Counts here come from the files that define them

Built for
the record.

A source-grounded corpus, a Postgres data plane with full-text and semantic retrieval, and a chronicler that cites the file behind every claim. Ingest, analyze, recall, operate.

This page, one line per chapter
  1. 1One canon, two lanes. Flat-file canon with a Postgres projection; the public lane carries aggregates only.
  2. 2Every claim anchored. Each answer cites its artifact ID and source path, with a line range where required.
  3. 3Co-occurrence, measured. The ten demonstration labels, every pair scored by Jaccard similarity.
  4. 4Three checks, one queue. Three required checks and a squash-only merge queue guard every change to main.
  5. 5Six services, one plane. Each service deploys as a scanned, leased, zero-traffic candidate; rollback is held until production probes pass.
  6. 6The production bar. Every pillar pinned to a file or a gate in the repository.

One canon, two lanes. Canon in the repository: aggregates go public, the full record to Postgres.

Architecture: one canon, two lanesSources and signed ingest callbacks become verbatim sidecars, then rows in one manifest beside the codices. From that canon a public lane builds an aggregate snapshot served by stonewall-public and stonewall-portal, and a private lane syncs the full record into Neon Postgres on merge for the cockpit, the Telegram bot, and the chat agent. An export guard between the lanes fails the build closed.buildsync on mergeINSourcesdocuments, email,transcripts,screenshotsCALLBACKSIngest webhookINTAKESidecars300 dpi OCR floor,500 dpi vision goldCANONManifest + codicescatalog/manifest.mdPUBLIC LANEAggregate snapshotcounts, neutral labelsPRIVATE LANENeon Postgresfull text, pgvector,memoryEXPORT GUARD · THE BUILD FAILS CLOSEDstonewall-publicstonewall-portalstonewall-cockpitstonewall-botchat-agent-service-c2e9Architecture: one canon, two lanesSources and signed ingest callbacks become verbatim sidecars, then rows in one manifest beside the codices. From that canon a public lane builds an aggregate snapshot served by stonewall-public and stonewall-portal, and a private lane syncs the full record into Neon Postgres on merge for the cockpit, the Telegram bot, and the chat agent. An export guard between the lanes fails the build closed.buildsync onmergeINSourcesdocuments, transcripts,email, screenshotsINGESTWebhooksignedcallbacksINTAKESidecars300 dpi OCR floor, 500 dpi vision goldCANONManifest + codicescatalog/manifest.mdPUBLIC LANESnapshotcounts, neutrallabels onlyPRIVATE LANENeon Postgresfull text,pgvector,memoryEXPORT GUARD · FAILS CLOSEDstonewall-publicstonewall-portalstonewall-cockpitstonewall-botchat-agent-service-c2e9
FIG 1 The wall between the lanes is a build step: the export guard fails the build closed.

The canon is flat files: one Markdown manifest indexes every artifact by ID, type, date, person and pattern, beside codices that keep identity, chronology and numbering from drifting. Gated tracked indexes are checked against it on each merge; corpus cross-reference freshness is advisory.

The public lane builds an aggregate snapshot, counts and neutral labels only, served by this site and the corpus API. An export guard checks the bundle against the public contract before the image is built, and fails the build on anything outside it.

The private lane rebuilds a queryable projection in Neon Postgres on merge: full source text, full-text search, and embeddings for semantic retrieval. Shelby’s memory lives there too, shared by the cockpit and Telegram.

Inside the data plane
Corpus projection
One row per manifest artifact, full source bodies, and the pattern taxonomy, all full-text indexed.
Semantic layer
Every canonical text file, chunked, with 1536-dimension embeddings under an HNSW cosine index.
Memory
Threads, messages, and durable per-operator memory, distilled in the background. Cockpit and Telegram read one memory.
Access
Row-level security, default-deny for generic roles, a read-only query role, and an idempotent, schema-versioned migrator.

PostgreSQL 17 · pgvector · HNSW cosine · numbered migrations

Every claim anchored. Each claim Shelby makes carries the file it came from.

The citation spineEach factual claim in an answer is bound to the manifest artifact ID and the repo-relative source path, with a line range where the claim requires one.ANSWER“The record shows the expertconceded the point on cross.”A0071artifact IDsources/…/*.pdf.mdsource pathL23line range,where required
FIG 2 The artifact ID and source path travel with every claim; the validator requires the line range on high-stakes claims.

Shelby does not summarize from memory. He walks the record artifact by artifact, and every factual claim is bound to a manifest ID and a repository source path, with a line range where required. Against the live corpus, the anchors open the source at the cited line.

Both surfaces call Anthropic’s Claude directly from Cloud Run and read one model pin; memory persists in Postgres, so the cockpit and Telegram answer as one chronicler. The full demo exchange lives on the landing page.

How a sidecar reads

The sources behind those anchors are transcribed verbatim, in two tiers.

Searchable floor
Machine text, so the page can be found.
  1. render at 300 dpi or more
  2. full-page raster OCR
  3. searchable sidecar
Gold
The screen record: every word, marker, and reaction.
  1. render at 500 dpi or more
  2. vision pass
  3. machine reaffirmation
  4. gold sidecar
Specimen sidecar, fictional. Nothing is summarized: a quoted reply nests above the reply that quotes it, and anything that is not text is bracketed and named.
Speaker B @ 09:16
> [quoted: Speaker A @ 09:14]
> Can you send the exhibit list before the call?
Sent. Two attachments below.
[IMAGE: exhibit list, page 1 of 3, four-column table]
[reaction: thumbs up · Speaker A]

Co-occurrence, measured. Shared over combined artifacts, for the ten labels in the public snapshot.

Drawing the Jaccard matrix…

Strongest pairs

  1. Motion Posture Witness SequencingJaccard 0.27
  2. Calendar Control Billing HygieneJaccard 0.23
  3. Witness Sequencing Billing HygieneJaccard 0.23
  4. Exhibit Chain Service of ProcessJaccard 0.17
  5. Calendar Control Deadline CadenceJaccard 0.16
FIG 3 Ten demonstration labels; 22 of the 45 possible pairs shown across 939 indexed artifacts, from the public aggregate snapshot. Strongest: Motion Posture and Witness Sequencing, sharing 26 artifacts (J = 0.27). The stronger the overlap, the stronger the cell; the strongest pair is outlined.

Three checks, one queue. Every change clears three required checks, then a squash-only queue.

The merge contractA pull request must pass verify, protected code/config scan, CodeQL gate. It then lands through the merge queue (squash, one at a time) onto main, where a path-scoped Cloud Build trigger starts the service's deploy lane.CHANGEPull requestverifyprotected code/config scanCodeQL gateMERGE QUEUESquash, one at a timeall green, built on mainBRANCHmainCLOUD BUILDTriggerpath-scoped,one per serviceThe merge contractA pull request must pass verify, protected code/config scan, CodeQL gate, then lands through the merge queue onto main, where a path-scoped Cloud Build trigger starts the service's deploy lane.CHANGEPull requestRULESETThree required checksMERGE QUEUESquash, one at a timeall green, built on mainBRANCHmainCLOUD BUILDTriggerpath-scoped, one per service
FIG 4 Each queue entry is built on main; review bots comment but never gate. After main, each service’s own trigger runs its deploy lane, listed below.
The three checks, and the rules behind them
verify
Lint, types, builds, tests, and the corpus suite: ruff, mypy, yamllint, stylelint, shellcheck, actionlint, zizmor; the public app, the cockpit, and the command worker built and tested; per-route bundle budgets; then manifest consistency, the ontology, freshness of gated tracked indexes, content-hash stamps, and identity and rendering audits. Corpus cross-reference freshness is advisory in ordinary verification.
protected code/config scan
Secret scanning on code and configuration, on every pull request and every queue entry. An advisory scan runs over the corpus beside it.
CodeQL gate
Three analyzers: GitHub Actions, JavaScript and TypeScript, Python. The gate passes only when all three finish.

The rules it was built around

  1. Pointers are not facts.
  2. The rendering layer can lie.
  3. Merge-critical truth is machine-enforced.

And for every gate: it must be satisfiable, falsifiable, and fail only on a real defect.

What the lane refuses

Every service deploys through the same eight-stage lane. The numerals mark where it can refuse a deploy.

  1. Build the image, then a filesystem gate
  2. Scan Trivy, fixable high and critical findingsi
  3. Guard the main tip is unchangedii
  4. Lease one build per serviceiii
  5. Candidate tagged, at zero traffic
  6. Probe the exact commit, readyiv
  7. Promote full traffic, production probesv
  8. Finalize rollback held, lease released
MarkConditionCaught byResult
iA fixable high- or critical-severity finding in the imageTrivy, before pushThe build stops; nothing is published.
iiMain advanced with changes to this serviceThe main-tip guardThe build stops before publishing; the newer build deploys.
iiiAnother build holds the serviceThe deploy leaseThis build waits for the owner to finish.
ivThe candidate serves the wrong commit or fails readinessThe candidate probeTraffic never moves; production is untouched.
vA production probe fails after promotionPromote and finalizeThe prior revision is restored.
—Derived artifacts sit behind their sourcesverify, on the pull request and in the queueRefused until they are regenerated and committed.

Six services, one plane. Cloud Run, one region: one service and one build trigger per workload.

stonewall-publicPublic lane
stnwl.ai — this sitePublic lane
stonewall-cockpitPrivate lane
app.stnwl.ai — the operator cockpit and ShelbyPrivate lane
stonewall-portalPublic lane
api.stnwl.ai — the corpus APIPublic lane
stonewall-botPrivate lane
Shelby on TelegramPrivate lane
knowledge-base-webhookCallbacks
Signed ingest callbacksCallbacks
chat-agent-service-c2e9Private lane
The operator’s Google Chat agent, bounded toolsPrivate lane
stonewall-commandPrivate lane · Cloudflare Workers
The operator’s command agent, behind Cloudflare AccessPrivate lane · Cloudflare Workers
Triggers, edge and uptime

The roster above is read from the one surface file CI probes live. One more surface runs beside the fleet on Cloudflare Workers, deployed by hand. The apex sits behind a global external HTTPS load balancer with managed certificates. The stnwl.ai DNS zone uses Google Cloud DNS; stonewall.esq retains Cloudflare DNS-only nameservers. Eleven uptime checks run at a five-minute cadence, with alert policies for uptime-check failures.

ServiceDeploy configTrigger
stonewall-publiccloudbuild.public.yamlstonewall-public-main-push
stonewall-cockpitweb/cloudbuild.cockpit.yamlstonewall-cockpit-main-push
stonewall-portalcloudbuild.yamlstonewall-main-push
stonewall-botscripts/stonewall_bot/cloudbuild.bot.yamlstonewall-bot-main-push
knowledge-base-webhookcloudbuild.webhook.yamlstonewall-kb-webhook-main-push
chat-agent-service-c2e9apps/chat-agent/cloudbuild.chat-agent.yamlstonewall-chat-agent-main-push
stonewall-commandapps/stonewall-command/wrangler.jsoncwrangler deploy, operator-run
The full stack
Languages
Python 3.12 / 3.13 / 3.14, by service · TypeScript · Node 24 · Markdown
Canon
catalog/manifest.md · Markdown + JSON · stdlib stonewall.py CLI
Data plane
Neon Postgres 17 · pgvector, HNSW · Row-level security
Embeddings
Vercel AI Gateway, the embedding transport · text-embedding-3-small, 1536 dimensions
Public site
Next.js 16 standalone · Distroless Node 24 · Self-hosted Geist + Newsreader · GA4, deferred
Corpus API
FastAPI · Uvicorn · Repo JSON + in-memory search index
Cockpit
Next.js 16 · React 19 · Tailwind · Clerk · AI SDK
Shelby
Anthropic Claude · Claude Fable 5.1, the deploy-lane pin · A smaller Claude tier for distillation
Voice and audio
Whisper · Gemini 2.5 Pro, listening · TTS-1-HD
Chat agent
Gemini 2.5 Flash on Vertex AI · Bounded tools, read-only SQL
Intake
pypdfium2 · Tesseract · extract-msg · Two-pass vision
CI
GitHub Actions · pytest · Vitest · Playwright · CodeQL · gitleaks · Trivy
Infrastructure
Cloud Run · Cloud Build · Artifact Registry · Cloud DNS · HTTPS load balancer · Terraform · Cloud Monitoring

The production bar. Five pillars, each pinned to a file or a gate.

Reliability
Zero-traffic candidates, rollback held, hashed assets, live probes.
Security
Secret and image scanning, CodeQL, an export guard, default-deny data.
Performance
Invariants in CI, per-route bundle budgets, self-hosted type.
Operations
One service per workload; triggers and merge rules as code.
Cost
Scope-aware CI, frozen lockfiles, duplicate runs cancelled.
Files and gates

Reliability

  • Zero-traffic candidate, rollback heldscripts/cloud_run_safe_promote.pyCloud Build probes, every lane
  • Content-hashed assetsscripts/asset_version_stamp.pyverify
  • Declared surfaces, probed livecatalog/intake/state/surfaces.tomlaudit_surface_state.py
  • Cockpit reads with the API coldweb/lib/api.tsbundled snapshot fallback

Security

  • Secret scanning.github/workflows/gitleaks.ymlprotected code/config scan
  • Static analysis.github/workflows/codeql.ymlCodeQL gate
  • Public export guardscripts/assert_public_portal_payload.pyfails the build
  • Operator boundaryweb/middleware.tsallowlist, fails closed
  • Default-deny data accessweb/migrations/postgres/0028-data-api-default-deny.sqlrow-level security
  • Security headers, pinned actionsnext.config.jsactionlint and zizmor in verify

Performance

  • Performance invariantsscripts/check_web_perf_invariants.pyverify
  • Per-route bundle budgetsweb/perf-budgets.jsonpnpm check:bundles
  • Self-hosted type, deferred analyticstests/test_public_perf_invariants.pyverify

Operations

  • Triggers declared in codeterraform/edge.tftrigger roster audit, live
  • Merge rules as codedocs/ruleset-policy.jsonapply_ruleset_policy.py
  • Gates tested on a clean treescripts/audit_gate_lane_parity.py--check and --canary

Cost

  • Corpus-only verify for prosescripts/detect_pr_change_scope.pyverify scope
  • Frozen lockfilesDockerfile.publicpnpm install --frozen-lockfile
  • Duplicate runs cancelled.github/workflows/cancel-runs-on-janitor-close.ymljanitor
  • Warm capacity per servicedocs/deployment-current-state.mdpublic 2 · portal, cockpit, bot 1 · webhook, chat agent 0
How it was built

The innovations book was first written in May 2026, in ten chapters. The first seven are condensed here and corrected to the system as it runs today; the milestones follow.

  1. The manifest is the database. Sequential artifact IDs, typed rows, joins across people, patterns, and dates, analysis flags. A stdlib CLI queries it; verify checks the gated tracked indexes against it.catalog/manifest.mdscripts/stonewall.py
  2. Agents route on purpose. Ordered reading bundles per task replace reading the whole repository. One sentence of case state fans out to every codex, index, and snapshot in a single sweep.context/MASTER_INDEX.mdscripts/lock_case_state.py
  3. The verification spine. One suite is the merge contract: a corpus-only mode for prose, the whole suite for code. Identity, rendering, and cross-surface drift each carry their own audit.scripts/verify_all.pyscripts/pre_pr_check.py
  4. One truth, many doors. A single declared surface file names every live service, hostname, trigger, and probe; the deployment docs render from it and CI probes it live.catalog/intake/state/surfaces.tomlscripts/render_surface_docs.py
  5. The evidence layer. Two-pass vision renders at 500 dpi or better produce the gold sidecars; full-page raster OCR at 300 dpi or better is the searchable floor. Reply chains nest; nothing is summarized.references/bubble_render_doctrine.mdscripts/batch_sidecar_gold_uplift.py
  6. The operator cockpit. Clerk-gated, with a fallback chain of live API, bundled snapshot, and public data, so an artifact still reads when an upstream service is cold.web/lib/api.tsscripts/build_cockpit_operator_snapshot.py
  7. Documentation that keeps pace. An on-demand scanner lists the pages that still cite changed paths or symbols; a scheduled documentation pass opens ordinary pull requests through the queue; a janitor keeps one survivor per topic.scripts/docs_api_drift.py.github/workflows/close-duplicate-doc-prs.yml
  1. The control-plane campaign: artifact reader, agent context snapshots, dedupe index, drift audits.
  2. Google Cloud Run becomes the deploy plane.
  3. The merge queue settles on main.
  4. The last external hosts retire; stnwl.ai DNS moves to Google Cloud DNS. The compatibility domain retains Cloudflare DNS.
  5. The public surface consolidates to four destinations.
  6. A sixth service joins the fleet: the operator’s chat agent.
  7. Review threads leave the merge gate; three checks and the queue are the whole contract.
  8. Every service deploys through the guarded lane.

Chapters IX and X now live on this page: the production bar above, and the one line per chapter at the top.

Go deeper. The record this machinery serves, and how its labels relate.