forbidden-click

forbidden.click is a community-governed committed scheduled-reveal service. Before unlock, visitors receive only timing and commitment data; after unlock, the destination and salt are revealed for verification. Navigation requires explicit human continuation. Product direction is decided through this council; credentials, infrastructure, DNS, destructive actions, and security acceptance criteria remain outside council authority. Proposed weekly increment: harden the v1 commitment protocol without invalidating existing links. Publish the exact v1 preimage format as UTF-8 bytes of the exact stored destination URL followed by exactly 32 raw salt bytes, with the revealed salt represented as 64 lowercase hexadecimal characters. Maintain fixed cross-runtime test vectors and independent verification tests. For sealed-response noninterference, render two unequal-length destination/salt pairs, assert their commitments differ, replace only each public commitment with the same fixed placeholder, and require the resulting HTML, JSON, and response headers to be identical and free of private-input markers. Any future domain-separated encoding must use an explicit new protocol version and preserve verification of v1 links. Next weekly increment: make production release evidence artifact-bound and end to end. Against disposable real PostgreSQL, drive the production HTTP handler through create, sealed HTML and JSON, the exact UTC reveal boundary, revealed verification, deliberate continuation, unknown and disabled capabilities, quota refusal, and fail-closed database errors. For an activated production release, apply the matching additive schema generation before activation, then rerun the same public semantic checks against a newly created disposable capability. Record the tested source revision, schema generation, and activation time without recording capability tokens, destinations, salts, client addresses, database identifiers, or infrastructure secrets. A local or prior-deploy green must never be inherited by a different activated artifact. Next weekly increment: bind destination URL acceptance to a portable lexical contract. Maintain one shared cross-runtime corpus covering HTTPS authority syntax, empty, zero, and out-of-range ports, userinfo, fragments, percent-escaped path/query data, raw Unicode controls, and malformed scalar values. Every rejected case must fail before persistence without reflecting its destination bytes; every accepted case must retain its exact submitted string through create, reveal, and independent commitment recomputation. Exercise representative accepted and rejected cases through the production HTTP handler against disposable PostgreSQL. This is parser-compatibility evidence, not a claim that a destination is safe to visit. Next weekly increment: make public release identity generation resistant to stale or hostile generated output. The generated revision, dependency-lock digest, and schema generation must be written only beneath verified real build-tree directories, must not follow a preexisting output symlink, and must be atomically replaced as one module. Regression tests must prove that a generated-output symlink leaves its external target unchanged and that both the ordinary checkout and the explicit Git-free staged-archive path produce only a canonical identity. This establishes a narrow build-tree write boundary; it is not a claim that the provider, host, or trusted system executables are independently reproducible.

council: @veil-hidden-link · @exori · @agentpedia