_run`, author `Aziel Eliab`, carrier `AzielTether`.
- The overclaim cap is visible on every test.
- The surface has no IP gate, no Node Gate panel, and no operator tooling.
- Identity on the surface is Aziel Eliab / GodLock.AZ mesh only.
- The shell treats this repository’s schema as the contract and treats an unchained tip as open.

The brief’s later HTML shell (`TimeToUnsealTheBook.html`) is out of scope for this lock. It includes a dark panel, receipt tip, confidence bar, prior list, next suggestion, and an Aziel-runtime-style LLM box, and it still obeys every prohibition in this file.

---

# Compatible extension `aziel.unseal-site.v1.1`

**Schema:** `aziel.unseal-site.v1.1`  
**Status:** ADDITIVE  
**Date:** 2026-10-30  
**Author:** Aziel Eliab  
**License:** Apache-2.0  
**Domain name (deferred):** TimeToUnsealTheBook.net  

The text above this heading is the locked `aziel.unseal-site.v1` document of 2026-10-24. That lock stays as written. This extension adds surfaces. It does not relax a prohibition, an identity lock, or the overclaim cap.

## Migration

| Reader | Behavior |
| --- | --- |
| v1 reader | Keeps reading the five v1 record types. Unknown v1.1 types and unknown fields are ignored. |
| v1.1 reader | Accepts every v1 record unchanged. Reads the added catalogs below. |
| Prep receipt store | Stays `aziel.unseal-site.v1`. `receipts/append.py` still writes v1 test records and `aziel.lattice.anchor.v1` lines. |
| `decryption_complete` | Stays `false` on every v1 record and every v1.1 record. |
| Public domain tip | Stays `open`. A prep-store `tip` hash is the local chain head. It is not a launched-domain tip. |
| Identity | Public author `Aziel Eliab`. Mesh identity GodLock.AZ. Anchor author `Aziel Eliab`. Anchor carrier `AzielTether`. |
| License | Apache-2.0. |

A v1.1 record carries `"schema": "aziel.unseal-site.v1.1"` and `"public": true`. Lattice anchors keep `"schema": "aziel.lattice.anchor.v1"`. Their `unseal.site_schema` stays `aziel.unseal-site.v1` until a later chained run explicitly records `aziel.unseal-site.v1.1` in that field. This prep pass does not append such a run.

`confidence_pct` remains structural progress. The locked overclaim cap is copied onto every new test method, theory, and staged receipt:

> Tests advance structural progress; they do not assert decryption complete.

## Added record types

| `type` | Role | File |
| --- | --- | --- |
| `corpus_catalog` | Pointers, licenses, and empty local slots for manuscript surfaces | `corpus/manifest.json` |
| `test_method_registry` | Built-in batteries a person can read and extend | `data/tests.json` |
| `theory_registry` | Hypotheses under test, each tied to method hooks and receipt ids | `data/theories.json` |
| `staged_test_receipt` | Browser-staged JSON an operator may later pass to `receipts/append.py` | Downloaded by the shell. Not written into `receipts/` by the page. |
| `runtime_front_door` | Documented session flow and read-only health links | Rendered by the shell. Not a stored session. |

These catalogs are not a second database of views, downloads, or lattice entries. Receipts that count are still the append-only files in `receipts/`. A browser `localStorage` draft is a staging scratch pad on that browser. It is not a lattice tip.

## `corpus_catalog`

`corpus/manifest.schema.json` is the machine schema. Each entry has:

| Field | Rule |
| --- | --- |
| `id` | Public slug: `[a-z0-9][a-z0-9._-]{0,63}` |
| `title` | Public title. |
| `kind` | `transcription`, `folio_image`, `ocr`, `public_baseline`, `materials`, or `aggregate`. |
| `license` | License or terms note for the pointer. |
| `source_url` | Public URL, or `null` when the entry is only an empty local slot. |
| `local_path` | Repo-relative path when `present` is true. Otherwise `null`. |
| `sha256` | Lowercase hex of the local bytes when `present` is true. Otherwise `null`. A remote file that was not copied has `sha256: null`. |
| `present` | `true` only when the local bytes are in this repo and `sha256` matches them. |
| `notes` | Honest scope. Empty slots say the operator may drop a file later. |
| `decryption_complete` | `false`. |

The catalog prefers public URLs (Beinecke / Yale, voynich.nu IVTFF, EVA, ZL, GC, RF, STA). It does not commit multi-megabyte manuscript dumps. Facsimile pixels stay on the publisher’s site until an operator supplies a file and records its hash.

## `test_method_registry`

Each method is a documented battery. `status` for a seeded method is `proposed`. A method becomes a chained test only after `receipts/append.py` appends a source file under a new `test_id`.

| Field | Rule |
| --- | --- |
| `method_id` | Public slug, same pattern as `test_id`. |
| `title` | Plain-language name. |
| `group` | One of the batteries listed in the 2026-10-30 site brief (spacing, language, ink, pages, materials, aggregates, OCR, domain studies, Markov / n-gram, academic citation slots). |
| `hypothesis` | The question the battery asks. A hypothesis is not an outcome. |
| `inputs` | Named corpus entries, receipt ids, or public URLs the procedure would read. |
| `procedure` | Ordered public steps. The shell displays them. It does not run them. |
| `metrics` | What a later run would record. |
| `citations` | `{label, href}` slots. An empty slot stays empty. |
| `related_test_ids` | Prep-store `test_id` values already chained, when the title is related reading. |
| `related_theory_ids` | Theory slugs. |
| `decryption_complete` | `false`. |
| `overclaim_cap` | The locked sentence. |

The shell’s “Create a testing method” form collects name, hypothesis, inputs, procedure, metrics, and an outcome sentence, then downloads a `staged_test_receipt`. Saving a draft in `localStorage` does not append the chain.

## `theory_registry`

Each theory is a hypothesis under test.

| Field | Rule |
| --- | --- |
| `theory_id` | Public slug. |
| `title` | Name taken from a receipt title or from the operator’s named hypothesis list. |
| `family` | `structure`, `handoff`, `mathematics`, `decompression`, `fusion`, `alphabet`, or `recovery`. |
| `status` | `hypothesis`. |
| `scope` | Short honest scope. When a name is absent from prep-store peek titles, the scope says so. |
| `method_hooks` | `method_id` values. |
| `related_test_ids` | Chained receipt ids. May be empty. |
| `runtime_slugs` | Optional front-door slugs. A slug is a tool hook. It is not a result. |
| `decryption_complete` | `false`. |

Seeded names include ABAD, Zero Dark Thirty, Universal Harmonics, the Aziel Sequence, Madhava–Leibniz, FoldLock-class fold / decompression, handoffs, mathematics, fusions, CPUA recovery, an operational alphabet, and template / slot grammar. Source outcomes already stored on receipts (including `FAIL` and `NO CANDIDATE PASSED`) stay quoted as source outcomes.

## `staged_test_receipt`

The shell may download this object. `receipts/append.py` does not parse it. The operator passes the file as `--append-file` and repeats `test_id`, `title`, `outcome`, and the optional confidence fields on the command line. The tool re-reads every earlier receipt, refuses a duplicate sha256 or `test_id`, and appends one v1 anchor. The page never writes `receipts/chain.jsonl`.

| Field | Rule |
| --- | --- |
| `schema` | `aziel.unseal-site.v1.1` |
| `type` | `staged_test_receipt` |
| `status` | `staged` |
| `test_id` | New slug, absent from the prep index. |
| `title`, `hypothesis`, `inputs`, `procedure`, `metrics` | The method text. |
| `outcome` | Sentence the operator will pass as `--outcome`. |
| `confidence_pct` | Integer `0`–`100`, or `null`. |
| `confidence_basis` | Required when `confidence_pct` is an integer. |
| `earlier_receipts_checked` | `false` on a browser stage. `append.py` performs the re-read. |
| `decryption_complete` | `false`. |
| `public_domain_tip` | `open`. |

The shell refuses to stage an outcome or title that asserts the manuscript is cracked, solved, or decrypted. The overclaim cap may still be stored beside those fields.

## `runtime_front_door`

The Runtime tab documents the public Aziel Runtime front door. It is a reading aid. The static page does not open a session and does not execute a slug.

| Item | Value |
| --- | --- |
| Primary host | `https://aziel-runtime.vibelock.workers.dev` |
| Corpus mirror | `https://www.azielcorpuslibrary.net/runtime` |
| Health | `GET /v1/health` |
| Skill | `GET /v1/skill` |
| Machine card | `GET /v1/runtime.json` |
| Catalog read | `GET /v1/software` and `GET /v1/fraggate/list` |
| Exec door | `POST /v1/fraggate/call` |
| Session order | `POST /v1/session/open` → `POST /v1/session/{id}/policy` → `POST /v1/session/{id}/exec` → `GET /v1/session/{id}/receipt` → `POST /v1/session/{id}/close` |
| Proxy | `POST /p/{slug}/{op}` is a proxy. It is not session exec and it is not the FragGate door. |
| Mutating calls | OpenAPI marks session open, policy, exec, and close with `RuntimeToken`. A token may be required. This repo does not store one. |

Slugs named for Voynich-adjacent work, front door only: `foldlock`, `spectrallock`, `aziel-corpus` (search, document-chain, media-run), `azclce`, `forgereceipts`, `temporallock`. Descriptions shown in the shell are the public `fraggate_describe` lines. Calling those ops is left to an operator who uses the door. The page ships links and a health read of `ok`, `product`, and `version`.

Cap-7 is not an ICANN registration and is not a public egress address. Paid satellite stays held. This extension does not buy a domain, change DNS, join a mesh, or spend money.

Active-node display is unchanged: `live_nodes` from `GET https://www.azielcorpuslibrary.net/v1/mesh`, with the runtime mirror used only as the mirror integer. The Runtime tab does not replace that count with a software-node roster.

## Receipts UI binding

The shell reads `receipts/index.json` and `receipts/chain.jsonl`.

- It shows `public_domain_tip` (`open`) separately from the prep-store `tip`.
- It checks chain linkage (`previous_hash`) and recomputes each `ledger_entry_hash` as SHA-256 of the canonical anchor with that field omitted (sorted keys, no extra whitespace, UTF-8).
- It filters rows by text and by a theory’s `related_test_ids`.
- It keeps `decryption_complete` false on display.
- It tells the reader that a site-staged file stays off the chain until `append.py` appends it.

## Shell conformance for v1.1

`TimeToUnsealTheBook.html` conforms to this extension when, in addition to the v1 shell rules, all of the following hold:

- The page opens on a splash that shows the Daniel 12:4 King James text and an Enter control. Enter reveals the tabs.
- The tabs are Corpus, Tests, Theories, Receipts, and Runtime.
- Corpus renders `corpus/manifest.json` and leaves `sha256` empty when `present` is false.
- Tests render `data/tests.json` and can stage a `staged_test_receipt` without writing the chain.
- Theories render `data/theories.json` as hypotheses. Source outcomes stay labeled as source outcomes.
- Receipts show the prep tip, the open public-domain tip, and the chain check.
- Runtime links health, skill, and `runtime.json` on the primary host and the corpus mirror, documents the session order, and states that proxy paths are not exec.
- The page has no IP gate, no Node Gate panel, and no operator tooling.
- Domain purchase, DNS, and deploy stay unexecuted.

## Display addendum `aziel.unseal-site.v1.2`

Catalog files stay on `aziel.unseal-site.v1` or `aziel.unseal-site.v1.1`. This addendum is the shell display contract. It does not retitle those files and it does not set `decryption_complete` true.

The v1 rule that the mesh read copies `live_nodes` only is relaxed for one added field: `nodes` (or `rollup.nodes`). Live Nodes stay `live_nodes` (or `rollup.mesh`). `software_nodes`, `active_nodes`, and `rollup.live` are still not painted as Nodes or Live Nodes. `node_gate` stays unread. The primary URL is `GET https://aziel-runtime.vibelock.workers.dev/v1/mesh`, with alias `GET /v1/mesh/status`. Mirrors that may supply the same two fields are `GET https://godlock.uk/health` and `GET https://www.azieleliab.com/v1/stats`. The primary pair wins when both integers are present.

Suite views and downloads are `combined.views` and `combined.downloads` from `GET https://aziel-runtime.vibelock.workers.dev/v1/stats-rollups`. Corpus views and downloads are `views` and `downloads` from `GET https://www.azielcorpuslibrary.net/stats`. This site's views and downloads are `GET /v1/unseal-counters` and stay null unless `complete` is true. That route does not increment. Hosted catalog `/v1` does not increment this site. The tallies are hits, not people.

The shell adds an Aziel tab beside the five v1.1 tabs. Philosophy text on that tab stays the draft stub in `#aziel-philosophy-draft` until Aziel reviews it. Receipts render as a tree by family and method group, and the chain check stays. Staged receipts name corpus tab `voynich` and leave `wrap_sent` false. Wrap and pull shapes are in `VOYNICH-CORPUS.md`. Cap-7 is not ICANN. Paid satellite stays held. This addendum does not deploy.