Colophon and contact

The short version

Bottom line. This site is a slice of an internal documentation corpus, published by the same pipeline discipline as everything else in the estate — and two independent controls decide what a reader is allowed to see.

• Risk managed — a page reaches the internet only if it carries an explicit publish flag and survives a fail-closed content scan of both the rendered source and the built bundle. An unflagged page is never rendered, so it cannot leak through a filter someone forgot.
• What it costs — publishing is slower and a mistake reds the build instead of reaching a reader. That is the intended trade.
• What is missing — stated plainly at the foot of this page rather than quietly left out.

Contact

• Email — clog.sized_68@icloud.com
• LinkedIn — linkedin.com/in/arronpitman
• Feeds — RSS · JSON Feed

That address is a per-service relay rather than a primary mailbox. It reaches me exactly as directly, and it means that if it ever starts receiving spam, the source is unambiguous — this site, and nothing else. The same practice applies to every third-party service the estate touches: one relay each, so a leak identifies its own origin.

How this site is built

The site is a static bundle built in the estate’s own CI and uploaded to a content-delivery edge. There is no home origin: no tunnel route, no reverse proxy, no access application. Nothing you request here reaches the estate, which is the whole reason the posture was chosen — publishing a showcase should not enlarge the attack surface of the thing being showcased.

Two independent controls decide what appears

Intent. A corpus page is published only if its own front matter carries an explicit opt-in flag. Everything else — the overwhelming majority — is absent from the tree the site builds from, not filtered out of it. Absence by construction rather than by a filter somebody could forget to apply.

Content. A second, independent gate scans everything that would ship — the rendered source and the built bundle — and fails the build on an internal address, an internal hostname, a known endpoint, an estate mailbox, a credential-shaped string or a high-entropy blob. It reds; it never rewrites. An automatic redaction would turn a loud failure into a silent transformation and leave an unproven sanitiser standing between a private corpus and the open internet.

It is scanned twice on purpose. “The build is a pure function of the input we already scanned” is exactly the proxy reasoning that lets an asset name or a bundled config string carry an identifier past the first pass.

Both controls were proven red before they were trusted green — one poisoned fixture per pattern, driven through the real entry point.

Every number here is derived, and none of it is live

The four interactive panels render JSON emitted by a build step that reads the estate directly. Each carries the timestamp it was taken and says, on the panel, that it is a build-time snapshot. There is no live feed, and there will not be one: a live panel would require publishing an interface into the estate, which is a larger change than any visualisation is worth.

If a data source is unavailable when the site builds, the build fails rather than rendering an empty chart or a placeholder value. The previous deployment keeps serving, and its panels state their own age. An empty chart and a working one look identical to a reader; a stale one that announces its age does not.

The topology panel goes further and asserts its own sanitisation: any surviving estate identifier, internal domain or private address in the emitted data aborts the build.

Colophon

Built with Astro and Starlight, pinned to exact versions, and shipping no third-party JavaScript at all. Diagrams used to be drawn in the reader’s browser by a megabyte of renderer; they are now rendered once at build time into static SVG, in both colour schemes, and the theme is switched by a CSS rule. What remains is about a kilobyte of the site’s own code for the full-screen diagram viewer, built on the platform’s <dialog> element. Type is a system stack — a webfont on a page whose argument is that it is fast and self-contained costs a render-blocking request to a third-party origin and buys a difference most readers will not name. Colour is defined once as tokens and inherited by the corpus pages, so the identity and the depth material cannot drift apart.

The site’s own dependencies are scanned into the estate’s dependency-tracking platform and watched for updates by the same automation as everything else, because a public asset with an unwatched supply chain would be an odd thing to publish alongside a chapter on supply-chain controls.

A note on what is missing

Some of this estate’s best material is not here, and will not be. Pages carrying internal addresses, hostnames or endpoints stay internal — sanitising them for publication would degrade the internal document for an external reason, which is the wrong trade. Where a chapter refers to a decision you cannot follow through to, that is why.

The corpus itself is the source of truth for all of it; this site is a slice, and it is designed so that adding to the slice is a one-line change to a page’s front matter and removing from it is the default.