GitLab

SERVED 2026-10-23 (fleet reserve). REAL GITLAB ANSWERS 200 HERE whatever a group has published, and the body is now transcribed from GitLab's own source rather than guessed: `Packages::Composer::PackagesPresenter` over an empty package set, which is the set here because `package.kind` carries no `composer` row. This row is the PROVIDER document, `{"providers":{}}`, served whatever sha addresses it, because GitLab never checks the sha: it is the client's cache key, and the root publishes the digest of exactly these bytes.

A `Packages::Debian::Distribution` is a CONFIGURATION OBJECT an operator creates with a write, not a package - and this universe has issued no writes, so both containers publish the empty list GitLab publishes for a scope that never ran `POST /debian_distributions`. This is a claim about olympus-labs rather than about the generation: the registry EXISTS on a hello-20 artifact and holds no Debian distribution. All eleven declared filters are answered rather than refused, because each narrows a collection that is empty before it narrows anything and the answer is the same either way (the two array parameters are accepted in Grape's bracketed spelling too, `components[]` and `architectures[]`, which is what a real client sends); the `shape` DRIVES the claim, so the day canon grows a distribution the row reds rather than letting those filters go on being ignored. Classified `derive` rather than `empty` DELIBERATELY: `packages/conformance/src/manifest/honest-empty-served.test.ts` runs every GitLab `empty` row on the DEFAULT hello-4 harness and argues that "a row that needed hello-20 to answer `[]` would be a generation gap wearing a ruling's clothes" - and this row answers `noPackageRegistry` on a hello-19 artifact, so it is exactly the row that rule excludes. Its conformance entry carries a `shape` instead, which is STRICTER than `expectsEmpty`: it checks BOTH ENDS, the empty collection on the wire AND the absence of that ecosystem in `packagesForRepo()`, so the day canon publishes one the row reds on the canon side before the response even changes.. This route answers the group's list. SERVED 2026-09-14 (hello-20 `packageRegistry`): gated on `reader.hasPackageRegistry()`, with the project or group resolving FIRST so an unknown one is GitLab's own 404 on every generation. An older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers `noPackageRegistry`, the named generation gap, rather than `[]`: an empty package list would claim an organization with three tagged releases, 344 build outputs and a root `Dockerfile` publishes nothing, which the same artifact contradicts

The NuGet search, RUN over `packagesForRepo()` rather than skipped: `package.kind` is npm, golang, pypi or generic on every row of every artifact, so no `nuget` package exists to match any query and `{totalHits: 0, data: []}` is exactly what GitLab answers for a feed with nothing in it. `q`, `skip`, `take` and `prerelease` are all accepted; each narrows a result set that is empty before it narrows anything. The conformance `shape` DRIVES the claim, so the day canon publishes a NuGet package this row goes red instead of hiding it. Classified `derive` rather than `empty` DELIBERATELY: `packages/conformance/src/manifest/honest-empty-served.test.ts` runs every GitLab `empty` row on the DEFAULT hello-4 harness and argues that "a row that needed hello-20 to answer `[]` would be a generation gap wearing a ruling's clothes" - and this row answers `noPackageRegistry` on a hello-19 artifact, so it is exactly the row that rule excludes. Its conformance entry carries a `shape` instead, which is STRICTER than `expectsEmpty`: it checks BOTH ENDS, the empty collection on the wire AND the absence of that ecosystem in `packagesForRepo()`, so the day canon publishes one the row reds on the canon side before the response even changes.. This route answers the group's search. SERVED 2026-09-14 (hello-20 `packageRegistry`): gated on `reader.hasPackageRegistry()`, with the project or group resolving FIRST so an unknown one is GitLab's own 404 on every generation. An older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers `noPackageRegistry`, the named generation gap, rather than `[]`: an empty package list would claim an organization with three tagged releases, 344 build outputs and a root `Dockerfile` publishes nothing, which the same artifact contradicts

SERVED 2026-10-23 (fleet reserve). REAL GITLAB ANSWERS 200 HERE whatever a namespace has published, and the body is now transcribed from GitLab's own source rather than guessed: the old reason held these rows until the bytes could be checked against GitLab's publication, and GitLab's presenters ARE its publication. This row is the EDMX metadata document, `MetadataIndexPresenter#xml`, which is the same for every project and group because it describes the feed's entity type (`V2FeedPackage`) and its `FindPackagesById` function, not any package.

Conan's OWN search, RUN over `packagesForRepo()` rather than skipped: `package.kind` is npm, golang, pypi or generic on every row of every artifact (the F1 decision's own enum ruling), so no Conan recipe of the form `name/version@user/channel` exists in this registry, so no pattern can match and `{"results": []}` is the whole answer. the `shape` DRIVES it, so the day canon publishes a Conan recipe this row goes red. The recipe ADDRESSES under the same prefix are `refuse` - the same fact read the other way round, and GitLab's own 404 for an object that cannot exist. Classified `derive` rather than `empty` DELIBERATELY: `packages/conformance/src/manifest/honest-empty-served.test.ts` runs every GitLab `empty` row on the DEFAULT hello-4 harness and argues that "a row that needed hello-20 to answer `[]` would be a generation gap wearing a ruling's clothes" - and this row answers `noPackageRegistry` on a hello-19 artifact, so it is exactly the row that rule excludes. Its conformance entry carries a `shape` instead, which is STRICTER than `expectsEmpty`: it checks BOTH ENDS, the empty collection on the wire AND the absence of that ecosystem in `packagesForRepo()`, so the day canon publishes one the row reds on the canon side before the response even changes.. This route is the INSTANCE-wide v1 search, across every project the caller can read. SERVED 2026-09-14 (hello-20 `packageRegistry`): gated on `reader.hasPackageRegistry()`, with the project or group resolving FIRST so an unknown one is GitLab's own 404 on every generation. An older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers `noPackageRegistry`, the named generation gap, rather than `[]`: an empty package list would claim an organization with three tagged releases, 344 build outputs and a root `Dockerfile` publishes nothing, which the same artifact contradicts

A `Packages::Debian::Distribution` is a CONFIGURATION OBJECT an operator creates with a write, not a package - and this universe has issued no writes, so both containers publish the empty list GitLab publishes for a scope that never ran `POST /debian_distributions`. This is a claim about olympus-labs rather than about the generation: the registry EXISTS on a hello-20 artifact and holds no Debian distribution. All eleven declared filters are answered rather than refused, because each narrows a collection that is empty before it narrows anything and the answer is the same either way (the two array parameters are accepted in Grape's bracketed spelling too, `components[]` and `architectures[]`, which is what a real client sends); the `shape` DRIVES the claim, so the day canon grows a distribution the row reds rather than letting those filters go on being ignored. Classified `derive` rather than `empty` DELIBERATELY: `packages/conformance/src/manifest/honest-empty-served.test.ts` runs every GitLab `empty` row on the DEFAULT hello-4 harness and argues that "a row that needed hello-20 to answer `[]` would be a generation gap wearing a ruling's clothes" - and this row answers `noPackageRegistry` on a hello-19 artifact, so it is exactly the row that rule excludes. Its conformance entry carries a `shape` instead, which is STRICTER than `expectsEmpty`: it checks BOTH ENDS, the empty collection on the wire AND the absence of that ecosystem in `packagesForRepo()`, so the day canon publishes one the row reds on the canon side before the response even changes.. This route answers the project's list. SERVED 2026-09-14 (hello-20 `packageRegistry`): gated on `reader.hasPackageRegistry()`, with the project or group resolving FIRST so an unknown one is GitLab's own 404 on every generation. An older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers `noPackageRegistry`, the named generation gap, rather than `[]`: an empty package list would claim an organization with three tagged releases, 344 build outputs and a root `Dockerfile` publishes nothing, which the same artifact contradicts

FOUNDER RULING F4 (2026-09-14), "package files = digest + deterministic rebuild", on the wire. The artifact stores `size_bytes` and `sha256` and NO BYTES, and this route rebuilds them at request time through `packageArchive(reader.treeFiles(version.commit_id), packageArchiveRoot(package.name, version.version), version.published_epoch, packageArchiveFormat(package.kind))` - the SAME `@sandboxapis/archive` entry point `compiler/src/compile.ts`'s `packageArchiveBytes()` measured the digest with, so `shasum` on the download returns the `file_sha256` the file list published. A `source_kind: artifact` file rebuilds nothing: it republishes the build output a job really uploaded, whose bytes are `artifactContent()` and whose digest the compiler measured over exactly those bytes, so the package surface and the Actions surface quote the same two numbers for the same upload. The digest is deliberately NOT rehashed on the request path - `verifyPackageFileDigests()` already fails the COMPILE on a mismatch, on every compile of every template - and conformance hashes the served bytes against the row instead, which is the check that catches this renderer rebuilding the archive a different way from that one. SERVED 2026-09-14 (hello-20 `packageRegistry`): gated on `reader.hasPackageRegistry()`, with the project or group resolving FIRST so an unknown one is GitLab's own 404 on every generation. An older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers `noPackageRegistry`, the named generation gap, rather than `[]`: an empty package list would claim an organization with three tagged releases, 344 build outputs and a root `Dockerfile` publishes nothing, which the same artifact contradicts

CARGO'S OWN registry-index configuration - `dl`, `api`, `auth-required` - which describes the registry rather than its crates and is therefore as true of a project with none. Both URLs are this project's own cargo root, derived from the request's own host and the project's id; `auth-required` is `true` because real GitLab requires a token on every cargo route, and reporting `false` would describe THIS host rather than the one being mirrored (invariant #2). The five crate-index and download addresses under it are `refuse`: no `cargo` package exists to be indexed, and GitLab's own 404 is the whole answer there. SERVED 2026-09-14 (hello-20 `packageRegistry`): gated on `reader.hasPackageRegistry()`, with the project or group resolving FIRST so an unknown one is GitLab's own 404 on every generation. An older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers `noPackageRegistry`, the named generation gap, rather than `[]`: an empty package list would claim an organization with three tagged releases, 344 build outputs and a root `Dockerfile` publishes nothing, which the same artifact contradicts

GitLab answers `ping` with a HEADER-ONLY 200 whose `X-Conan-Server-Capabilities` is the EMPTY list - `header 'X-Conan-Server-Capabilities', [].join(',')` in its own Conan API - and this replica supports no Conan capability either, so the empty value is the TRUE one rather than a stub and the body is genuinely absent. It is the one Conan route that asks nothing about a recipe, which is why it is served where the recipe addresses are refused. This route is the project-scoped ping, whose project still has to resolve - a ping for a project nobody has is GitLab's own 404, not a cheerful 200. SERVED 2026-09-14 (hello-20 `packageRegistry`): gated on `reader.hasPackageRegistry()`, with the project or group resolving FIRST so an unknown one is GitLab's own 404 on every generation. An older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers `noPackageRegistry`, the named generation gap, rather than `[]`: an empty package list would claim an organization with three tagged releases, 344 build outputs and a root `Dockerfile` publishes nothing, which the same artifact contradicts

HELM'S OWN repository-index format - `apiVersion`, `entries`, `generated` - which is what a Helm client asks a repository for before it knows whether there is anything in it, so every channel answers rather than only a configured one. `entries` is `{}` because `package.kind` carries no `helm` row, and `generated` is the ARTIFACT'S OWN ANCHOR (`reader.meta().anchorEpochSec`) rather than a clock read: a frozen universe has no now, and a timestamp that moved with the calendar would make one pin answer differently on two days - the call ./depth-runners.ts makes for a runner's `online`. GitLab also emits `serverInfo.contextPath`; it is OMITTED rather than guessed, because Helm's format does not require it and no client reads it to find a chart. The `.tgz` chart address is `refuse`. SERVED 2026-09-14 (hello-20 `packageRegistry`): gated on `reader.hasPackageRegistry()`, with the project or group resolving FIRST so an unknown one is GitLab's own 404 on every generation. An older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers `noPackageRegistry`, the named generation gap, rather than `[]`: an empty package list would claim an organization with three tagged releases, 344 build outputs and a root `Dockerfile` publishes nothing, which the same artifact contradicts

The NuGet search, RUN over `packagesForRepo()` rather than skipped: `package.kind` is npm, golang, pypi or generic on every row of every artifact, so no `nuget` package exists to match any query and `{totalHits: 0, data: []}` is exactly what GitLab answers for a feed with nothing in it. `q`, `skip`, `take` and `prerelease` are all accepted; each narrows a result set that is empty before it narrows anything. The conformance `shape` DRIVES the claim, so the day canon publishes a NuGet package this row goes red instead of hiding it. Classified `derive` rather than `empty` DELIBERATELY: `packages/conformance/src/manifest/honest-empty-served.test.ts` runs every GitLab `empty` row on the DEFAULT hello-4 harness and argues that "a row that needed hello-20 to answer `[]` would be a generation gap wearing a ruling's clothes" - and this row answers `noPackageRegistry` on a hello-19 artifact, so it is exactly the row that rule excludes. Its conformance entry carries a `shape` instead, which is STRICTER than `expectsEmpty`: it checks BOTH ENDS, the empty collection on the wire AND the absence of that ecosystem in `packagesForRepo()`, so the day canon publishes one the row reds on the canon side before the response even changes.. This route answers the project's search. SERVED 2026-09-14 (hello-20 `packageRegistry`): gated on `reader.hasPackageRegistry()`, with the project or group resolving FIRST so an unknown one is GitLab's own 404 on every generation. An older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers `noPackageRegistry`, the named generation gap, rather than `[]`: an empty package list would claim an organization with three tagged releases, 344 build outputs and a root `Dockerfile` publishes nothing, which the same artifact contradicts

SERVED 2026-10-23 (fleet reserve). REAL GITLAB ANSWERS 200 HERE whatever a namespace has published, and the body is now transcribed from GitLab's own source rather than guessed: the old reason held these rows until the bytes could be checked against GitLab's publication, and GitLab's presenters ARE its publication. This row is the EDMX metadata document, `MetadataIndexPresenter#xml`, which is the same for every project and group because it describes the feed's entity type (`V2FeedPackage`) and its `FindPackagesById` function, not any package.

RUBYGEMS' dependency API, which speaks MARSHAL rather than JSON - the protocol `gem install` actually uses - so the body is `Marshal.dump([])`, the four bytes `04 08 5B 00`, at `application/octet-stream`. Every name a caller asks after resolves to nothing because no `rubygems` package exists here, which is the answer RubyGems' own protocol gives for an unknown gem rather than a 404. `gems` is REQUIRED by the operation and its absence is Grape's own `{"error": "gems is missing"}` envelope - a different body from every other GitLab error, and GitLab's (./render-archives.ts mirrors the same envelope for a missing `job`). The three `.gem` file addresses are `refuse`. SERVED 2026-09-14 (hello-20 `packageRegistry`): gated on `reader.hasPackageRegistry()`, with the project or group resolving FIRST so an unknown one is GitLab's own 404 on every generation. An older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers `noPackageRegistry`, the named generation gap, rather than `[]`: an empty package list would claim an organization with three tagged releases, 344 build outputs and a root `Dockerfile` publishes nothing, which the same artifact contradicts

SERVED 2026-10-23 (fleet reserve). REAL GITLAB ANSWERS 200 HERE whatever a namespace has published, and the body is now transcribed from GitLab's own source rather than guessed: the old reason held these rows until the bytes could be checked against GitLab's publication, and GitLab's presenters ARE its publication. This row is `OdataPackageEntryService` reached through `$filter=(tolower(Id) eq '<name>')`, the same version-less Atom entry `FindPackagesById()` answers for the same name, because GitLab routes both to one service that reads no package. `$filter` is required and must name a package, a Grape 400 otherwise.

`package` and `package_version` through `packagesForRepo()` then `packageVersions()` - the two SCOPED accessors, because hello-19's reader rule leaves no `listPackages()`. A GitLab package row is a (name, version) pair, so canon's four packages are ELEVEN GitLab packages and `{package_id}` is the VERSION's id, never the `package` row's. `tags` is `[]` and is an ARRAY against a document that types it `string` - a declared deviation, because `Entities::Package` exposes it unconditionally and GitLab's own group example prints `"tags": []`, and canon mints no package tag so no npm dist-tag points at any version. `last_downloaded_at` is OMITTED (canon records no download) and so is `_links.delete_api_path`, which GitLab's own entity omits exactly when the caller may not destroy the package - on a read-only replica, every caller. This route answers one row per published version of this project, in GitLab's documented default order (`order_by=created_at`, `sort=asc`, canonical id as the total-order tie-break), with all six declared filters answered. `include_versionless` is answered rather than refused because BOTH VALUES SELECT THE SAME ROWS - every package here has a version - which is ./render-archives.ts's `include_lfs_blobs` precedent and not a silently dropped filter; `status` narrows to the empty list for anything but `default`, because canon mints no hidden, processing or error package. SERVED 2026-09-14 (hello-20 `packageRegistry`): gated on `reader.hasPackageRegistry()`, with the project or group resolving FIRST so an unknown one is GitLab's own 404 on every generation. An older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers `noPackageRegistry`, the named generation gap, rather than `[]`: an empty package list would claim an organization with three tagged releases, 344 build outputs and a root `Dockerfile` publishes nothing, which the same artifact contradicts

refuse — This address names a Debian DISTRIBUTION by codename, and no `debian_distribution` exists in this universe: a distribution is created by a write and this replica has issued none, which is exactly why the two LIST routes answer `[]` rather than a 404. GitLab's own 404 for an object that cannot exist is the whole answer here (the group's).

refuse — This address names a FILE IN THE DEBIAN POOL - a `.deb`, `.dsc` or `.tar.xz` of a published source or binary package. `package.kind` carries no `debian` row on any artifact, and no `debian_distribution` exists to hold a pool, so both halves of the address name things that cannot exist; GitLab's own 404 is the whole answer, and serving an npm tarball under a `.deb` name would break every client that unpacks by extension (the group's pool, which addresses the project inside the path).

refuse — This address names a Conan RECIPE, a binary package of one, or a file inside one, at the instance-wide v1 API, and `package.kind` is npm, golang, pypi or generic on every row of every artifact (the F1 decision's own enum ruling), so no Conan recipe of the form `name/version@user/channel` exists in this registry. GitLab's own 404 for an object that cannot exist is the whole answer; serving an npm tarball or a Go module through Conan's recipe API would hand `conan install` something that is not a recipe, which is invariant #4's invented value wearing a provider's clothes. The two Conan questions that ask nothing about a recipe - `conans/search` and `ping` - ARE served (hello-20 `packageRegistry`, 2026-09-14)

refuse — This address names a Conan RECIPE, a binary package of one, or a file inside one, at the instance-wide v1 API, and `package.kind` is npm, golang, pypi or generic on every row of every artifact (the F1 decision's own enum ruling), so no Conan recipe of the form `name/version@user/channel` exists in this registry. GitLab's own 404 for an object that cannot exist is the whole answer; serving an npm tarball or a Go module through Conan's recipe API would hand `conan install` something that is not a recipe, which is invariant #4's invented value wearing a provider's clothes. The two Conan questions that ask nothing about a recipe - `conans/search` and `ping` - ARE served (hello-20 `packageRegistry`, 2026-09-14)

refuse — This address names a Conan RECIPE, a binary package of one, or a file inside one, at the instance-wide v1 API, and `package.kind` is npm, golang, pypi or generic on every row of every artifact (the F1 decision's own enum ruling), so no Conan recipe of the form `name/version@user/channel` exists in this registry. GitLab's own 404 for an object that cannot exist is the whole answer; serving an npm tarball or a Go module through Conan's recipe API would hand `conan install` something that is not a recipe, which is invariant #4's invented value wearing a provider's clothes. The two Conan questions that ask nothing about a recipe - `conans/search` and `ping` - ARE served (hello-20 `packageRegistry`, 2026-09-14)

refuse — This address names a Conan RECIPE, a binary package of one, or a file inside one, at the instance-wide v1 API, and `package.kind` is npm, golang, pypi or generic on every row of every artifact (the F1 decision's own enum ruling), so no Conan recipe of the form `name/version@user/channel` exists in this registry. GitLab's own 404 for an object that cannot exist is the whole answer; serving an npm tarball or a Go module through Conan's recipe API would hand `conan install` something that is not a recipe, which is invariant #4's invented value wearing a provider's clothes. The two Conan questions that ask nothing about a recipe - `conans/search` and `ping` - ARE served (hello-20 `packageRegistry`, 2026-09-14)

refuse — This address is a Conan AUTHENTICATION PROBE - `users/authenticate` answers a JWT, `check_credentials` validates one - and it is refused on two independent legs. FIRST, the condition: this project's Conan registry holds nothing to authenticate against, because `package.kind` is npm, golang, pypi or generic on every row of every artifact, and 404 is one of the THREE responses the vendored operation itself declares (200 / 401 / 404) - REFUSE_SHAPES.md paragraph 2 picks between an operation's declared errors by the condition the reason describes, and 401 is GitLab's answer for a caller whose credential is missing or invalid, which would be a false claim about the CALLER on a host whose gateway authenticated them. SECOND, THIS UNIVERSE ISSUES NO TOKEN: there is no session and no secret to sign with, so a JWT minted here would be a credential invented by the replica (the PagerDuty routing-key rule, 2026-09-03). Keeping the whole Conan block on one status is what makes it reviewable, and it widens no type union (ruled by the wave coordinator, 2026-09-14)

refuse — This address names a Debian DISTRIBUTION by codename, and no `debian_distribution` exists in this universe: a distribution is created by a write and this replica has issued none, which is exactly why the two LIST routes answer `[]` rather than a 404. GitLab's own 404 for an object that cannot exist is the whole answer here (the project's).

refuse — A crate's `.crate` archive. `package.kind` carries no `cargo` row on any artifact, so this project publishes no crate and this address names one that cannot exist; GitLab's own 404 is the whole answer. The registry CONFIGURATION a `cargo` client reads first - `cargo/config.json` - IS served (hello-20 `packageRegistry`, 2026-09-14), because it describes the registry rather than its crates

refuse — The single-character sparse-index shard for a crate. `package.kind` carries no `cargo` row on any artifact, so this project publishes no crate and this address names one that cannot exist; GitLab's own 404 is the whole answer. The registry CONFIGURATION a `cargo` client reads first - `cargo/config.json` - IS served (hello-20 `packageRegistry`, 2026-09-14), because it describes the registry rather than its crates

refuse — The three-character sparse-index shard for a crate. `package.kind` carries no `cargo` row on any artifact, so this project publishes no crate and this address names one that cannot exist; GitLab's own 404 is the whole answer. The registry CONFIGURATION a `cargo` client reads first - `cargo/config.json` - IS served (hello-20 `packageRegistry`, 2026-09-14), because it describes the registry rather than its crates

refuse — This address names a Conan RECIPE, a binary package of one, or a file inside one, inside one project's v1 API, and `package.kind` is npm, golang, pypi or generic on every row of every artifact (the F1 decision's own enum ruling), so no Conan recipe of the form `name/version@user/channel` exists in this registry. GitLab's own 404 for an object that cannot exist is the whole answer; serving an npm tarball or a Go module through Conan's recipe API would hand `conan install` something that is not a recipe, which is invariant #4's invented value wearing a provider's clothes. The two Conan questions that ask nothing about a recipe - `conans/search` and `ping` - ARE served (hello-20 `packageRegistry`, 2026-09-14)

refuse — This address names a Conan RECIPE, a binary package of one, or a file inside one, inside one project's v1 API, and `package.kind` is npm, golang, pypi or generic on every row of every artifact (the F1 decision's own enum ruling), so no Conan recipe of the form `name/version@user/channel` exists in this registry. GitLab's own 404 for an object that cannot exist is the whole answer; serving an npm tarball or a Go module through Conan's recipe API would hand `conan install` something that is not a recipe, which is invariant #4's invented value wearing a provider's clothes. The two Conan questions that ask nothing about a recipe - `conans/search` and `ping` - ARE served (hello-20 `packageRegistry`, 2026-09-14)

refuse — This address names a Conan RECIPE, a binary package of one, or a file inside one, inside one project's v1 API, and `package.kind` is npm, golang, pypi or generic on every row of every artifact (the F1 decision's own enum ruling), so no Conan recipe of the form `name/version@user/channel` exists in this registry. GitLab's own 404 for an object that cannot exist is the whole answer; serving an npm tarball or a Go module through Conan's recipe API would hand `conan install` something that is not a recipe, which is invariant #4's invented value wearing a provider's clothes. The two Conan questions that ask nothing about a recipe - `conans/search` and `ping` - ARE served (hello-20 `packageRegistry`, 2026-09-14)

refuse — This address names a Conan RECIPE, a binary package of one, or a file inside one, inside one project's v1 API, and `package.kind` is npm, golang, pypi or generic on every row of every artifact (the F1 decision's own enum ruling), so no Conan recipe of the form `name/version@user/channel` exists in this registry. GitLab's own 404 for an object that cannot exist is the whole answer; serving an npm tarball or a Go module through Conan's recipe API would hand `conan install` something that is not a recipe, which is invariant #4's invented value wearing a provider's clothes. The two Conan questions that ask nothing about a recipe - `conans/search` and `ping` - ARE served (hello-20 `packageRegistry`, 2026-09-14)

refuse — This address is a Conan AUTHENTICATION PROBE - `users/authenticate` answers a JWT, `check_credentials` validates one - and it is refused on two independent legs. FIRST, the condition: this project's Conan registry holds nothing to authenticate against, because `package.kind` is npm, golang, pypi or generic on every row of every artifact, and 404 is one of the THREE responses the vendored operation itself declares (200 / 401 / 404) - REFUSE_SHAPES.md paragraph 2 picks between an operation's declared errors by the condition the reason describes, and 401 is GitLab's answer for a caller whose credential is missing or invalid, which would be a false claim about the CALLER on a host whose gateway authenticated them. SECOND, THIS UNIVERSE ISSUES NO TOKEN: there is no session and no secret to sign with, so a JWT minted here would be a credential invented by the replica (the PagerDuty routing-key rule, 2026-09-03). Keeping the whole Conan block on one status is what makes it reviewable, and it widens no type union (ruled by the wave coordinator, 2026-09-14)

refuse — This address names a Conan RECIPE REVISION, a package revision of one, or a file or search inside one, at Conan 2.x's v2 API, and `package.kind` is npm, golang, pypi or generic on every row of every artifact (the F1 decision's own enum ruling), so no Conan recipe of the form `name/version@user/channel` exists in this registry. GitLab's own 404 for an object that cannot exist is the whole answer; serving an npm tarball or a Go module through Conan's recipe API would hand `conan install` something that is not a recipe, which is invariant #4's invented value wearing a provider's clothes. The two Conan questions that ask nothing about a recipe - `conans/search` and `ping` - ARE served (hello-20 `packageRegistry`, 2026-09-14)

refuse — This address names a Conan RECIPE REVISION, a package revision of one, or a file or search inside one, at Conan 2.x's v2 API, and `package.kind` is npm, golang, pypi or generic on every row of every artifact (the F1 decision's own enum ruling), so no Conan recipe of the form `name/version@user/channel` exists in this registry. GitLab's own 404 for an object that cannot exist is the whole answer; serving an npm tarball or a Go module through Conan's recipe API would hand `conan install` something that is not a recipe, which is invariant #4's invented value wearing a provider's clothes. The two Conan questions that ask nothing about a recipe - `conans/search` and `ping` - ARE served (hello-20 `packageRegistry`, 2026-09-14)

refuse — This address names a Conan RECIPE REVISION, a package revision of one, or a file or search inside one, at Conan 2.x's v2 API, and `package.kind` is npm, golang, pypi or generic on every row of every artifact (the F1 decision's own enum ruling), so no Conan recipe of the form `name/version@user/channel` exists in this registry. GitLab's own 404 for an object that cannot exist is the whole answer; serving an npm tarball or a Go module through Conan's recipe API would hand `conan install` something that is not a recipe, which is invariant #4's invented value wearing a provider's clothes. The two Conan questions that ask nothing about a recipe - `conans/search` and `ping` - ARE served (hello-20 `packageRegistry`, 2026-09-14)

refuse — This address names a Conan RECIPE REVISION, a package revision of one, or a file or search inside one, at Conan 2.x's v2 API, and `package.kind` is npm, golang, pypi or generic on every row of every artifact (the F1 decision's own enum ruling), so no Conan recipe of the form `name/version@user/channel` exists in this registry. GitLab's own 404 for an object that cannot exist is the whole answer; serving an npm tarball or a Go module through Conan's recipe API would hand `conan install` something that is not a recipe, which is invariant #4's invented value wearing a provider's clothes. The two Conan questions that ask nothing about a recipe - `conans/search` and `ping` - ARE served (hello-20 `packageRegistry`, 2026-09-14)

refuse — This address names a Conan RECIPE REVISION, a package revision of one, or a file or search inside one, at Conan 2.x's v2 API, and `package.kind` is npm, golang, pypi or generic on every row of every artifact (the F1 decision's own enum ruling), so no Conan recipe of the form `name/version@user/channel` exists in this registry. GitLab's own 404 for an object that cannot exist is the whole answer; serving an npm tarball or a Go module through Conan's recipe API would hand `conan install` something that is not a recipe, which is invariant #4's invented value wearing a provider's clothes. The two Conan questions that ask nothing about a recipe - `conans/search` and `ping` - ARE served (hello-20 `packageRegistry`, 2026-09-14)

refuse — This address is a Conan AUTHENTICATION PROBE - `users/authenticate` answers a JWT, `check_credentials` validates one - and it is refused on two independent legs. FIRST, the condition: this project's Conan registry holds nothing to authenticate against, because `package.kind` is npm, golang, pypi or generic on every row of every artifact, and 404 is one of the THREE responses the vendored operation itself declares (200 / 401 / 404) - REFUSE_SHAPES.md paragraph 2 picks between an operation's declared errors by the condition the reason describes, and 401 is GitLab's answer for a caller whose credential is missing or invalid, which would be a false claim about the CALLER on a host whose gateway authenticated them. SECOND, THIS UNIVERSE ISSUES NO TOKEN: there is no session and no secret to sign with, so a JWT minted here would be a credential invented by the replica (the PagerDuty routing-key rule, 2026-09-03). Keeping the whole Conan block on one status is what makes it reviewable, and it widens no type union (ruled by the wave coordinator, 2026-09-14)

refuse — This address names a FILE IN THE DEBIAN POOL - a `.deb`, `.dsc` or `.tar.xz` of a published source or binary package. `package.kind` carries no `debian` row on any artifact, and no `debian_distribution` exists to hold a pool, so both halves of the address name things that cannot exist; GitLab's own 404 is the whole answer, and serving an npm tarball under a `.deb` name would break every client that unpacks by extension (the project's pool).

refuse — This address names a `.gem` FILE or its Marshal'd spec. `package.kind` carries no `rubygems` row on any artifact, so no gem exists here and GitLab's own 404 is the whole answer. The DEPENDENCY API - `rubygems/api/v1/dependencies` - IS served (hello-20 `packageRegistry`, 2026-09-14) and answers `Marshal.dump([])`, which is the same fact in RubyGems' own protocol (the flat address).

refuse — This address names a `.gem` FILE or its Marshal'd spec. `package.kind` carries no `rubygems` row on any artifact, so no gem exists here and GitLab's own 404 is the whole answer. The DEPENDENCY API - `rubygems/api/v1/dependencies` - IS served (hello-20 `packageRegistry`, 2026-09-14) and answers `Marshal.dump([])`, which is the same fact in RubyGems' own protocol (the quick-spec address).

no broadcast message has ever been posted on this instance: a broadcast exists only because an admin created one, and this universe has no admin acting on it

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — the collection this id would index is empty in this universe, so the only honest answer is the vendor's own 404

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

this organization's one deploy token is scoped to its one REPOSITORY, which is where a registry-pull token belongs: reader.listCredentials("deploy-token") (reader.ts:3085) holds one row and its scope_ref is a RepoId, so the GROUP-level list is truthfully empty while /api/v4/projects/{id}/deploy_tokens serves that row. SERVED 2026-09-10 as GitLab's empty page with the pagination headers the vendored operation's page/per_page declare, behind the hello-16 credential gate — an older artifact answers the named generation gap, not []. The subgroup resolves here and is empty for a second reason: it owns no repository and so has no registry to pull (founder ruling F1). RULED by the founder 2026-09-10

SERVED 2026-09-12 (hello-17): the groups and projects the caller's token reaches, derived from the caller's own membership rows and the projects this organization owns; access_level is their DIRECT standing where they hold one and their organization standing otherwise, which is GitLab's inheritance rule. THE VENDORED DOCUMENT POINTS THIS OPERATION'S 200 AT APIEntitiesPersonalAccessToken - the token, not its associations - contradicting its own summary and description; invariant #2 mirrors the provider, so the body is {groups, projects} and the permissive vendored schema validates it anyway. Paged as ONE sequence, groups first, then split back into the two keys

SERVED 2026-09-12 (coverage wave W8) (hello-15 `ciConfig`): canon.CheckoutKey IS a deploy key — `CheckoutKeyType` is literally "deploy-key" — and reader.listCheckoutKeys(repo) already carries the OpenSSH line and BOTH fingerprints in the forms GitLab prints them. `title` is the comment at the end of that same line, READ OFF the material rather than kept as a second copy, so the title and the key can never name two different things; `created_at` is created_epoch; `fingerprint` is the colon-hex MD5 and `fingerprint_sha256` the OpenSSH form. `expires_at`, `last_used_at` and `usage_type` are OMITTED rather than nulled: this universe issues no key with an expiry, records no use of one and stores no usage flag, all three are optional, and a null typed `string` would buy a deviation for nothing. GENERATION-GATED: an artifact without the CI-configuration domain answers that gap rather than `[]`, because `[]` would say this project's CI clones with nothing. The same row by id, byte-identical to the list's entry, which conformance compares directly; a key id nobody holds is GitLab's own 404

SERVED 2026-09-10 (hello-16): the same row by id, byte-identical to the list's first entry

SERVED 2026-09-12 (hello-17): the by-id twin of the caller's GPG key list, resolving exactly what that list carries

SERVED 2026-09-12 (hello-17): the by-id twin of the caller's SSH key list, resolving exactly what that list carries so the two cannot disagree about what this caller holds. Blocked until now by the same fact - the caller held no key, so no id could ever return 200 - and unblocked by the same one

SERVED 2026-09-10 (hello-16): the same rows by id, byte-identical to the list's first entry (conformance asserts it). The armored-key omission is the list row's ruling and applies here unchanged

SERVED 2026-09-10 (hello-16): reader.credentialsForPerson(person, "ssh-auth") + ("ssh-signing") (packages/artifact/src/reader.ts:3075). ONE LIST FOR BOTH GRANTS, which is GitLab's shape rather than GitHub's: an authentication key and a signing key are told apart by `usage_type` (auth/signing) instead of by two endpoints, so canon's two kinds survive the crossing. `key` is the artifact's own OpenSSH line and re-hashes to its `fingerprint_sha256` under ssh-keygen -lf, which conformance recomputes; `expires_at` and `last_used_at` are omitted when canon carries none (the vendored component declares no required list and types both non-nullable, the deploy-key precedent). Gated on reader.hasCredentials(): every pre-hello-16 pin answers the noCredentials generation-gap 404 rather than [], because an empty key list asserts that this person pushes with nothing

SERVED 2026-09-10 (hello-16): the same row by id, byte-identical to the list's first entry. The organization's token id does NOT resolve under the subgroup — conformance asserts it, because a token belongs to one group rather than to every group on the host

SERVED 2026-09-10 (hello-16): the caller's own tokens by id, byte-identical to the list's first row. Another member's token id answers GitLab's 404 — the same non-administrator visibility the list reports, read from the other end, and conformance drives it

SERVED 2026-09-10 (hello-16): reader.listCredentials("project-token") filtered on scope_ref (reader.ts:3085) — TWO ROWS, AND THEY ARE THE ROTATION: the CI token in force when the incident opened was revoked at the incident's first instant and a replacement minted in the same breath, so the revoked row's ended_epoch IS the active row's created_epoch (conformance asserts they abut). `user_id` is the principal the token acts as — this universe's CI identity, a person a client can then fetch, where real GitLab mints a bot user. `access_level` is that holder's OWN standing in the repository, read off reader.membershipFor("repo", …) and mapped once by GITLAB_ACCESS_LEVEL: GitLab's own rule is that a resource token cannot exceed its creator's role. Unpaginated, because the vendored operation declares neither page nor per_page. Gated on hasCredentials()

SERVED 2026-09-12 (coverage wave W8): the deployment names a commit and reader.pullsForCommit resolves the merge requests that commit belongs to — the ones listing it among their commits plus the one whose MERGE commit it is, which is the shape every staging deployment in this universe takes. THE SAME READ backs the DORA lead-time fold, so a lead time and this list cannot disagree about which changes went out. The rows are `glMergeRequest`'s own, carrying the iid `/merge_requests/{iid}` answers to — conformance fetches each one by that iid and asserts it is the same merge request — and the same nullable-key `deviation` the merge-request list already declares. A deployment id nobody has is GitLab's own 404

refuse — listing every key, deploy token or impersonation token across the instance requires admin on GitLab; answering would be inventing an admin session

refuse — the by-id twin of the group deploy-token list: that list is truthfully empty, so no id can resolve and GitLab's own 404 is the whole answer rather than a coverage miss. SERVED 2026-09-10 with x-sandboxapis-refusal naming this row, and UNGATED unlike the list — no generation of this universe holds a group-level deploy token, so the 404 is true on every artifact and naming the credential generation gap here would point a caller at a live host that answers the identical 404. The group still has to resolve: an id nobody holds is 404 Group Not Found, and the subgroup gets this same refusal. RULED by the founder 2026-09-10

refuse — listing every key, deploy token or impersonation token across the instance requires admin on GitLab; answering would be inventing an admin session

refuse — every actor in olympus-labs is a person on the roster — canon mints no bot principal, and a service account served here would be a member no other host lists (invariant #5); GitLab answers `[]` at 200 for a group with none. THE NAMED HALF: `{user_id}` names a service account, and no service account exists to be named — so this operation never reaches a token list to be empty of and GitLab's own 404 is the whole answer. UNGATED: canon has no `ServiceAccount` in any generation — hello-17 dropped the federation domain that would have introduced one. RULED by the founder 2026-09-12

refuse — listing every key, deploy token or impersonation token across the instance requires admin on GitLab; answering would be inventing an admin session

SERVED 2026-09-12 (hello-17): an HONEST EMPTY, and gated. features.reviewPolicy exists and the route QUERIES the container's own id against scope_kind/scope rather than hard-coding [] - so it serves a namespace-scoped rule the day canon writes one. None exists: a rule is measured off the merges in its scope, the organization's merges all happen in its one project, and the subgroup owns no repository (founder ruling F1), so neither group id has a rule of its own. On every artifact without the domain the route answers the named hello-17 generation gap instead, because [] there would assert that nothing gates a merge in an organization whose every merge carried reviews

SERVED 2026-09-12 (hello-17): one field, and it is the one canon answers: allow_overrides_to_approver_list_per_merge_request IS canon's `optional`, which says whether a rule may be overridden on a single merge request. The other six settings this entity carries are policy toggles canon does not model and are omitted rather than defaulted, the same ruling /projects/{id}/approvals takes

SERVED 2026-09-12 (hello-17): the by-id twin of the merge request's approval-rule list, byte-identical to the same rule inside it

the other direction of the merge-request dependency pair, held to the same fact: canon models no dependency between merge requests

a context commit is one a person manually ATTACHES to a merge request to widen the diff a reviewer sees. It is an action, canon models no such action, and so no merge request carries one. Unpaginated: the vendored document declares no page/per_page on this operation. RULED by the founder 2026-09-09

a draft note is an unsubmitted review comment, by definition never visible to anyone but its author; every review in this universe is already submitted, so the draft list is truthfully empty

"all merge requests for a specified group AND ANY SUBGROUPS", which for the organization is every merge request in the universe. THE SUBGROUP RESOLVES HERE as of 2026-09-10 and answers `200 []`: it owns no project and has no subgroup below it (founder ruling F1)

SERVED 2026-09-12 (hello-17): features.reviewPolicy gives the repository the rule its merges were actually held to - approvals_required MEASURED off the merged pulls, approvers derived from the people the review log records approving. rule_type is `regular` by GitLab's own definition (a rule that names its approvers), eligible_approvers IS users because `groups` is empty, and `groups` is empty as a fact about GITLAB'S MODEL rather than about the policy: canon's approver TEAMS have no GitLab container on this host, which publishes exactly two groups and neither is a team. applies_to_all_protected_branches is true because canon's rule carries no branch filter; the vendored component types the accompanying protected_branches as a single object where real GitLab sends an array, so the row is a deviation

SERVED 2026-09-12 (hello-17): the private settings surface over the same rule, rendered by the same shaper as /approval_rules so the two cannot drift. fallback_approvals_required is the rule's own number because canon carries ONE approval measurement for a repository - what its merges actually carried - and there is no second figure for a fallback to differ by. `target_branch` narrows nothing and is answered rather than refused, because the rule applies to every protected branch. The vendored component types `rules` as a single object where real GitLab sends an array, so the row is a deviation

no persona in olympus-labs logs time against an issue or a merge request — canon records no TimeEntry; GitLab's own answer for an untracked issue is a 200 carrying `time_estimate: 0`, `total_time_spent: 0` and both human_ fields null. NOT A COLLECTION: the operation returns `APIEntitiesIssuableTimeStats`, an object, so the honest empty is the zeroed object rather than `[]`. It is the SAME object `glIssue` and `glMergeRequest` already embed as `time_stats` (`emptyTimeStats` in packages/renderer-gitlab/src/render2.ts), read from one function so the standalone endpoint and the embedded block can never disagree (invariant #5). canon's `Issue.estimate` is a story-point estimate on a fibonacci scale rather than a duration, and `time_estimate` is documented in seconds, so mapping one onto the other would be an invention. The two human_ fields are a `deviation` against the vendored component, which types them `string` with no `nullable` while real GitLab renders nil for a zero — the same two entries NULLABLE_SPEC_BUGS already carries for the embedded block. UNGATED: no generation of this universe records a time entry. RULED by the founder 2026-09-12

refuse — the collection this id would index is empty in this universe, so the only honest answer is the vendor's own 404

the by-id twin of the group's register, scanned over THAT GROUP'S fold and then re-read through reader.personAuditEvent(id) — so a PROJECT's audit event answers GitLab's own 404 Audit Event Not Found through this route, which conformance drives directly and which is the whole point of scoping the fold rather than the shaping. The subgroup's ids and the organization's are likewise not interchangeable. An id nobody holds is that same 404, and `%ZZ` is a 404 rather than a 500 (PR #481). SERVED 2026-09-14 (hello-20 `auditActor`): gated on reader.hasAuditActor() after the group has resolved; an older artifact answers the named hello-20 gap

there IS a second group as of hello-16 and this is still empty, because a SHARE is an action and canon records none: no group here has ever been shared with another. THE SUBGROUP RESOLVES HERE as of 2026-09-10 and answers the same empty list, for the same reason

the counts over the same rows the group issue list serves. THE SUBGROUP RESOLVES HERE as of 2026-09-10 and answers REAL ZEROS — `{all: 0, closed: 0, opened: 0}` — rather than an empty object: a group whose issue list is empty has zero of each, which is what real GitLab returns

one DIRECT member of the group. THE SUBGROUP RESOLVES HERE as of 2026-09-10 and answers `404 Not found` for every person: it has no direct member, which is the same fact its list row reports as `[]`. The inherited form /members/all/{user_id} is where an organization member resolves

one member of the direct-plus-inherited listing. THE SUBGROUP RESOLVES HERE as of 2026-09-10 and resolves every organization member through inheritance, matching its own list row; the DIRECT-only twin /members/{user_id} answers GitLab's 404 there instead

a pending reassignment is an IMPORT artifact and this group was never imported from another instance. THE SUBGROUP RESOLVES HERE as of 2026-09-10 and answers the same empty list, for the same reason

the organization owns every project directly and none is shared in from anywhere. THE SUBGROUP RESOLVES HERE as of 2026-09-10 and answers the same empty list: it owns no project of its own (founder ruling F1) and nothing has been shared with it either

SERVED 2026-09-12 (hello-18): THE SAME SIXTEEN PEOPLE ANSWER saml_users, provisioned_users AND enterprise_users, and that is GitLab's own definition rather than a shortcut: an enterprise user is one the group provisioned through its own SAML/SCIM, and a SAML user and a provisioned user are that sentence read from the other two ends. canon carries ONE identity_provider_config (protocol saml, scim_enabled 1) and one external_uid per person, so the three lists are one set and conformance asserts they are identical rather than leaving it a coincidence. THE MACHINE ACCOUNT IS EXCLUDED and that is the domain's load-bearing ruling (decisions/2026-09-12-1120): canon writes no external_uid for the CI bot, because a directory provisions humans and GitLab's word for a machine principal is a SERVICE ACCOUNT — a different object, a different API family, and one five armed `…/service_accounts` rulings say this universe does not mint. The rows are glUser, byte-identical to what /api/v4/users/{id} serves for each of them, which conformance checks person by person. THE SUBGROUP GETS GITLAB'S OWN not_found!: the vendored description scopes this operation to a specified TOP-LEVEL group, so the operation does not exist for a subgroup — a different fact from having nothing to list, and the one the provider reports (the per-family table of decisions/2026-09-10). Gated on hasExternalUid(); an older artifact answers the named hello-18 identity gap rather than [], because an empty list there would say nobody here was provisioned by a directory while this same host publishes a SAML configuration with SCIM enabled — the replica disagreeing with itself (invariant #5)

SERVED 2026-09-12 (hello-18): the group's own uploads — reader.namespaceUploads. THE ROOT GROUP HOLDS NONE AND THE SUBGROUP HOLDS ONE, which is the split /groups/{id}/labels already makes and is a fact rather than a gap: a group-level upload belongs to the CONTAINER it was attached to, and canon attaches its one such file — the chart of the release the subgroup was created around — to the subgroup. So the root answers [] at 200 (the group resolves, it simply has nothing attached) and the subgroup answers its file; conformance drives BOTH ids and asserts each. Gated on hasAttachmentParents(); an older artifact answers the named hello-18 upload gap rather than [], because [] there would say nobody here ever attached a file — false of the story every generation tells, where only the PARENT column was missing

SERVED 2026-09-12 (hello-18): the FILE. The vendored operation declares no response schema at all, because the body is the bytes: this route answers the artifact's own attachment.body verbatim, with the artifact's own content_type and `Content-Disposition: attachment` naming the file. The disposition is `attachment` for every kind rather than a branch this host guesses at — GitLab serves an upload inline only for a type on its own safe list, and image/svg+xml, which every image in this canon carries, is explicitly not on it because an SVG can carry script. Conformance re-reads the artifact row and asserts the served bytes are identical to it and that their length is the `size` the list advertised. Scoped to the group named in the path, so a project upload's id is GitLab's 404 here exactly as a group upload's is on the project path. Gated on hasAttachmentParents(); an older artifact answers the named hello-18 upload gap

SERVED 2026-09-12 (hello-17): WAS `empty` AND THE RULING WAS FALSIFIED ON SCHEDULE. The 2026-09-09 namespaces decision said in as many words that the day canon gives a namespace a member this goes red rather than hiding it; features.grants gives the subgroup a roster of five - the people whose authority is over the PLAN rather than over the code - so this route serves that person's namespace membership, with created_at read off the membership row's own instant rather than the person's first sighting. A person on no namespace roster still gets [], which is what keeps this a derive rather than a claim that everybody is in the subgroup. THE SUBGROUP STILL ANSWERS GITLAB'S OWN 404: the vendored document says the operation works on top-level groups only. On every artifact without the domain namespaceMembers() finds nothing and the answer is the [] the 127 pins frozen before hello-20 serve

the transitive twin of the subgroup list, from the same reader.listNamespaces walk. One level deep in this universe, so it answers the same single row; older pins still answer the empty list. SERVED 2026-09-09 (hello-16)

every issue in the organization's projects. THE SUBGROUP RESOLVES HERE as of 2026-09-10 and answers `200 []`: it owns no repository (founder ruling F1, 2026-09-09) and has no subgroup of its own, so the rollup is empty BY CONSTRUCTION rather than by a gap — the artifact asserts `repo.namespace IS NULL` on every row and conformance re-checks it

the containment fold at the project: the repository's own row plus the 9 memberships scoped to it and the 4 credential acts whose scope_ref IS this repository (two project access tokens issued, one of them later revoked, and the deploy token) — 10 rows at 90 days, which is WIDER than personAuditEventsForTarget('repo', 'repo-01') returns, and conformance asserts that inequality so the fold cannot quietly collapse back into the single-target read. Every object is read through the scoped accessor that publishes it, so the four repository grants whose principal is a TEAM are absent by construction: listMemberships drops a team-principal grant, GitLab has no team, and an event naming one would resolve nowhere on this host. details.target_type is the Rails class GitLab names the object by (Project, User, PersonalAccessToken, DeployToken) and every target_id resolves to something this host serves. SERVED 2026-09-14 (hello-20 `auditActor`): gated on reader.hasAuditActor() after the project has resolved; an older artifact answers the named hello-20 gap rather than `[]`, which would claim nobody ever created this repository

no project in this universe is a fork and none has been forked: the group owns every project and there is no namespace outside it to fork into — the same fact every project object already reports as forks_count: 0

the project-scoped twin of the group invitation list, held to the same fact: a second group exists from hello-16, and no invitation to this project has ever been made. Reviewed again 2026-09-09 against the subgroup.

these govern who may PUBLISH into a registry; a read-only mirror accepts no publishes, so nothing has ever configured a rule here — and real GitLab answers a project with none configured 200 []

every person who bookmarked this project, off reader.starsForRepo(repo) in `(repo, person)` key order, with `search` honoured as a real narrowing over the login and the name. THE SAME CANON ROW GITHUB SERVES AT `…/stargazers`, which is the founder's own ruling this row's old reason quoted - stars are generated on both hosts so a starred repo is the same repo on GitHub and GitLab - and it is honoured BY CONSTRUCTION rather than by agreement: one `repo_star` table, two renderings. hello-17 landed only the person-to-person half of that ruling (`person_follow`); this is the other half, four generations later. A STAR IS A BOOKMARK ON WORK YOU HAVE DONE, so the set is strictly smaller than the roster - the CI identity keeps no bookmarks and somebody who has only filed issues never had a moment at which they would have made one - and conformance fails if it ever equals the roster, because a rule that cannot exclude anybody is a constant wearing a fold's clothes. DEVIATION: the vendored document types the 200 `APIEntitiesUserBasic`, a bare user; real GitLab presents `Entities::UserStarrer`, which is `{starred_since, user}`, and its own REST documentation for List starrers of a project shows that pair. Invariant #2 mirrors the provider rather than its documentation, and the difference is not cosmetic - `starred_since` is the one column this domain minted beyond the pair of ids (the earlier of that person's first commit and first review here) and `APIEntitiesUserBasic` has nowhere to put it. SERVED 2026-09-14 (hello-20 `watchGraph`), gated on hasWatchGraph(); an older artifact answers the named hello-20 star gap, because [] there would claim nobody in this organization has bookmarked the one project they all work in.

the namespaces a project can be moved into, excluding its current parent. From hello-16 there is one that qualifies - the subgroup - so reader.listNamespaces() answers a real row where the 2026-09-09 ruling had nowhere to point. Older pins still answer the empty list. SERVED 2026-09-09 (hello-16)

SERVED 2026-09-12 (hello-18): the FILE. The vendored operation declares no response schema at all, because the body is the bytes: this route answers the artifact's own attachment.body verbatim, with the artifact's own content_type and `Content-Disposition: attachment` naming the file. The disposition is `attachment` for every kind rather than a branch this host guesses at — GitLab serves an upload inline only for a type on its own safe list, and image/svg+xml, which every image in this canon carries, is explicitly not on it because an SVG can carry script. Conformance re-reads the artifact row and asserts the served bytes are identical to it and that their length is the `size` the list advertised. THE `secret` IS THE FILE'S OWN DIGEST, first 32 characters. GitLab mints a 32-character hex token per upload and canon mints none; an invented one would be a value no client could cross-check, while the first half of attachment.sha256 — measured from the body at compile — is 32 hex characters, is a pure function of the bytes it addresses, and is reproducible by any caller that has downloaded the file. Conformance asserts the secret address and the id address serve the same bytes, and that a secret which is not this file's digest is GitLab's own 404. The filename must match too: a right secret with a wrong name addresses nothing. Gated on hasAttachmentParents(); an older artifact answers the named hello-18 upload gap

the projects a person owns in their OWN namespace. Canon models no personal namespace — the group owns every project — so nobody owns one. users/{id}/contributed_projects answers the question this is often mistaken for, and it is served with real rows. RULED by the founder 2026-09-09; a subgroup and group-level objects are on hello-16

refuse — olympus-labs publishes no GitLab Pages site — no project in this universe has a pages deployment or a custom domain; GitLab's own 404 for a project with Pages unused is the whole answer. ALL FOUR ROWS REFUSE, the domain list included: a Pages domain collection is addressable only on a project that HAS Pages, and no project here does — a 200 `[]` there would advertise a Pages site with no custom domain rather than the absence of Pages. The vendored document declares `404 Not Found` on all four operations. UNGATED: canon has no PagesSite in any generation. RULED by the founder 2026-09-12

reader.listEpics() — the epic's own state, closed_epoch and author, which is the merge request's rule in ./depth-history.ts one entity over: canon needs no history table for an epic's state, because an epic that closed carries the instant it closed at and THAT instant is the one event GitLab records. 17 of the 27 epics are closed at 90 days and answer one `closed` event each; the other 10 answer `[]` because they resolve and simply never closed. `resource_type` is Epic and `resource_id` the epic, `user` its author, `created_at` its closed_at. `source_commit` and `source_merge_request_id` are OMITTED throughout: canon records neither against an epic's close and either invented here would be a placeholder. THE GATE IS THE EPIC AND NOT THIS GENERATION — the epic resolves through reader.hasPortfolio() and glEpicOrder's iid sequence, exactly as every other epic route on this host, so a pre-hello-16 artifact answers the EPIC generation gap and a hello-19 one answers this feed in full. The subgroup owns no plan, so `{id}` naming it is GitLab's 404 Epic Not Found. SERVED 2026-09-14 (hello-20 `resourceEvents` wave, gated on hello-16 `portfolio` rather than on hello-20): an artifact without epics answers the epic gap, never `[]`

reader.resourceEventsOfKind(issue, 'label') — hello-20's `resource_event` table, which is the history `issue_label` could not carry: a bare join with no instant on it. 205 rows at 90 days (101 label adds, 30 removes, 49 milestone adds, 25 removes) and every one of them written as the simulation played out, so the instant is an event's own instant and the actor the person who performed it — a label lands when the issue is TRIAGED, by whoever made that transition, or at filing by its author when nobody ever triaged it, and the starter label comes off at triage when somebody picked the work up. `id` is (issue, ord) run through gitlabId, the composition ./depth-history.ts already uses for the state events beside these: the table carries NO id column, because a resource event is addressed by its issue and its position. `label` is the SAME object /projects/{id}/labels publishes, resolved through reader.listLabels, so a caller that follows a label out of an event lands on a row this host serves. The list is `ord` order and never `at_epoch` order: two events share an instant when a label lands and the starter label comes off at one transition, and `ord` is the position in the finalized log, which is the only stable one. `{eventable_id}` is the ISSUE's iid, GitLab's own parameter description, so an iid nobody holds is GitLab's 404 Not found and an unknown project is its 404 Project Not Found — on every generation. SERVED 2026-09-14 (hello-20 `resourceEvents`): gated on reader.hasResourceEvents(); an older artifact answers the NAMED hello-20 gap (`the history of a label or a milestone on an issue`) rather than `[]`, because `[]` would claim no label on this issue was ever applied by anybody while the same artifact serves the labels themselves on the issue beside it

SERVED 2026-09-12 (coverage wave W8): GitLab's ResourceStateEvent vocabulary is NARROW — opened, closed, merged, reopened — and canon's `issue_transition` is a WORKFLOW-COLUMN log (backlog, todo, in_progress, in_review, done, canceled). So a column move is NOT a state event and is not served as one: only a move into a terminal column (done or canceled, exactly the two workflow states canon marks an issue `closed` in) is a CLOSE, and a move back out of one would be a REOPEN. `wave-w8.test.ts` walks the whole issue roster and asserts that constant against the artifact, so the day canon grows a third terminal column the row goes red rather than quietly under-reporting a close. `id` is (issue, ord) minted through gitlabId; `user` is the transition's actor, `created_at` its instant, and `source_merge_request_id` the merge request that performed the close where `by_pull` records one and nothing at all where it does not. `source_commit` is omitted — canon records no commit against a close. An OPEN issue has no state event and says so with `[]` rather than a 404: the issue resolves, it simply never changed state. An iid nobody has is GitLab's own 404

NOBODY IN THIS UNIVERSE EVER SET AN ISSUE'S WEIGHT. canon's `ResourceEventKind` is `label` | `milestone` and nothing else, ruled in the hello-20 canon decision because a weight is a VALUE rather than a row — canon carries `issue.estimate`, which is the team's sizing and not GitLab's weight, and no event in the log ever changes it. And this host claims no weight on the issue: glIssue omits the field under its 2026-08-30 bounding rule, so `[]` says exactly what the issue says. `[]` at 200 under an issue that RESOLVES; an iid nobody holds is still GitLab's own 404 Not found. UNGATED, for the iteration row's reason. RULED 2026-09-14 on the hello-20 GitLab history wave.

the by-id twin of the merge request's label feed, off the same reader.pullLabels rows and byte-identical to its entry in the list. Addressed by gitlabId of the (pull, label) pair the list publishes; an id this merge request does not hold is GitLab's own 404 Resource Not Found, and `%ZZ` is that 404 rather than the raw 500 PR #481 fixed. Ungated for its list's reason. SERVED 2026-09-14 (hello-20 `resourceEvents` wave, ungated): an older artifact answers the same event computed from its own pulls

SERVED 2026-09-12 (coverage wave W8): canon needs no history table for a merge request's state — one that settled carries the instant it settled at, and that instant IS the one event GitLab records: `merged` for one that landed, `closed` for one that did not, and nothing for one still open. reader.listPulls; `user` is the author, `resource_id` the merge request, `id` minted from (pull, state). The same event by id, byte-identical to its entry in the list

reader.resourceEventsOfKind(issue, 'milestone') — the milestone half of the same `resource_event` table. A milestone is set at SPRINT PLANNING (the `sprint-opened` instant of the issue's own sprint, by the lead who opened it, or at the issue's creation when the sprint was already running) and cleared when an issue SLIPS a sprint (its sprint closed while it was neither done nor canceled), so both instants are acts the event log already records. `milestone` is the SAME object /projects/{id}/milestones publishes, through the same glMilestone, so the two surfaces cannot disagree about one milestone's dates. `state` is GitLab's own field for the ISSUABLE's state at the instant, derived from the issue's own close rather than from its state today — a milestone removed at a sprint close after the issue was finished reads `closed` and the identical event on a live issue reads `opened`. DEVIATION, and it is the milestone's own: the vendored document types APIEntitiesMilestone.start_date and due_date as non-nullable strings while real GitLab emits both always and null where unset — the bug NULLABLE_SPEC_BUGS has recorded since 2026-08-30 for the milestone embedded in every issue and merge request, carried here because it is the same object. SERVED 2026-09-14 (hello-20 `resourceEvents`): gated on reader.hasResourceEvents(); an older artifact answers the named hello-20 gap rather than `[]`, which would claim this issue was never planned into a sprint while the issue beside it carries the milestone

PullRow.milestone restated at the instant the merge request opened — the label feed's rule on the merge request's other fixed attribute, and NOT the blanket empty PullRow alone suggests. Measured on the 90-day artifact: exactly ONE of the 24 merge requests carries a milestone, so twenty-three answer `[]` because they were never milestoned and one answers a single `add`; conformance asserts that count against the artifact rather than against a hope, so the day canon milestones a second one the row goes red instead of under-reporting. `state` is `opened` on every row by construction: the instant is the instant the merge request opened, and nothing is merged before it exists. `milestone` is the SAME object /projects/{id}/milestones publishes, and it carries that object's own start_date/due_date deviation (NULLABLE_SPEC_BUGS, 2026-08-30). Ungated for the label feed's reason: nothing here reads a hello-20 table. SERVED 2026-09-14 (hello-20 `resourceEvents` wave, ungated): an older artifact answers the same rule over its own pulls

refuse — ENTAILED by the empty beside it: the epic's label feed serves `[]` on this same host, so no event id resolves and GitLab's own `404 Resource Not Found` is the whole answer. The EPIC still resolves first, so an epic iid nobody holds is `404 Epic Not Found` and a malformed escape (`%ZZ`) is a 404 rather than the raw URIError 500 PR #481 fixed fleet-wide. RULED 2026-09-14 on the hello-20 GitLab history wave.

refuse — ENTAILED by the empty beside it: the weight feed serves `[]` on this same host, so no event id resolves and GitLab's own `404 Resource Not Found` is the whole answer. The project and the issue iid still resolve first, and `%ZZ` is a 404 rather than a 500 (PR #481). RULED 2026-09-14 on the hello-20 GitLab history wave.

SERVED 2026-09-12 (hello-17): the notes inside one epic discussion, byte-identical to the same notes inside the discussion object. The vendored document types this operation's 200 as APIEntitiesDiscussion - Grape's desc block disagreeing with a route that presents the NOTE collection - so conformance validates against APIEntitiesNote, which is what a client receives; the issue and merge-request twins make the same call

no commit in this universe carries a comment — DECISIONS 2026-08-20 [commit-detail] ruled it per endpoint and that ruling stands (the 2026-08-29 entry superseded only its three-verdict bar); GitLab's own answer for a commit with no notes is `[]` at 200. THE LIST HALF: the commit must resolve first (reader.getCommitBySha), so a sha nobody pushed is still GitLab's 404 rather than a cheerful `[]`. UNGATED: packages/canon/src/notes.ts:52 records that hello-17's entity-note domain may not declare a `commit` parent until this ruling is reversed, so no generation of this universe carries a commit note. Falsifiable: the `expectsEmpty` entry reds the row the day one appears. RULED by the founder 2026-09-12

SERVED 2026-09-12 (hello-17): one epic discussion by its 40-hex digest, which is SHA-1 over the canonical id of the thread's root note - the same derivation the issue and merge-request discussions use, so a discussion is addressable by exactly one thread. A discussion that belongs to a different epic 404s here rather than being served under the wrong parent

refuse — no commit in this universe carries a comment — DECISIONS 2026-08-20 [commit-detail] ruled it per endpoint and that ruling stands (the 2026-08-29 entry superseded only its three-verdict bar); GitLab's own answer for a commit with no notes is `[]` at 200. THE DISCUSSION-ID HALF: with no note on any commit there is no discussion id to resolve, so GitLab's own 404 is the whole answer rather than a 200 over a discussion that does not exist. UNGATED, for the reason the list half states. RULED by the founder 2026-09-12

refuse — no snippet exists in this organization — every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted a snippet; GitLab answers `[]` at 200 for a snippet list and its own 404 for a snippet id that names nothing. THE ID HALF: no snippet id resolves, so this operation never reaches a collection to be empty of and GitLab's own 404 is the whole answer — `[]` on a snippet's award-emoji or note list would assert that the snippet exists and holds nothing. UNGATED: canon has no `Snippet` in any generation, so the 404 is true on every artifact. RULED by the founder 2026-09-12

refuse — no snippet exists in this organization — every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted a snippet; GitLab answers `[]` at 200 for a snippet list and its own 404 for a snippet id that names nothing. THE ID HALF: no snippet id resolves, so this operation never reaches a collection to be empty of and GitLab's own 404 is the whole answer — `[]` on a snippet's award-emoji or note list would assert that the snippet exists and holds nothing. UNGATED: canon has no `Snippet` in any generation, so the 404 is true on every artifact. RULED by the founder 2026-09-12

SERVED 2026-09-12 (hello-17): features.socialGraph derives the follow edges from the review graph - you follow the people whose changes you review most and the people who review yours - in ONE person_follow table both git hosts read, which is the cross-host parity this reason has committed to since the classification run. Ordered by the follower's canonical id, the order both hosts page. On every older artifact it answers the named hello-17 generation gap, because [] would assert that nobody here follows anybody

SERVED 2026-09-12 (coverage wave W3): reader.credentialsForPerson(athena, 'email') - athena is the caller GET /api/v4/user reports, and GitHub's /user/emails has been green off the same person_credential rows since the hello-16 credential wave. `confirmed_at` is the credential's own instant and is sent only on an ACTIVE row: GitLab's field records when the address was confirmed to belong to its owner, canon records when the person came to hold it, and a row canon ever revokes loses the field in the same edit rather than keeping a confirmation that is no longer true. `id` is the integer real GitLab sends where the vendored component types it string, so the row is a deviation. Behind the hello-16 credential gate, not the hello-17 caller gate: the caller has held an address since hello-16, which is a different question from whether she holds a key. The old reason - canon's person carries no email list - was falsified by that generation

the caller's own four booleans, off the four columns hello-20's F13 appended to `person` - `view_diffs_file_by_file`, `show_whitespace_in_diffs`, `pass_user_identities_to_ci_jwt` and `policy_advanced_editor`, which is exactly the set `APIEntitiesUserPreferences` declares. FOUR AND NOT THREE deliberately: three of four would have left one to be invented at render time, which is the thing the column exists to prevent. The caller is the one identity every token on this replica resolves to, the same person `/api/v4/user` answers as, so the two surfaces cannot describe different people. `id` IS THE PREFERENCE RECORD'S KEY AND NOT THE PERSON'S - on real GitLab a `user_preferences` row has a primary key of its own and it is a different number from `user_id`, so it is minted from the preference's own canonical name rather than from the person, and conformance fails if the two are ever equal. Conformance also fails if every person in the roster carries the same four values, because each is read off something that person did and a constant would be a fold that distinguishes nobody. DEVIATION: the vendored component types all six fields `string`; real GitLab exposes the `user_preferences` columns directly - two integers and four booleans, which is what its own `db/structure.sql` declares - so the row is `deviation` with the validator substring recorded rather than green (invariant #2 mirrors the provider, not its documentation). SERVED 2026-09-14 (hello-20 `providerTails`), gated on hasProviderTails(); an older artifact answers the named hello-20 preference gap, and there is no honest empty because the response is an object of four flags and any default would be a placeholder.

nobody in olympus-labs sets a status message — canon's person carries no availability, emoji or status text; GitLab's own answer for a user who has set none is a 200 with every field null. NOT A COLLECTION: `APIEntitiesUserStatus` is an object, so the honest empty is the all-null object rather than `[]`. All five fields are a `deviation` against the vendored component, which types each of them `string` with no `nullable` while GitLab renders `Entities::UserStatus` over a person who has set no status and every field comes out nil. UNGATED: `canon.Person` (packages/canon/src/entities.ts:79) has carried id, archetype, teams, utcOffsetMinutes, isBot and member in every generation and has grown only `aiTool`/`extraAiTools` since, so no artifact of this universe has ever held an availability, an emoji or a status text. RULED by the founder 2026-09-12

refuse — a support PIN authenticates a human to GitLab Support; SandboxAPIs has no support desk and issuing one would be a credential-shaped lie

refuse — a support PIN authenticates a human to GitLab Support; SandboxAPIs has no support desk and issuing one would be a credential-shaped lie

content_reaction has carried target_kind 'epic' since hello-15; the block was that this renderer served no epic route, and hello-16's portfolio layer gives the epic one. reactionsFor('epic', id) under a resolvable epic_iid. Two gates in the order a caller meets them: no epic before hello-16 (noEpics), no reactions before hello-15 (noAwardEmoji). SERVED 2026-09-09 (hello-16)

SERVED 2026-10-27 (hello-23 noteReactions, decisions/2026-10-27-2221 and decisions/2026-10-27-2310): the content_reaction rows of target_kind entityNote on this note (reader.noteReactionsFor), as APIEntitiesAwardEmoji with awardable_type Note. The pass ran over every epic note at the issue-comment rate, so a note with none answers [] at 200 as a fact; the 90 d seed-42 recipe draws none and the 30 d recipe six, which is where conformance validates the non-empty case. Older artifacts answer the hello-23 generation gap

ContentReaction is canon as of hello-15 (features.contentReactions): one row per person per gesture per target, with an id, a discriminated target and an instant. reactionsFor() answers it and renderer-gitlab's glAwardEmoji renders GitLab's AwardEmoji envelope over it - the same rows GitHub serves as reactions and Azure DevOps as comment reactions

ContentReaction is canon as of hello-15 (features.contentReactions): one row per person per gesture per target, with an id, a discriminated target and an instant. reactionsFor() answers it and renderer-gitlab's glAwardEmoji renders GitLab's AwardEmoji envelope over it - the same rows GitHub serves as reactions and Azure DevOps as comment reactions

ContentReaction is canon as of hello-15 (features.contentReactions): one row per person per gesture per target, with an id, a discriminated target and an instant. reactionsFor() answers it and renderer-gitlab's glAwardEmoji renders GitLab's AwardEmoji envelope over it - the same rows GitHub serves as reactions and Azure DevOps as comment reactions

ContentReaction is canon as of hello-15 (features.contentReactions): one row per person per gesture per target, with an id, a discriminated target and an instant. reactionsFor() answers it and renderer-gitlab's glAwardEmoji renders GitLab's AwardEmoji envelope over it - the same rows GitHub serves as reactions and Azure DevOps as comment reactions

refuse — no snippet exists in this organization — every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted a snippet; GitLab answers `[]` at 200 for a snippet list and its own 404 for a snippet id that names nothing. THE ID HALF: no snippet id resolves, so this operation never reaches a collection to be empty of and GitLab's own 404 is the whole answer — `[]` on a snippet's award-emoji or note list would assert that the snippet exists and holds nothing. UNGATED: canon has no `Snippet` in any generation, so the 404 is true on every artifact. RULED by the founder 2026-09-12

refuse — no snippet exists in this organization — every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted a snippet; GitLab answers `[]` at 200 for a snippet list and its own 404 for a snippet id that names nothing. THE ID HALF: no snippet id resolves, so this operation never reaches a collection to be empty of and GitLab's own 404 is the whole answer — `[]` on a snippet's award-emoji or note list would assert that the snippet exists and holds nothing. UNGATED: canon has no `Snippet` in any generation, so the 404 is true on every artifact. RULED by the founder 2026-09-12

SERVED 2026-09-12 (coverage wave W7): a real archive of the ref's tree, whose members are `reader.treeFiles(commit)` - the same content-addressed blobs `/repository/files/{path}/raw`, `/repository/blobs/{sha}/raw` and `git clone` serve, so a file cannot have one body here and another there. GITLAB'S OWN NAMING, not GitHub's: the single root directory and the download filename are `{project path}-{ref}-{full sha}` from `archive_prefix` (the project's own path segment, the ref as the caller wrote it with slashes flattened, and the sha appended unconditionally because the API passes `append_sha: true`). FORMATS: `tar.gz` (the default - `format ||= 'tar.gz'`), `tar` and `zip` are served, and the three gzip spellings `tgz`/`gz` and any unrecognised `?format=` collapse onto tar.gz exactly as `archive_file_path` does. The five bzip2 spellings answer the coverage 404 naming the format and the reason - node:zlib carries no bzip2 codec and the shared writer has no dependencies - rather than a gzip wearing a `.tar.bz2` name, which is what falling back to the default would have done. A suffix outside GitLab's own `archive_formats_regex` gets GitLab's plain 404, since its route does not match either. `sha` and `ref_type` are answered; `include_lfs_blobs` is answered too and conformance asserts the two values select byte-identical archives, which is true because the file model holds whole file bodies and no LFS pointer; `path` and `exclude_paths` are refused, because a caller who asked for a subfolder and got the whole repository has been answered a different question. Unblocked by the tar/zip writers moving out of packages/renderer-github into `@sandboxapis/archive`, founder-ordered 2026-09-09

refuse — this reports Gitaly storage verification for a physical repository; the artifact has no Gitaly behind it

SERVED 2026-09-12 (hello-17): features.entityNotes gives a plan item the planning conversation the storyline already had - entity_note rows keyed to an epic, authored by the people who commented on the issues underneath it. listEntityNotes() answers this list in canon id order, which is chronological within a parent. On every older artifact it answers the named hello-17 generation gap and never [], because an empty note list asserts that this organization plans in silence

refuse — olympus-labs documents its services in the parthenon repository, not in a wiki — no WikiPage exists at project or group scope; GitLab answers `[]` at 200 for the wiki list and its own 404 for a slug that names nothing. THE SLUG/PAGE-ID HALF: no slug and no wiki_page_meta_id resolves, so GitLab's own 404 is the whole answer — a 200 `[]` on a wiki page's note list would assert that the page exists and nobody commented on it. UNGATED: canon has no WikiPage in any generation. RULED by the founder 2026-09-12

refuse — no snippet exists in this organization — every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted a snippet; GitLab answers `[]` at 200 for a snippet list and its own 404 for a snippet id that names nothing. THE ID HALF: no snippet id resolves, so this operation never reaches a collection to be empty of and GitLab's own 404 is the whole answer — `[]` on a snippet's award-emoji or note list would assert that the snippet exists and holds nothing. UNGATED: canon has no `Snippet` in any generation, so the 404 is true on every artifact. RULED by the founder 2026-09-12

refuse — no vulnerability exists in this organization — canon carries no SecurityFinding, so no vulnerability id resolves, and GitLab's own 404 for an unknown vulnerability is the whole answer. BOTH HALVES REFUSE rather than one of them answering `[]`: the note list hangs off a `{noteable_id}` that names a VULNERABILITY, and a 200 `[]` there would assert the vulnerability exists and nobody commented on it. UNGATED: packages/canon/src/notes.ts:52 records `SecurityFinding` as the entity hello-17's entity-note domain is still missing, so no generation of this universe holds one. RULED by the founder 2026-09-12

refuse — olympus-labs documents its services in the parthenon repository, not in a wiki — no WikiPage exists at project or group scope; GitLab answers `[]` at 200 for the wiki list and its own 404 for a slug that names nothing. THE SLUG/PAGE-ID HALF: no slug and no wiki_page_meta_id resolves, so GitLab's own 404 is the whole answer — a 200 `[]` on a wiki page's note list would assert that the page exists and nobody commented on it. UNGATED: canon has no WikiPage in any generation. RULED by the founder 2026-09-12

reader.boardScopes('epic') and reader.boardColumns('epic', epic) — the same read one scope kind over, and the place the domain's rule is visible: five of the twenty-seven epics have a board at 90 days, because an epic nobody ever filed an issue against has no view to configure. Conformance asserts that equivalence in both directions over every epic. The board's id and name are the EPIC's, hide_backlog_list and hide_closed_list are folds over its own columns (epic-013 and epic-026 hide their backlog; the other three do not), `lists` is `[]` and the board's scope fields are omitted for the project list's reason: nobody configured a label list. The subgroup owns no plan and answers `[]`. SERVED 2026-09-14 (hello-20 `boards`): gated on reader.hasBoards(); an older artifact answers the named hello-20 gap rather than `[]`

The issue board's ruling on the epic board, and the vendored component makes it no easier: APIEntitiesEpicBoardsList carries `label`, `position` and a `list_type` whose published members are backlog, closed and label — and the operation excludes the first two in its own description, so every servable list is a LABEL list over a label this group publishes, and no label in this universe is a workflow state. Nobody configured one, so `[]` at 200 under an epic board that RESOLVES is GitLab's own answer and matches the `lists: []` the board publishes. An epic nobody filed an issue against has no board at all and its id is GitLab's 404 Board Not Found. RULED 2026-09-14 on the hello-20 GitLab history wave.

EpicRow carries the portfolio columns from hello-16 (features.portfolio): author, state, description, start/due/closed epochs and one level of parent/child. reader.hasPortfolio() + listEpics()/epic()/epicChildren()/epicIssues() derive GitLab's Epic entity; older pins answer the noEpics generation-gap 404 rather than an empty plan. SERVED 2026-09-09 (hello-16)

EpicRow carries the portfolio columns from hello-16 (features.portfolio): author, state, description, start/due/closed epochs and one level of parent/child. reader.hasPortfolio() + listEpics()/epic()/epicChildren()/epicIssues() derive GitLab's Epic entity; older pins answer the noEpics generation-gap 404 rather than an empty plan. SERVED 2026-09-09 (hello-16)

EpicRow carries the portfolio columns from hello-16 (features.portfolio): author, state, description, start/due/closed epochs and one level of parent/child. reader.hasPortfolio() + listEpics()/epic()/epicChildren()/epicIssues() derive GitLab's Epic entity; older pins answer the noEpics generation-gap 404 rather than an empty plan. SERVED 2026-09-09 (hello-16)

EpicRow carries the portfolio columns from hello-16 (features.portfolio): author, state, description, start/due/closed epochs and one level of parent/child. reader.hasPortfolio() + listEpics()/epic()/epicChildren()/epicIssues() derive GitLab's Epic entity; older pins answer the noEpics generation-gap 404 rather than an empty plan. SERVED 2026-09-09 (hello-16)

refuse — ENTAILED by the empty beside it: the epic board has no label list, so no list id resolves and GitLab's own `404 List Not Found` is the whole answer. The GROUP and the BOARD resolve first, and `%ZZ` is a 404 rather than a 500 (PR #481). RULED 2026-09-14 on the hello-20 GitLab history wave.

SERVED 2026-09-12 (coverage wave W8) (hello-15 `ciConfig`): reader.listWorkflowSchedules(repo) over canon.WorkflowSchedule. `description` and `ref` are the schedule's own description and branch, `owner` is the actor it runs as, `created_at` and `updated_at` its two epochs, `cron_timezone` UTC because canon's hours ARE UTC, and `cron` is the (per_hour, hours_of_day, days_of_week) triple re-encoded LOSSLESSLY — every value in the triple appears in the expression and nothing else does, which conformance checks field by field rather than against a literal. `active` is true because every schedule here really starts runs, and an inactive schedule that had started 398 pipelines would contradict its own pipeline list. `next_run_at` is walked forward from THE ARTIFACT'S ANCHOR, never Date.now(): a frozen pin must print the same instant in a year's time. `inputs` and `variables` are omitted — canon carries no schedule variable of any kind. GENERATION-GATED: an older artifact answers the CI-configuration gap rather than `[]`, which would say nothing here runs unattended. `scope=inactive` is a real filter that truthfully matches nothing, the posture `pipelines?status=` takes for a value this generator never produces

the nightly release's publishing credential, off reader.scheduleCiBindings(schedule) — a job that runs unattended cannot be handed its credential by a person, which is why the binding is stored on the schedule rather than pasted into a run. THE SAME BYTES ITS OWN RUNS PUBLISH: conformance compares this response to /pipelines/{pipeline_id}/variables on a run this schedule started, so one fact cannot be answered two ways. GitLab's own `404 Not found` for an unknown schedule or key, `%ZZ` included. SERVED 2026-09-12 (hello-19 `ciBindings`): the 2026-09-09 re-scope asked for a variable table and named the constraint that would make one honest — a masked value is a secret canon stores none of. hello-19's `ci_binding` is that table, built on exactly that constraint: one row, one `masked` boolean, and NO VALUE IN ANY COLUMN on a masked row (`compiler/src/hello19.test.ts` asserts `COUNT(*) WHERE masked = 1 AND value IS NOT NULL` is 0 on every compiled artifact). A MASKED BINDING RENDERS `hidden: true` AND SHIPS NO `value` KEY, which is GitLab's own vocabulary rather than a convenience: `masked` means blanked out of JOB LOGS and `hidden` (created as `masked_and_hidden`) means THE API NEVER RETURNS THE VALUE, so `masked: true, hidden: false` with the key dropped would be a shape real GitLab never sends. An unmasked binding's `value` is the artifact row `ci_binding.value_source` names — the collector's endpoint, the default branch, the orb document's tree path — resolved at compile time, so the setting and the thing it configures cannot drift apart. `variable_type` is `env_var` on every row, which agrees with /api/v4/projects/{id}/secure_files being ruled empty: a `file` variable IS a secure file. `raw` and `description` are OMITTED rather than defaulted — neither is required by APIEntitiesCiVariable and neither is a fact canon holds (the depth-hooks.ts rule, one wave earlier). Conformance drives each row against the vendored schema AND against the reader accessor the renderer must have used, walks the pages with the headers asserted, and fails if a masked row ever carries a value. Gated on hasCiBindings(); an older artifact answers the named hello-19 CI-variable gap, because [] there would say this organization configures its pipelines with nothing while the same artifact publishes a CI document, a nightly schedule and deployments to two environments

the variables ONE RUN WAS STARTED WITH — a genuinely two-branch answer, and `workflow_run.schedule` is the column that tells the branches apart without a join. A run a schedule started carries that schedule's bindings (reader.scheduleCiBindings); a run somebody pushed was started with none and answers [] at 200, which is the true answer rather than a gap. 86 of this universe's 350 runs at 90 days carry a schedule, so conformance drives both branches and fails if either becomes unreachable. The pipeline id resolves FIRST, on every generation: an id this project does not have is GitLab's own `404 Not found`. SERVED 2026-09-12 (hello-19 `ciBindings`): the 2026-09-09 re-scope asked for a variable table and named the constraint that would make one honest — a masked value is a secret canon stores none of. hello-19's `ci_binding` is that table, built on exactly that constraint: one row, one `masked` boolean, and NO VALUE IN ANY COLUMN on a masked row (`compiler/src/hello19.test.ts` asserts `COUNT(*) WHERE masked = 1 AND value IS NOT NULL` is 0 on every compiled artifact). A MASKED BINDING RENDERS `hidden: true` AND SHIPS NO `value` KEY, which is GitLab's own vocabulary rather than a convenience: `masked` means blanked out of JOB LOGS and `hidden` (created as `masked_and_hidden`) means THE API NEVER RETURNS THE VALUE, so `masked: true, hidden: false` with the key dropped would be a shape real GitLab never sends. An unmasked binding's `value` is the artifact row `ci_binding.value_source` names — the collector's endpoint, the default branch, the orb document's tree path — resolved at compile time, so the setting and the thing it configures cannot drift apart. `variable_type` is `env_var` on every row, which agrees with /api/v4/projects/{id}/secure_files being ruled empty: a `file` variable IS a secure file. `raw` and `description` are OMITTED rather than defaulted — neither is required by APIEntitiesCiVariable and neither is a fact canon holds (the depth-hooks.ts rule, one wave earlier). Conformance drives each row against the vendored schema AND against the reader accessor the renderer must have used, walks the pages with the headers asserted, and fails if a masked row ever carries a value. Gated on hasCiBindings(); an older artifact answers the named hello-19 CI-variable gap, because [] there would say this organization configures its pipelines with nothing while the same artifact publishes a CI document, a nightly schedule and deployments to two environments

SERVED 2026-09-12 (coverage wave W8) (hello-15 `ciConfig`): reader.listWorkflowSchedules(repo) over canon.WorkflowSchedule. `description` and `ref` are the schedule's own description and branch, `owner` is the actor it runs as, `created_at` and `updated_at` its two epochs, `cron_timezone` UTC because canon's hours ARE UTC, and `cron` is the (per_hour, hours_of_day, days_of_week) triple re-encoded LOSSLESSLY — every value in the triple appears in the expression and nothing else does, which conformance checks field by field rather than against a literal. `active` is true because every schedule here really starts runs, and an inactive schedule that had started 398 pipelines would contradict its own pipeline list. `next_run_at` is walked forward from THE ARTIFACT'S ANCHOR, never Date.now(): a frozen pin must print the same instant in a year's time. `inputs` is omitted — canon carries no schedule input. GENERATION-GATED: an older artifact answers the CI-configuration gap rather than `[]`, which would say nothing here runs unattended. The detail shape adds `last_pipeline`, and it is the newest run THIS SCHEDULE started (reader.runsForSchedule) rather than the project's newest pipeline — conformance asserts every other field is byte-identical to the list row's. VARIABLES SERVED 2026-09-13 (hello-19 `ciBindings`), AND THIS ROW IS A `deviation` BECAUSE OF THEM: the detail shape also publishes the schedule's CI/CD variables, off the SAME glScheduleVariables the by-key row /pipeline_schedules/{id}/variables/{key} reads, so the two surfaces cannot disagree about one fact — conformance compares the block to that URL's bytes element for element. A masked binding renders `masked: true, hidden: true` and ships NO `value` key, here as everywhere: no ci_binding row carries a value when masked = 1 (compiler/src/hello19.test.ts asserts it as SQL over every compiled artifact). THE DEVIATION IS THE VENDORED DOCUMENT'S: APIEntitiesCiPipelineScheduleDetails types `variables` as a SINGLE APIEntitiesCiVariable object while real GitLab sends an ARRAY — `Ci::PipelineSchedule has_many :variables`, `Entities::Ci::PipelineScheduleDetails` exposes them `using: Entities::Ci::Variable` over that association, and GitLab's own published example for this operation shows `"variables": [{...}]`. Invariant #2 mirrors the provider rather than its documentation, so the array is served and the one validator error is declared a spec bug (SCHEDULE_VARIABLES_SPEC_BUGS); the vendored file is upstream-verbatim and sha256-pinned, so it is NOT edited — the correction and the evidence live in conformance and in coverage/provider-pins.yaml. Same class as `approved_by` on the code-review component. The `variables` KEY IS ABSENT rather than `[]` on a pre-hello-19 artifact: [] would say this organization hands its nightly release nothing while the same artifact publishes a CI document, a schedule that starts real runs and deployments to two environments, and a whole-response coverage 404 would break invariant #2 on every frozen pin, which fetches this row and get GitLab's 200. gitlab/hello19.test.ts asserts the row gains exactly that one key and nothing else

SERVED 2026-09-12 (coverage wave W8) (hello-15 `ciConfig`): reader.testResultsForJob(job) over canon.TestCase/TestResult, folded PER JOB — GitLab keys a test report's suites by the BUILD that reported them, which is what makes one suite per job the mirror rather than a choice. canon spells a failure "failure" and GitLab spells it "failed"; the other three statuses agree. `system_output` is the reporter's message and is absent on a pass, because canon stores NULL there rather than an empty string. `file`, `stack_trace`, `recent_failures` and `attachment_url` are omitted — canon records none of them. The durations are FLOAT seconds as real GitLab sends them while both vendored components type them `integer`, so the row is a `deviation` rather than rounding canon's millisecond durations away. Generation-gated: an older artifact answers the CI-configuration gap rather than a report of no tests. The SAME fold, totals only: the summary carries `build_ids` and no `test_cases`, which is the whole difference between the two operations and the reason both exist. Conformance asserts the two endpoints agree counter for counter — two different totals for one pipeline would be this host describing two universes of tests. `test_suites` is a `deviation`, the vendored component typing the collection as one object

SERVED 2026-09-12 (coverage wave W3): Project.repository's rootRef, branchCount, tagCount and branchNames(searchPattern,offset,limit) - which is the WHOLE of GitLab's branch surface in GraphQL: its schema publishes no branch object, and mirroring that rather than inventing a richer type is invariant #2. Tags are reached the way GitLab reaches them, through Release. The counters are asserted equal to what `/repository/branches` and `/repository/tags` list

SERVED 2026-09-12 (coverage wave W3): Project.label(title) and labels(first, after, title). REST's `name` is GraphQL's `title` and the colours are glLabel's own two strings; `createdAt`/`updatedAt` are OMITTED rather than derived, because canon's label row carries no instant at all and GitLab types both non-null - a subset may omit a field, and inventing a creation date for a label would be a placeholder

SERVED 2026-09-12 (coverage wave W3): Project.milestones(first, after, state, title), every field glMilestone's own value for the same row - including the two dates ArtifactReader.milestoneTimes derives, so GraphQL and `/milestones` cannot print different ones. `projectMilestone` is true and the two group flags false because canon's `milestone.repo` is never null

SERVED 2026-09-12 (coverage wave W3): Project.release(tagName) and releases(first, after), every field glRelease's own value for the same row, with `commit` resolving to the same Commit type the repository serves so a release's tag commit is fetchable from either dialect

no snippet exists in this organization — every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted a snippet; GitLab answers `[]` at 200 for a snippet list and its own 404 for a snippet id that names nothing. THE LIST HALF, served as GitLab's empty page with the pagination headers the operation declares (`page`/`per_page`). UNGATED: canon has no `Snippet` entity in any generation — packages/canon/src/avatars-reactions.ts:188 names it as the blocker the hello-15 reaction domain could not answer — so every registered pin answers this same `[]`. Falsifiable: the `expectsEmpty` conformance entry reds the row the day canon grows a snippet. RULED by the founder 2026-09-12

no snippet exists in this organization — every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted a snippet; GitLab answers `[]` at 200 for a snippet list and its own 404 for a snippet id that names nothing. THE LIST HALF, served as GitLab's empty page with the pagination headers the operation declares (`page`/`per_page`). UNGATED: canon has no `Snippet` entity in any generation — packages/canon/src/avatars-reactions.ts:188 names it as the blocker the hello-15 reaction domain could not answer — so every registered pin answers this same `[]`. Falsifiable: the `expectsEmpty` conformance entry reds the row the day canon grows a snippet. RULED by the founder 2026-09-12

refuse — no snippet exists in this organization — every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted a snippet; GitLab answers `[]` at 200 for a snippet list and its own 404 for a snippet id that names nothing. THE ID HALF: no snippet id resolves, so this operation never reaches a collection to be empty of and GitLab's own 404 is the whole answer — `[]` on a snippet's award-emoji or note list would assert that the snippet exists and holds nothing. UNGATED: canon has no `Snippet` in any generation, so the 404 is true on every artifact. RULED by the founder 2026-09-12

refuse — no snippet exists in this organization — every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted a snippet; GitLab answers `[]` at 200 for a snippet list and its own 404 for a snippet id that names nothing. THE ID HALF: no snippet id resolves, so this operation never reaches a collection to be empty of and GitLab's own 404 is the whole answer — `[]` on a snippet's award-emoji or note list would assert that the snippet exists and holds nothing. UNGATED: canon has no `Snippet` in any generation, so the 404 is true on every artifact. RULED by the founder 2026-09-12

refuse — no snippet exists in this organization — every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted a snippet; GitLab answers `[]` at 200 for a snippet list and its own 404 for a snippet id that names nothing. THE ID HALF: no snippet id resolves, so this operation never reaches a collection to be empty of and GitLab's own 404 is the whole answer — `[]` on a snippet's award-emoji or note list would assert that the snippet exists and holds nothing. UNGATED: canon has no `Snippet` in any generation, so the 404 is true on every artifact. RULED by the founder 2026-09-12

refuse — no snippet exists in this organization — every shared file in olympus-labs lives in the parthenon repository and no persona has ever posted a snippet; GitLab answers `[]` at 200 for a snippet list and its own 404 for a snippet id that names nothing. THE ID HALF: no snippet id resolves, so this operation never reaches a collection to be empty of and GitLab's own 404 is the whole answer — `[]` on a snippet's award-emoji or note list would assert that the snippet exists and holds nothing. UNGATED: canon has no `Snippet` in any generation, so the 404 is true on every artifact. RULED by the founder 2026-09-12

refuse — mirroring GitLab MLflow means simulating a second ML platform with no bearing on the dev-tool story; GitLab 404s these for a project with no experiments

refuse — mirroring GitLab MLflow means simulating a second ML platform with no bearing on the dev-tool story; GitLab 404s these for a project with no experiments

refuse — mirroring GitLab MLflow means simulating a second ML platform with no bearing on the dev-tool story; GitLab 404s these for a project with no experiments

refuse — mirroring GitLab MLflow means simulating a second ML platform with no bearing on the dev-tool story; GitLab 404s these for a project with no experiments

refuse — mirroring GitLab MLflow means simulating a second ML platform with no bearing on the dev-tool story; GitLab 404s these for a project with no experiments

refuse — mirroring GitLab MLflow means simulating a second ML platform with no bearing on the dev-tool story; GitLab 404s these for a project with no experiments

the machines available to one group - the instance pool, on BOTH containers. The operation's own description settles it: it lists the runners available in a specified group AND ANY ANCESTOR GROUPS, including any allowed instance runners. No machine in this universe was registered against a namespace (`RunnerRow` carries a repository or nothing), so neither the organization's root group nor the subgroup has a group runner of its own and what both of them see is the instance pool; conformance asserts the subgroup's answer is byte-identical to the root's, because an [] there would claim a subgroup cannot use the instance machines, which is false about GitLab rather than about olympus-labs. Conformance also asserts no row in this list is a `group_type` runner, which is the claim that keeps the derivation honest. An unknown group is GitLab's own 404 on every generation. SERVED 2026-09-14 (hello-20 `ciRunners`), gated on hasCiRunners(); an older artifact answers the named hello-20 runner gap.

the runners AVAILABLE TO THE CALLER, off reader.runnersByOwnership(org, `hosted`) followed by reader.runnersByOwnership(org, `self-hosted`) - the host's own pool first, then the machines this organization keeps, which is mint order and therefore a stable page for a client that walks it. THIS IS NOT THE INSTANCE LIST and the operation says so: `/api/v4/runners` lists what the user can reach, `/api/v4/runners/all` is admin-only and stays armed `refuse` with the other seven runner administration rows, and conformance asserts that `/runners/all` has not quietly become a synonym for this row. `runner_type` is read off WHICH CONTAINER registered the machine (`RunnerRow.repo` NULL = `instance_type`, a repo id = `project_type`), which is GitLab's own meaning for the field; `is_shared` carries the OWNERSHIP (hosted vs self-hosted), which is GitLab's own word for that second fact. `online` and `status` are THIS HOST'S THRESHOLD applied to canon's instant: `RunnerRow.last_seen_epoch` is an instant and the row's own doc block says each host applies its own online window to it, so GitLab's two-hour `Ci::Runner::ONLINE_CONTACT_TIMEOUT` is measured against the ARTIFACT'S OWN ANCHOR rather than against wall-clock now - a frozen pin must answer the same way in a year. `job_execution_status` is `idle` by construction rather than by default: `runner.busy` is 0 on every row of every artifact because the anchor is not mid-build, which is the first leg of buildkite's armed `/agents` ruling, and conformance fails if any artifact ever carries a busy runner. `name` is `gitlab-runner`, the runner SOFTWARE, because that is what GitLab reads off the registration payload; the operator's own word for the machine is `description`, which is where canon's `RunnerRow.name` goes. SERVED 2026-09-14 (hello-20 `ciRunners`): the row's old reason asked for a Runner the job table can point at and hello-20 built both halves - four tables and the `job.runner` column. Gated on hasCiRunners(); an older artifact answers the named hello-20 runner gap, because [] there would claim nothing ever executed a pipeline here while the same artifact records 592 jobs that each started, finished and concluded.

which projects a machine is available to. An INSTANCE runner (`RunnerRow.repo` NULL) is available to every project on the host; a PROJECT runner to the one that registered it - so the answer is a filter over reader.listRepos() by the machine's own owner rather than a count. Each project is `APIEntitiesBasicProjectDetails`, the same rendering `/api/v4/projects` publishes, and conformance asserts every id here is an id that list carries, so the reference RESOLVES (invariant #5). SERVED 2026-09-14 (hello-20 `ciRunners`), gated on hasCiRunners(); an older artifact answers the named hello-20 runner gap.

refuse — runner ADMINISTRATION: managers, controllers, tokens and router discovery are instance-scope operations GitLab restricts to admins, and this replica authenticates as a member of one organization rather than as an instance administrator. RE-WORDED 2026-09-14 (hello-20 gate 1, the falsified-rulings sweep), the mode unmoved: the sentence used to rest on "physical CI machines ... not the org", and hello-20's `ciRunners` domain made that half false - canon now carries runners, their groups and their labels, `job.runner` says which machine ran each of 592 jobs, and `/api/v4/runners` serves the pool this caller can reach. Two legs survive and either is enough alone. THE ACCESS LEG: `/api/v4/runners/all` is the INSTANCE list and `/api/v4/runners` is the caller's, which is GitLab's own distinction rather than ours, and conformance asserts the two have not become synonyms. THE CREDENTIAL LEG: a runner token and a controller token are secrets, and this canon stores secret NAMES and never values (hello-19's `ci_binding` rule, which `/projects/{id}/secure_files` already rests on). A runner existing is what made the first sentence stale; neither of these moves

refuse — runner ADMINISTRATION: managers, controllers, tokens and router discovery are instance-scope operations GitLab restricts to admins, and this replica authenticates as a member of one organization rather than as an instance administrator. RE-WORDED 2026-09-14 (hello-20 gate 1, the falsified-rulings sweep), the mode unmoved: the sentence used to rest on "physical CI machines ... not the org", and hello-20's `ciRunners` domain made that half false - canon now carries runners, their groups and their labels, `job.runner` says which machine ran each of 592 jobs, and `/api/v4/runners` serves the pool this caller can reach. Two legs survive and either is enough alone. THE ACCESS LEG: `/api/v4/runners/all` is the INSTANCE list and `/api/v4/runners` is the caller's, which is GitLab's own distinction rather than ours, and conformance asserts the two have not become synonyms. THE CREDENTIAL LEG: a runner token and a controller token are secrets, and this canon stores secret NAMES and never values (hello-19's `ci_binding` rule, which `/projects/{id}/secure_files` already rests on). A runner existing is what made the first sentence stale; neither of these moves

refuse — runner ADMINISTRATION: managers, controllers, tokens and router discovery are instance-scope operations GitLab restricts to admins, and this replica authenticates as a member of one organization rather than as an instance administrator. RE-WORDED 2026-09-14 (hello-20 gate 1, the falsified-rulings sweep), the mode unmoved: the sentence used to rest on "physical CI machines ... not the org", and hello-20's `ciRunners` domain made that half false - canon now carries runners, their groups and their labels, `job.runner` says which machine ran each of 592 jobs, and `/api/v4/runners` serves the pool this caller can reach. Two legs survive and either is enough alone. THE ACCESS LEG: `/api/v4/runners/all` is the INSTANCE list and `/api/v4/runners` is the caller's, which is GitLab's own distinction rather than ours, and conformance asserts the two have not become synonyms. THE CREDENTIAL LEG: a runner token and a controller token are secrets, and this canon stores secret NAMES and never values (hello-19's `ci_binding` rule, which `/projects/{id}/secure_files` already rests on). A runner existing is what made the first sentence stale; neither of these moves

the group milestone RESOLVES from hello-16 and nothing is assigned to it: it is the release train the repository's own milestone rolls up into, and all 24 issues that carry a milestone carry the repository's. Served as GitLab's 200 [] under a milestone that exists, rather than the 404 it was when no group milestone could exist - which is still the answer on every older pin. SERVED 2026-09-09 (hello-16)

the by-id twin of the group milestone list, off the same reader.milestonesForNamespace row; an id nobody holds is still GitLab's 404 Milestone Not Found, and that is the whole answer on every pin older than hello-16. SERVED 2026-09-09 (hello-16)

derive — The project row's reason at the group scope: hello-20's `resource_event` carries the milestone history the old reason said was missing, so the blocker is now the UNOBSERVED WIRE SHAPE — the vendored operation declares a bare `200: description: OK` with no content, no component and no example, and authoring one would be the invented body the Azure DevOps chart-image rows were held back from on 2026-09-03. Deferred on the encoding, not on the canon. NOTE FOR THE COORDINATOR: `empty` would ALSO be defensible on the data here and is not on the project row — this group milestone is the release train the repository's own milestone rolls up into and NOTHING is assigned to it directly, which is exactly why its own /issues and /merge_requests rows were ruled `empty` on 2026-09-09; an empty burndown needs no knowledge of the item shape. It is not taken here because serving one half of a pair whose shape is unobserved, while the tier-1 project row beside it cannot be, is a worse answer than uniform honesty. REASON REPLACED 2026-09-14 on the hello-20 GitLab history wave. RE-CHECKED 2026-10-27 at the pinned commit ea02ef9f: doc/api/milestones.md and doc/api/group_milestones.md give this operation's request line and parameter table and no response example, so the blocker stands (decisions/2026-10-27-2140-documented-shapes-left.md).

no commit in this universe carries a comment — DECISIONS 2026-08-20 [commit-detail] ruled it per endpoint and that ruling stands (the 2026-08-29 entry superseded only its three-verdict bar); GitLab's own answer for a commit with no notes is `[]` at 200. THE LIST HALF: the commit must resolve first (reader.getCommitBySha), so a sha nobody pushed is still GitLab's 404 rather than a cheerful `[]`. UNGATED: packages/canon/src/notes.ts:52 records that hello-17's entity-note domain may not declare a `commit` parent until this ruling is reversed, so no generation of this universe carries a commit note. Falsifiable: the `expectsEmpty` entry reds the row the day one appears. RULED by the founder 2026-09-12

refuse — no commit or tag in this universe is GPG-signed, and GitLab answers its own 404 'GPG Signature Not Found' for an unsigned object

NOBODY IN THIS ORGANIZATION WROTE CUSTOM INSTRUCTIONS FOR A CODE REVIEW. Canon records the review CONVERSATION - `review` and `review_comment`, both served on this host - and no per-merge-request instruction to an agent; inventing one would be inventing an agent's PROMPT, the same never-invent rule (2026-08-20, restated by founder ruling F6 of 2026-09-14) that keeps the serialized graph state off a Duo checkpoint and the text off a session turn. THE PARENT IS IN THE QUERY STRING, and the empty is only honest behind it: the operation declares `project_id` and `merge_request_iid` both `required: true`, so a missing one is GitLab's 400 in this host's own shape, a `project_id` that does not resolve is `404 Project Not Found`, and an iid this project has not got is the `404 Not found` the merge-request route itself answers. Unpaged. RULED 2026-09-14 by the hello-20 GitLab serving wave, on the F6 `glDelivery` decision's §5

the instants the run reached, off reader.agentWorkflowSteps(session) in ordinal order — its own start, the merge request it opened, and its own end, EVERY ONE an instant canon already records for that session (a checkpoint log with a drawn instant would be a trace of a run that did not happen), and a session still in flight at the window's now has no terminal step. 163 steps over 78 sessions at 90 d. Each row is `{id, thread_ts, parent_ts}`: the id is `gitlabId(<session>|checkpoint|<ord>)` because `agent_workflow_step` has no id column and is addressed by the pair — THE ORDINAL AND NOT THE INSTANT is what makes it unique, since a session whose merge request opened at the instant it finished carries two steps at one `thread_ts` — and `parent_ts` is the previous step's instant, null on the first because the run had reached nothing before it. NO `checkpoint` AND NO `metadata`: GitLab's checkpoint carries a serialized LangGraph graph state, and this universe does not invent an agent's reasoning any more than it invents its prose (the 2026-08-20 policy, restated by founder ruling F6 of 2026-09-14); `AgentWorkflowStepRow` has four columns and no body, so a blob here would come from the renderer rather than from the universe. The vendored document declares NO SCHEMA, so the row is `schema: null` and conformance asserts the contract plus that every non-clamped instant is one canon records for the session. `accept_compressed` is accepted and changes nothing: it selects an encoding, not a set. SERVED 2026-09-14 (hello-20 `glDelivery`): gated on hasGlDelivery(); an older artifact answers the named delivery generation gap

the SAME reader.agentWorkflowSteps(session) list, in GitLab's event shape — `{id, workflow_id, event_type, thread_ts, parent_ts}`, and conformance asserts it is row-for-row the same set in the same order as `…/checkpoints`, which is what `one list read three ways` has to mean on the wire. `event_type` IS THE ONE VALUE IN THIS DOMAIN THAT IS CANON'S WORD RATHER THAN GITLAB'S, disclosed here rather than buried: GitLab's own event vocabulary (`message`, `pause`, `resume`, `stop`, `require_input`, …) names CONTROL events a CLIENT posts, and this universe records no control event — what it records is what the run REACHED (`started`, `pull-opened`, `completed`, `failed`), and THE KIND IS THE STATUS, so there is no second column to put it in. The vendored document declares NO SCHEMA for this operation, so nothing is invalidated by the choice and the wire contract is asserted directly. `message` and `correlation_id` are OMITTED: both are text this universe does not write. A session that produced a merge request reached a `pull-opened` step and that merge request resolves; one that produced none has no such step, and conformance drives both directions. SERVED 2026-09-14 (hello-20 `glDelivery`): gated on hasGlDelivery(); an older artifact answers the named delivery generation gap

generateheld · data-licensing — static provider catalog, and NOT `derive`: `derive` is defined in this file as computed from artifact rows that already exist, and a vendor catalog is not an artifact row. THE OLD REASON IS FALSE AS OF 2026-09-14 - hello-20's `agent_workflow_step` IS the Duo workflow/checkpoint/trace projection the reason asked for, and the five rows that needed it are served - but this row never did: it takes no project, no group and no user, so it could not be gated on hasGlDelivery() even in principle, because a fact about the HOST must not depend on which snapshot of olympus-labs is being read (the `noRefCatalogs` distinction). LICENCE: NO GRANT, AND NO SOURCE TO CHECK AGAINST. The vendored document declares no schema, no example and no enum for this operation, so every tool id, name and description would come out of memory rather than out of a document, and the contents are GitLab's own MIT-licensed source - verbatim the finding `canon/src/ref-catalogs/gitlab-templates.ts` states at length, and the one that has left GitHub's `/emojis` and `/codes_of_conduct` uncovered since 2026-09-09. THE ASK: a `ref_catalog_entry` catalogue beside the four this fleet already serves (licences, ignore files, Dockerfile templates, CI templates), which is a canon change and was out of scope for the hello-20 serving wave. The row goes on answering the coverage 404 with its `X-SandboxAPIs-Coverage` header and stays in the badge denominator

refuse — a WebSocket upgrade is not an HTTP read and the gateway serves no bidirectional channel

SERVED 2026-09-12 (hello-17): features.issueLinks derives the edges from the storyline - issues in one storyline relate, and an issue whose close precedes another's start blocks it. Canon stores the link ONCE, directed; this route renders it relative to the issue you asked about, so one `blocks` row reads `blocks` from the blocker's end and `is_blocked_by` from the blocked one's. The other end is the same issue /issues/{iid} serves, shaped by the same glIssue, plus the four link fields APIEntitiesRelatedIssue adds; sorted by the relationship's own instant ascending, which is the vendored document's own ordering. Answers the named hello-17 generation gap on every older artifact

refuse — GitLab exposes user-agent detail to instance administrators for abuse reports only; a non-admin token gets 403

the SAME four team boards the project's list serves, through the same reader.boardScopes('team'), with GitLab's group object in place of its project object — one board, two containers, which is GitLab's own model. THE ORGANIZATION'S GROUP ANSWERS AND THE SUBGROUP DOES NOT: platform-delivery owns no repository, so no issue was ever filed in it and there is no view to configure, and its `[]` is the honest answer under a group that resolves — the split every plan-shaped family on this host already makes. hide_backlog_list and hide_closed_list are the same folds over the board's own columns, `lists` is `[]` for the project list's reason, and no WIP limit is emitted anywhere. SERVED 2026-09-14 (hello-20 `boards`): gated on reader.hasBoards(); an older artifact answers the named hello-20 gap rather than `[]`

The project row's ruling at the group scope, over the SAME four team boards: a GitLab board list is a label list, this canon's columns are workflow states, and no label in this project's catalogue is one — so no board in this organization has a label list configured and `[]` at 200 under a board that resolves is GitLab's own answer, matching the `lists: []` the board object publishes. The board's columns reach the surface through hide_backlog_list and hide_closed_list, which the board rows serve. The SUBGROUP owns no repository and therefore no board at all, so a board id under it is GitLab's 404 Board Not Found rather than this empty. RULED 2026-09-14 on the hello-20 GitLab history wave.

the by-id twin of the project's board list, off the same reader.boardScopes('team') membership test and byte-identical to the board's entry in the list. `{board_id}` is gitlabId of the TEAM the board is, so the id the list publishes is the id this route accepts — and a team that has NO board is not a board id, which is what keeps `a board exists only where issues do` true from both directions: conformance walks every team without a board and asserts GitLab's 404 Board Not Found. `%ZZ` is that 404 rather than a 500 (PR #481). SERVED 2026-09-14 (hello-20 `boards`): gated on reader.hasBoards(); an older artifact answers the named hello-20 gap after the project has resolved

refuse — ENTAILED by the empty beside it: the board has no label list, so no list id resolves and GitLab's own `404 List Not Found` is the whole answer. The GROUP and the BOARD resolve first, and `%ZZ` is a 404 rather than a 500 (PR #481). RULED 2026-09-14 on the hello-20 GitLab history wave.

SERVED 2026-09-12 (hello-18): the hooks a group publishes to, off reader.orgWebhooks for the organization and reader.namespaceWebhooks for the subgroup. BOTH CONTAINER IDS ANSWER IT — the vendored document restricts the operation to no particular group, so the subgroup is not denied a family this host lists it under (invariant #5) — and what each holds is a different fact: the organization's is the account-wide feed with all six delivery events, and the subgroup's is the hook every real account has one of, wired up once and never fired, because the subgroup owns no repository (founder ruling F1 of 2026-09-09). That one renders with every event flag FALSE and `alert_status: disabled`, which is GitLab's own vocabulary for a hook that will not deliver — APIEntitiesGroupHook carries no `active` property — and conformance asserts it rather than testing the family only where it is busy. The event-name translation is the project row's, plus the three flags only a group can publish (subgroup_events, member_events, project_events), all false. Gated on hasWebhookFilters()

SERVED 2026-10-27 (hello-23 deliveryEvents, founder ruling F4, decisions/2026-10-27-2218 and decisions/2026-10-27-2310): the organization group hook's webhook_delivery rows from the last seven days before the anchor, newest first, in GitLab's documented event shape (doc/api/project_webhooks.md and group_webhooks.md at the pinned GitLab commit, pinned under gitlab.docs; the vendored operation is a bare 200). Each carries trigger, request_headers, request_data (GitLab's push, issue or merge request hook body as of the delivery instant), response_status from last_delivery_code, execution_duration 0 (the whole-second ruling) and null response_headers and response_body, because the receiver's answer was never recorded. A log holding a job hook answers the coverage 404, since its subject is a commit status here. Older artifacts answer the hello-23 generation gap

SERVED 2026-09-12 (hello-18): the same hook by id, byte-identical to the row the list publishes — conformance compares them directly. THE ID MUST BELONG TO THIS PROJECT: a hook id from the group's own feed is GitLab's 404 here, which is the same scoping reader.repoWebhooks()/orgWebhooks() enforce one layer down and which conformance drives from both sides. A hook id nobody holds is GitLab's own 404. Gated on hasWebhookFilters()

refuse — instance-wide system hooks are admin-only and describe the installation, not the org

SERVED 2026-09-12 (coverage wave W7): the zip of the files the job uploaded, from `reader.jobArtifacts(job)` + `reader.artifactContent()` - the SAME bytes the Buildkite artifact download and GitHub's `actions/artifacts/{id}/zip` serve for the same canonical job (invariant #5), each member named by `ArtifactRow.path`, which is where the job wrote it. Served INLINE at 200 rather than through GitHub's 302: the vendored document declares `'200': OK` and real GitLab streams the file from the API host through workhorse, so a redirect here would be mirroring the other provider. `Content-Disposition: attachment; filename="artifacts.zip"`, which is the name GitLab stores and serves a job's uploaded archive under. A pre-hello-15 snapshot answers the NAMED generation gap (`ArtifactRow.content` ships with `features.ciConfig`) and not a bare 404, which would say this job uploaded nothing - a claim about the job, and a false one. A job that really has no artifacts still gets GitLab's own `404 Not found`.. THE INSTANCE-SCOPED ADDRESS of that same archive, asserted byte-identical to the project-scoped one. Unlike `/api/v4/job` and `/api/v4/job/allowed_agents` - which are `refuse` because they ask what job the CALLER is running right now, and a frozen universe has no live job - this one names a job by id, and the job it names is one this host serves. Unblocked by the tar/zip writers moving out of packages/renderer-github into `@sandboxapis/archive`, founder-ordered 2026-09-09

SERVED 2026-09-12 (coverage wave W8) (hello-15 `ciConfig`): `artifact.path` is where the job wrote the file relative to the workspace root, so the archive's directory tree is a GROUP-BY over those paths and needs no archive format at all — which is what separates this row from the three artifact DOWNLOAD rows. One entry per directory on the way to a file plus one per file, in path order; `?recursive=` and `?path=` narrow it as the vendored operation declares. `mode` is OMITTED throughout: canon records no POSIX mode for an artifact and "100644" would be this renderer inventing one. A JOB WITH NO ARTIFACT IS A 404 rather than an empty list — GitLab's artifact browser has nothing to browse when the job uploaded no archive, and `[]` would advertise an empty archive that does not exist; conformance drives such a job and asserts the 404. Generation-gated: an older artifact has no `artifact.path` column at all

SERVED 2026-09-12 (coverage wave W7): the zip of the files the job uploaded, from `reader.jobArtifacts(job)` + `reader.artifactContent()` - the SAME bytes the Buildkite artifact download and GitHub's `actions/artifacts/{id}/zip` serve for the same canonical job (invariant #5), each member named by `ArtifactRow.path`, which is where the job wrote it. Served INLINE at 200 rather than through GitHub's 302: the vendored document declares `'200': OK` and real GitLab streams the file from the API host through workhorse, so a redirect here would be mirroring the other provider. `Content-Disposition: attachment; filename="artifacts.zip"`, which is the name GitLab stores and serves a job's uploaded archive under. A pre-hello-15 snapshot answers the NAMED generation gap (`ArtifactRow.content` ships with `features.ciConfig`) and not a bare 404, which would say this job uploaded nothing - a claim about the job, and a false one. A job that really has no artifacts still gets GitLab's own `404 Not found`.. ADDRESSED BY REF AND JOB NAME: the latest successful pipeline on the branch or tag, then the job of that name on it. `ref_name` resolves as a branch or a tag and nothing else, because the document says outright that `HEAD` or `SHA` references are not supported. A missing `job` is Grape's own `{"error": "job is missing"}` at 400 - that envelope and not GitLab's usual `{message}`, because that is what the framework actually sends for a missing required parameter. `search_recent_successful_pipelines` is refused rather than implemented: it widens the search from the latest successful pipeline to `recent` ones, and neither the vendored document nor GitLab's own page says how far back that reaches, so answering it would be answering a different question. Unblocked by the tar/zip writers moving out of packages/renderer-github into `@sandboxapis/archive`, founder-ordered 2026-09-09

refuse — Elasticsearch migrations and Zoekt shards describe the instance search cluster, are admin-only, and say nothing about the org

refuse — Elasticsearch migrations and Zoekt shards describe the instance search cluster, are admin-only, and say nothing about the org

the image-build starting points this INSTANCE bundles, off reader.refCatalog(`gitlab.dockerfile-templates`) - the half of the template family `gitignore_template` (163 rows) and `license_catalog` (13) have carried since hello-16, which ./depth-catalogs.ts has served at `/api/v4/templates/{gitignores,licenses}` ever since. THIS IS A FACT ABOUT THE HOST, NOT ABOUT olympus-labs: the question is what starting points GitLab offers anybody opening a new project, so an [] here would be a false claim about GitLab rather than about this organization - the same distinction `hasRefCatalogs()` already draws for the licence catalogue. THE NAMES ARE FACTUAL AND THE BODIES ARE OURS, and `canon/src/ref-catalogs/index.ts` draws the line for exactly this case: a catalogue is factual when its content is an identifier a client USES (an MIT licence body, a `.gitignore` source) and fictional when it is content that decorates the story. Nobody compares a build template - it is a starting point a person edits - and GitLab's own bundled templates are MIT-licensed source from its repository, so shipping them inside every artifact would redistribute a third party's code without its notice, which is the licence finding that leaves GitHub's `/emojis` and `/codes_of_conduct` uncovered to this day. WHICH THREE ECOSYSTEMS IS NOT A CHOICE EITHER: parthenon's head tree carries a `package.json`, a `go.mod` and a `requirements.txt`, the same evidence `render-sbom.ts` parses, and conformance fails if a fourth appears. Each entry is `{key, name}` with the two equal, because a build template is its own key exactly as an ignore-file template is (`Gitlab::Template::BaseTemplate` derives both from the file name). SERVED 2026-09-14 (hello-20 `providerTails`), gated on hasProviderTails(); an older artifact answers the named hello-20 template gap rather than [].

SERVED 2026-09-12 (coverage wave W8) (hello-16 `refCatalogs`): reader.listGitignoreTemplates() over `license_catalog` (13 rows, bodies included) and `gitignore_template` (163 rows, source included) — the SAME two compile-time tables GitHub's /licenses and /gitignore/templates already serve, which is what makes a licence fetched through either host the same licence (invariant #5). GENERATION-GATED and `[]` is not an option: an artifact without the catalogs answers the template-catalog generation gap, because `[]` here would say GitLab bundles no licence templates — a claim about the HOST rather than about this organization, and a false one. licence: FACTUAL/CC0 — the licence texts are the licences themselves and the ignore-file templates are github/gitignore's CC0-1.0 corpus, the same grant coverage/reviews/2026-09-09-hello-15-stale-reasons-git-hosts.md records for the GitHub twins. `Entities::TemplatesList` is `{key, name}`, and an ignore-file template is its own key: GitLab derives both from the file name, which conformance asserts rather than assumes

the pipeline starting points this INSTANCE bundles, off reader.refCatalog(`gitlab.ci-templates`) - the twin of `/api/v4/templates/dockerfiles` and served by the same pair of handlers over one table, so the two families cannot page differently from one another. Everything that row says applies unchanged: it is a fact about the HOST rather than about olympus-labs, so [] would be a false claim about GitLab; the NAMES are factual and the BODIES are this project's own, because nobody compares a build template and GitLab's own are MIT-licensed source this project holds no grant to redistribute; and which three ecosystems is read off parthenon's head tree rather than chosen. SERVED 2026-09-14 (hello-20 `providerTails`), gated on hasProviderTails(); an older artifact answers the named hello-20 template gap rather than [].

SERVED 2026-09-12 (coverage wave W8) (hello-16 `refCatalogs`): reader.listLicenses() over `license_catalog` (13 rows, bodies included) and `gitignore_template` (163 rows, source included) — the SAME two compile-time tables GitHub's /licenses and /gitignore/templates already serve, which is what makes a licence fetched through either host the same licence (invariant #5). GENERATION-GATED and `[]` is not an option: an artifact without the catalogs answers the template-catalog generation gap, because `[]` here would say GitLab bundles no licence templates — a claim about the HOST rather than about this organization, and a false one. licence: FACTUAL/CC0 — the licence texts are the licences themselves and the ignore-file templates are github/gitignore's CC0-1.0 corpus, the same grant coverage/reviews/2026-09-09-hello-15-stale-reasons-git-hosts.md records for the GitHub twins. `popular` IS the catalog's own `featured` flag rather than a second judgement, and `?popular=true` narrows on it. `content` is the stored body VERBATIM — upstream's `[fullname]` placeholder included — because only the single-template operation declares the parameters that expand it. `nickname`, `html_url` and `source_url` are OMITTED: canon's licence row deliberately stores no URL and no nickname (a URL is a host's rendering of the row, not a fact about the licence), GitLab points both URLs at choosealicense.com, which is a link out of the sandbox, and this host publishes no licence page to point at instead

the group's own CI/CD variables, off reader.orgCiBindings(org, 'pipeline') for the organization's top-level group and reader.namespaceCiBindings(ns) for the subgroup — two scopes, two sets, resolved through the one groupTarget every group family shares. A `selected` org binding is still a group variable here: visibility is GitHub's vocabulary and GitLab has none, a group variable reaching every project in the group — and conformance asserts that the selected set IS every repository this organization has, so the day a second one appears the row reds rather than over-serving. SERVED 2026-09-12 (hello-19 `ciBindings`): the 2026-09-09 re-scope asked for a variable table and named the constraint that would make one honest — a masked value is a secret canon stores none of. hello-19's `ci_binding` is that table, built on exactly that constraint: one row, one `masked` boolean, and NO VALUE IN ANY COLUMN on a masked row (`compiler/src/hello19.test.ts` asserts `COUNT(*) WHERE masked = 1 AND value IS NOT NULL` is 0 on every compiled artifact). A MASKED BINDING RENDERS `hidden: true` AND SHIPS NO `value` KEY, which is GitLab's own vocabulary rather than a convenience: `masked` means blanked out of JOB LOGS and `hidden` (created as `masked_and_hidden`) means THE API NEVER RETURNS THE VALUE, so `masked: true, hidden: false` with the key dropped would be a shape real GitLab never sends. An unmasked binding's `value` is the artifact row `ci_binding.value_source` names — the collector's endpoint, the default branch, the orb document's tree path — resolved at compile time, so the setting and the thing it configures cannot drift apart. `variable_type` is `env_var` on every row, which agrees with /api/v4/projects/{id}/secure_files being ruled empty: a `file` variable IS a secure file. `raw` and `description` are OMITTED rather than defaulted — neither is required by APIEntitiesCiVariable and neither is a fact canon holds (the depth-hooks.ts rule, one wave earlier). Conformance drives each row against the vendored schema AND against the reader accessor the renderer must have used, walks the pages with the headers asserted, and fails if a masked row ever carries a value. Gated on hasCiBindings(); an older artifact answers the named hello-19 CI-variable gap, because [] there would say this organization configures its pipelines with nothing while the same artifact publishes a CI document, a nightly schedule and deployments to two environments

A PIPELINE TRIGGER IS A TOKEN, and canon stores no token of any kind - the PagerDuty routing-key rule (2026-09-03) and hello-19's masked-binding rule, which is asserted as SQL on every compiled artifact (`COUNT(*) FROM ci_binding WHERE masked = 1 AND value IS NOT NULL` is 0). Nobody in olympus-labs ever created one, so the list is empty: §A-R6 of the hello-20 batch, founder-approved 2026-09-14, and the 2026-09-09 re-scope's own words - the trigger rows are the tokens that start a pipeline from outside, and canon stores none. WHAT THIS ORGANIZATION DOES START PIPELINES WITH IS ALREADY SERVED: hello-15's `workflow_schedule` answers `/api/v4/projects/{id}/pipeline_schedules`, which is the nightly release this universe really runs, so the empty here withholds nothing a caller cannot find. UNGATED: no generation stores a token; conformance drives it against the oldest generation in the suite. A collection under a project that resolves; the row addressed by `{trigger_id}` answers GitLab's own 404.

the same project variable by key, with `filter[environment_scope]` honoured as a real selector — four of this project's variables share a key with another (DEPLOY_ENVIRONMENT and ENVIRONMENT_DEPLOY_TOKEN, once per environment), which is the case the operation's description tells a caller to use the filter for, and conformance drives every duplicated key through every scope it exists in plus one it does not. GitLab's own `404 Variable Not Found` for an unknown key, `%ZZ` included. SERVED 2026-09-12 (hello-19 `ciBindings`): the 2026-09-09 re-scope asked for a variable table and named the constraint that would make one honest — a masked value is a secret canon stores none of. hello-19's `ci_binding` is that table, built on exactly that constraint: one row, one `masked` boolean, and NO VALUE IN ANY COLUMN on a masked row (`compiler/src/hello19.test.ts` asserts `COUNT(*) WHERE masked = 1 AND value IS NOT NULL` is 0 on every compiled artifact). A MASKED BINDING RENDERS `hidden: true` AND SHIPS NO `value` KEY, which is GitLab's own vocabulary rather than a convenience: `masked` means blanked out of JOB LOGS and `hidden` (created as `masked_and_hidden`) means THE API NEVER RETURNS THE VALUE, so `masked: true, hidden: false` with the key dropped would be a shape real GitLab never sends. An unmasked binding's `value` is the artifact row `ci_binding.value_source` names — the collector's endpoint, the default branch, the orb document's tree path — resolved at compile time, so the setting and the thing it configures cannot drift apart. `variable_type` is `env_var` on every row, which agrees with /api/v4/projects/{id}/secure_files being ruled empty: a `file` variable IS a secure file. `raw` and `description` are OMITTED rather than defaulted — neither is required by APIEntitiesCiVariable and neither is a fact canon holds (the depth-hooks.ts rule, one wave earlier). Conformance drives each row against the vendored schema AND against the reader accessor the renderer must have used, walks the pages with the headers asserted, and fails if a masked row ever carries a value. Gated on hasCiBindings(); an older artifact answers the named hello-19 CI-variable gap, because [] there would say this organization configures its pipelines with nothing while the same artifact publishes a CI document, a nightly schedule and deployments to two environments

refuse — GitLab answers 403 to a non-admin token here (Geo, Sidekiq, storage moves, LDAP, application settings, feature toggles, background migrations); a tenant-shaped mirror has no instance to administer

NO SECURITY PRODUCT IS ENABLED ON olympus-labs AND NO VULNERABILITY EXISTS - the founder's ruling of 2026-09-12 on `/projects/{id}/vulnerabilities/{noteable_id}/notes`, applied to its own family as §A-R1 of the hello-20 batch and approved 2026-09-14. AND IT CANNOT BE BUILT, which is what makes this permanent rather than a deferral: `render-sbom.ts` parses this repository's REAL manifests, so the components this universe declares are `express@4.18.2`, `github.com/google/uuid v1.3.0` and `httpx==0.24.1` - real packages at real versions - and a generated finding over them would be a false claim about a third party's software. The same fact is why hello-20's F8 derives this namespace's plan rung as `premium` rather than Ultimate, so the money surface and this one agree. UNGATED: no generation of this universe holds a SecurityFinding (`packages/canon/src/notes.ts` records it as the entity hello-17's entity-note domain is still missing), so the empty is true on every artifact and on every frozen pin - conformance drives it against the OLDEST generation in the suite rather than against hello-20, which is what would catch a generation gap wearing a ruling's clothes. A collection under a project that resolves; the six rows in this family addressed by an id or a digest answer GitLab's own 404 instead.

refuse — the export object can only be created by a POST we refuse, so the by-id read can only ever be the vendor's own 404

refuse — the export object can only be created by a POST we refuse, so the by-id read can only ever be the vendor's own 404

refuse — no vulnerability exists in this organization - canon carries no SecurityFinding, so no vulnerability id resolves, and GitLab's own 404 for an unknown vulnerability is the whole answer. That is the founder's ruling of 2026-09-12, quoted from the two `/projects/{id}/vulnerabilities/{noteable_id}/notes` rows it was written for, applied to the operation those rows hang off as §A-R1 of the hello-20 batch (founder-approved 2026-09-14). It cannot be built: a finding would have to be about the REAL third-party packages this repository's own manifests declare. UNGATED: `packages/canon/src/notes.ts` records `SecurityFinding` as the entity hello-17's entity-note domain is still missing, so no generation of this universe holds one.

refuse — certificate-based cluster integration is disabled on GitLab.com and removed upstream; mirroring it would advertise a surface no current client can reach

refuse — certificate-based cluster integration is disabled on GitLab.com and removed upstream; mirroring it would advertise a surface no current client can reach

refuse — certificate-based cluster integration is disabled on GitLab.com and removed upstream; mirroring it would advertise a surface no current client can reach

refuse — certificate-based cluster integration is disabled on GitLab.com and removed upstream; mirroring it would advertise a surface no current client can reach

the group's own badges, off reader.projectBadges('group', org) — ONE row, a `pipeline` badge, and its derivation REPLACES THE FALSE ONE THIS ROW CARRIED. The old reason said `project READMEs in this universe carry pipeline and coverage badges`. THE README CARRIES NO BADGE: `themes/src/greek/files.ts`'s `readme()` writes a title, the repository's description, a `## Layout` list, a `## Development` block and one paragraph of prose — no image, no shield, no link — so a parse would return nothing; and the blob cannot be given one, because it is in `git_blob` on every frozen pin and on live and changing a character of it is a determinism sev-1. THE BADGE IS DERIVED FROM WHAT THIS ORGANIZATION DOES: it runs CI on every push — `job` holds 575 rows at 90 d across three workflows — so the badge sits on the GROUP, dated at the first job, and a group badge is INHERITED by every project under it, which is what makes this one row answer both this endpoint and the inherited half of `/projects/{id}/badges`. ADO's `/_apis/build/status/{definition}` is green in this fleet on exactly this reasoning (2026-09-03). AND THERE IS NO COVERAGE BADGE: nothing in this canon measures test coverage — `job` carries `build` and `test`, and the test job publishes RESULTS (`test_case`, `test_result`) rather than a percentage — so a coverage badge would publish a number nobody computed; `ProjectBadgeKind` has two members and conformance reds any badge whose name or URL says `coverage`. The badge's `name`, `link_url` and `image_url` are GitLab's own vocabulary and GitLab's own templates (`%{project_path}`, `%{default_branch}`), composed by the renderer from the container it is holding, because canon carries none of the three. `rendered_link_url`/`rendered_image_url` EQUAL the templates here and that is the provider's behaviour, not a stub: GitLab presents a group badge with no project and `Badge#rendered_link_url(nil)` returns the url unchanged. A SUBGROUP RESOLVES AND ANSWERS `[]` — `project_badge` is keyed `(scope_kind, scope)`, no row names a namespace, and GitLab's `Group#badges` lists the group's OWN badges without walking ancestors. The `name` filter the operation declares is not implemented and is answered by `filterNotCovered`'s explicit 400 rather than ignored. SERVED 2026-09-14 (hello-20 `glDelivery`): gated on hasGlDelivery(); an older artifact answers the named delivery generation gap

GitLab's badge PREVIEW at group scope: it takes the caller's own `link_url` and `image_url` — both `required: true`, and a missing one is GitLab's own 400 `{error: "… is missing"}` — and answers `APIEntitiesBasicBadgeDetails`. THE TWO PAIRS ARE EQUAL HERE AND THAT IS THE PROVIDER, NOT A STUB: `Badges::BuildService` builds the badge and the group routes present it with no project, so `Badge#rendered_link_url(nil)` returns the template unchanged — the project routes are where the placeholders expand. `name` is omitted because the caller supplied none and the component does not require it. THE DERIVATION THIS ROW CARRIED WAS FALSE and is replaced: no README in this universe carries a badge and nothing in this canon measures coverage; the badges that exist are a group `pipeline` badge off 575 CI jobs and a project `release` badge off three published tags (see `/api/v4/groups/{id}/badges`). SERVED 2026-09-14 (hello-20 `glDelivery`): gated on hasGlDelivery(); an older artifact answers the named delivery generation gap

a project's badge by id, over the SAME two-scope composition the list uses — so the group's inherited badge resolves here too, which is GitLab's own behaviour (`find_badge` searches the union `Project#badges` is) and which conformance drives directly, asserting the inherited row comes back with `kind: "group"` and with its placeholders EXPANDED, because a project is what they resolve against. THE DERIVATION THIS ROW CARRIED WAS FALSE and is replaced: no README badge, no coverage badge; a group `pipeline` badge off 575 CI jobs and a project `release` badge off three published tags (see `/api/v4/projects/{id}/badges`). `404 Badge Not Found` for an id nothing has and for `%ZZ`. SERVED 2026-09-14 (hello-20 `glDelivery`): gated on hasGlDelivery(); an older artifact answers the named delivery generation gap

the Kubernetes agents that performed this project's deployments, off reader.clusterAgents(repo) in environment order — ONE PER (project, environment) THAT WAS DEPLOYED TO, which is the narrowest claim the rows support: `deployment` says production and staging were, and says nothing about a third; conformance asserts the served set is exactly the set of environments `/projects/{id}/environments` lists. The agent is dated at the FIRST deploy to its environment and was registered by whoever ran it (`created_by_user_id` resolves on `/users/{id}`). ITS NAME IS COMPOSED BY THE RENDERER from `(project, environment)` — canon carries the environment as a closed enum and no name at all, `ProjectBadge`'s rule one entity along — and the pair is the table's primary key, so two agents can never be handed one name. `is_receptive` IS FALSE AND IS LOAD-BEARING: a receptive agent is one GitLab connects OUT to, these connect IN (which is what a deploy run from a pipeline is), and it is the same fact that makes `…/url_configurations` an honest empty. NO TOKEN VALUE ON ANY SHAPE IN THIS DOMAIN (hello-19's masked-binding rule). `config_project` is the seven-field `APIEntitiesProjectIdentity`, every value the one `/projects/{id}` publishes. SERVED 2026-09-14 (hello-20 `glDelivery`): gated on hasGlDelivery(); an older artifact answers the named delivery generation gap, because `[]` there would say nothing performed the deployments the same artifact records against two environments

the agent's ACTIVE tokens — exactly one, always, because an agent in this canon is registered with one token and keeps it, which is why the token is four columns on `cluster_agent` rather than a sixth table. A NAME AND TWO DATES AND NO VALUE: GitLab returns an agent token's secret once, in the 201 of a create this replica refuses, and never again, so no shape in this domain carries a `token` key and conformance reds one that does (hello-19's masked-binding rule, the PagerDuty routing-key precedent of 2026-09-03). The token's name is composed from the agent's, its id from the agent's canonical id, and `created_by_user_id` is the person who registered the agent. `last_used_at` IS ABSENT HERE ON PURPOSE: the list declares `APIEntitiesClustersAgentTokenBasic`, which does not carry it, and the by-id read declares `APIEntitiesClustersAgentToken`, which does — GitLab's own split between two entities, mirrored rather than flattened. `description` is omitted: canon holds no text for the token and the field is optional. The agent resolves before the token list, so an unknown agent is GitLab's 404. SERVED 2026-09-14 (hello-20 `glDelivery`): gated on hasGlDelivery(); an older artifact answers the named delivery generation gap

A URL CONFIGURATION BELONGS TO A RECEPTIVE AGENT - one GitLab connects OUT to - and every agent in this universe connects IN, which is what a deploy run from a pipeline is. The served `…/cluster_agents/{agent_id}` rows publish `is_receptive: false`, so this empty and that flag are one fact said twice rather than two claims that could drift. THE AGENT RESOLVES FIRST, which is what makes the empty honest rather than confident: an `{agent_id}` this project has not got answers `404 Agent Not Found`, the same body the by-id route gives, and an unknown project answers `404 Project Not Found`. Unpaged, because the operation declares no `page`/`per_page`. RULED 2026-09-14 by the hello-20 GitLab serving wave, on the F6 `glDelivery` decision's §5

refuse — GitLab restricts custom attributes to instance administrators; a non-admin token gets 403

refuse — GitLab restricts custom attributes to instance administrators; a non-admin token gets 403

refuse — GitLab restricts custom attributes to instance administrators; a non-admin token gets 403

olympus-labs protects only branches — canon's protected_ref carries two branch patterns at namespace scope and no environment, tag, merge train, push rule or external status check exists; GitLab answers `[]` at 200 for each of these lists and its own 404 for a named one. THE LIST HALF, served as GitLab's empty page with the pagination headers the operation declares. UNGATED: no generation of this universe has ever protected an environment or a tag, queued a merge train, registered an external status check or set a push rule, so every registered pin answers this same `[]`. Falsifiable: the `expectsEmpty` conformance entry reds the row the day canon grows one. RULED by the founder 2026-09-12

refuse — olympus-labs protects only branches — canon's protected_ref carries two branch patterns at namespace scope and no environment, tag, merge train, push rule or external status check exists; GitLab answers `[]` at 200 for each of these lists and its own 404 for a named one. THE NAMED HALF: no name resolves over a collection that is empty, so GitLab's own 404 is the whole answer — `[]` here would assert that the thing exists and holds nothing. UNGATED: no generation of this universe has ever protected an environment or a tag, queued a merge train, registered an external status check or set a push rule, so the 404 is true on every artifact. RULED by the founder 2026-09-12

refuse — each of these reads reports on an export or import that a WRITE would have started, and writes are refused; GitLab answers 404 for an export nobody requested

refuse — each of these reads reports on an export or import that a WRITE would have started, and writes are refused; GitLab answers 404 for an export nobody requested

refuse — each of these reads reports on an export or import that a WRITE would have started, and writes are refused; GitLab answers 404 for an export nobody requested

THIS ORGANIZATION WIRES ITS INTEGRATIONS AT THE PROJECT, AND GITLAB DISTINGUISHES THE TWO PLACEMENTS. hello-20's `project_integration` is keyed `(repo, kind)`: canon says the Slack workspace, the Jira project and the error tracker are the PROJECT's, and GitLab publishes a project row that came from the group with `inherited: true`. Every row this host serves at `/projects/{id}/integrations` carries `inherited: false`, so a group-level record would contradict it in the same breath - serving the three project rows here would tell a client this organization set group-wide defaults every project inherits, which is an over-claim rather than a gap. BOTH CONTAINERS ANSWER []: the subgroup owns no project to configure a default for (hello-16's founder ruling F1). Unpaged, because the group operation declares only `id`. THE ADJACENT ROW THAT IS SERVED IS NOT A COUNTER-EXAMPLE: `/api/v4/integrations/jira_forge/subscriptions` answers one row for this group because a GitLab-for-Jira Forge subscription is ALWAYS namespace-scoped and has no project-level counterpart at all, so the group is the only place this universe's Jira link can appear on that endpoint. RULED 2026-09-14 by the hello-20 GitLab serving wave: the F6 `glDelivery` decision counted this row servable, and the placement fact is what it could not be served on

the same integration by GitLab's own slug, off reader.projectIntegration(repo, kind) through the `slack`/`jira` mapping the list uses — conformance asserts the by-slug answer is byte-identical to the list's own row, so one integration cannot be described two ways. `APIEntitiesIntegration` adds exactly one field over the list's component, `properties`, and it is OMITTED: an empty settings object is a claim that the integration is configured with nothing. A slug GitLab knows but this project has not turned on (`jenkins`), a slug outside the enum, and `error-tracking` are all the operation's own `404 Service Not Found` — a resolved parent and a missing child rather than a coverage miss. NO decodeURIComponent on `{slug}`: Hono has already decoded the segment, so a second decode would THROW on a malformed escape — `…/integrations/%ZZ` is a slug no integration has, answered 404 (the class PR #481 closed fleet-wide). SERVED 2026-09-14 (hello-20 `glDelivery`): gated on hasGlDelivery(); an older artifact answers the named delivery generation gap

the by-slug half of GitLab's `/services` alias, byte-identical to `/projects/{id}/integrations/{slug}` and asserted so in conformance rather than rendered twice. Same `404 Service Not Found` for an unknown slug and for `%ZZ`. SERVED 2026-09-14 (hello-20 `glDelivery`): gated on hasGlDelivery(); an older artifact answers the named delivery generation gap

refuse — a self-managed license does not exist on a SaaS-shaped mirror and GitLab refuses these to non-admins; managed_licenses is the removed License-Compliance feature

refuse — a self-managed license does not exist on a SaaS-shaped mirror and GitLab refuses these to non-admins; managed_licenses is the removed License-Compliance feature

refuse — a self-managed license does not exist on a SaaS-shaped mirror and GitLab refuses these to non-admins; managed_licenses is the removed License-Compliance feature

refuse — each of these reads reports on an export or import that a WRITE would have started, and writes are refused; GitLab answers 404 for an export nobody requested

refuse — each of these reads reports on an export or import that a WRITE would have started, and writes are refused; GitLab answers 404 for an export nobody requested

refuse — each of these reads reports on an export or import that a WRITE would have started, and writes are refused; GitLab answers 404 for an export nobody requested

features.namespaces (hello-16) adds protected_ref, a rule over a ref PATTERN at namespace scope - two rows, main and release/*. reader.protectedRefs('namespace', id) derives them; older pins answer the empty list. SERVED 2026-09-09 (hello-16)

olympus-labs protects only branches — canon's protected_ref carries two branch patterns at namespace scope and no environment, tag, merge train, push rule or external status check exists; GitLab answers `[]` at 200 for each of these lists and its own 404 for a named one. THE LIST HALF, served as GitLab's empty page with the pagination headers the operation declares. UNGATED: no generation of this universe has ever protected an environment or a tag, queued a merge train, registered an external status check or set a push rule, so every registered pin answers this same `[]`. Falsifiable: the `expectsEmpty` conformance entry reds the row the day canon grows one. RULED by the founder 2026-09-12

refuse — This address names a TERRAFORM MODULE. `package.kind` is npm, golang, pypi or generic on every row of every artifact - canon's deliberate enum, with `terraform_module` among the eleven GitLab types it does not carry - so no module exists at any namespace, name or system, and GitLab's own 404 is the whole answer. This organization's infrastructure story is CI configuration and a `Dockerfile`, not a published module registry (the latest version's metadata).

refuse — This address names a TERRAFORM MODULE. `package.kind` is npm, golang, pypi or generic on every row of every artifact - canon's deliberate enum, with `terraform_module` among the eleven GitLab types it does not carry - so no module exists at any namespace, name or system, and GitLab's own 404 is the whole answer. This organization's infrastructure story is CI configuration and a `Dockerfile`, not a published module registry (the version list).

refuse — state describes real infrastructure the sandbox does not have; GitLab 404s a state name nobody wrote, and writes are refused

refuse — this is per-caller editor storage, not a record of the org; it 404s until the caller WRITES settings, and writes are refused

refuse — this is per-caller editor storage, not a record of the org; it 404s until the caller WRITES settings, and writes are refused

refuse — this is per-caller editor storage, not a record of the org; it 404s until the caller WRITES settings, and writes are refused

`container_repository` and `container_tag` through `containerRepositories()`, `containerTags()` and `containerTag()`. `location` is the image path behind `registry.` + this host's own name, which is how GitLab derives its own (`registry.gitlab.com` beside `gitlab.com`); `name` is the segment after the project's full path, so `""` here, because canon's one image is the ROOT image of the one repository carrying a `Dockerfile`. `delete_api_path`, `status` and `cleanup_policy_started_at` are omitted: nothing is scheduled for deletion and no caller here may delete anything. This route answers every image across the group's projects. The vendored GROUP operation declares neither `tags` nor `tags_count`, so neither is emitted here even though the project-scoped list answers both - mirroring each operation rather than the other one (invariant #2). The subgroup answers `[]`: founder ruling F1 leaves it no repository to keep an image in. SERVED 2026-09-14 (hello-20 `packageRegistry`): gated on `reader.hasPackageRegistry()`, with the project or group resolving FIRST so an unknown one is GitLab's own 404 on every generation. An older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers `noPackageRegistry`, the named generation gap, rather than `[]`: an empty package list would claim an organization with three tagged releases, 344 build outputs and a root `Dockerfile` publishes nothing, which the same artifact contradicts

`container_repository` and `container_tag` through `containerRepositories()`, `containerTags()` and `containerTag()`. `location` is the image path behind `registry.` + this host's own name, which is how GitLab derives its own (`registry.gitlab.com` beside `gitlab.com`); `name` is the segment after the project's full path, so `""` here, because canon's one image is the ROOT image of the one repository carrying a `Dockerfile`. `delete_api_path`, `status` and `cleanup_policy_started_at` are omitted: nothing is scheduled for deletion and no caller here may delete anything. This route answers one image's tags in push order with the moving `latest` last, which is the artifact's own `id` order: one tag per release plus `latest`, which shares the newest release tag's digest BY CONSTRUCTION because both are the same commit. A repository id this project does not hold, `%ZZ` included, is GitLab's own 404. SERVED 2026-09-14 (hello-20 `packageRegistry`): gated on `reader.hasPackageRegistry()`, with the project or group resolving FIRST so an unknown one is GitLab's own 404 on every generation. An older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers `noPackageRegistry`, the named generation gap, rather than `[]`: an empty package list would claim an organization with three tagged releases, 344 build outputs and a root `Dockerfile` publishes nothing, which the same artifact contradicts

`container_repository` and `container_tag` through `containerRepositories()`, `containerTags()` and `containerTag()`. `location` is the image path behind `registry.` + this host's own name, which is how GitLab derives its own (`registry.gitlab.com` beside `gitlab.com`); `name` is the segment after the project's full path, so `""` here, because canon's one image is the ROOT image of the one repository carrying a `Dockerfile`. `delete_api_path`, `status` and `cleanup_policy_started_at` are omitted: nothing is scheduled for deletion and no caller here may delete anything. This route is the INSTANCE-scoped address of one image, resolving its project from the image itself, and answers the third flag its own operation declares: `size=true` sums the layers DEDUPLICATED BY DIGEST, which is what a registry stores - `latest` and the newest release tag are the same manifest, and counting that layer twice would report a repository at twice its own size. SERVED 2026-09-14 (hello-20 `packageRegistry`): gated on `reader.hasPackageRegistry()`, with the project or group resolving FIRST so an unknown one is GitLab's own 404 on every generation. An older artifact - the 127 pins frozen before hello-20, and live until the hello-20 cutover - answers `noPackageRegistry`, the named generation gap, rather than `[]`: an empty package list would claim an organization with three tagged releases, 344 build outputs and a root `Dockerfile` publishes nothing, which the same artifact contradicts

refuse — namespace storage-limit exclusions are a GitLab Inc. internal admin surface

"all releases for PROJECTS IN a specified group" — the same rows each project's own /releases serves. THE SUBGROUP RESOLVES HERE as of 2026-09-10 and answers `200 []`, because it owns no project (founder ruling F1)

refuse — no release in olympus-labs carries an asset link — canon's release names a tag and a description and nothing is attached to it; GitLab answers `[]` at 200 for a release with no links and its own 404 for a link id. THE LINK-ID HALF: with no link on any release there is no link id to resolve and GitLab's own 404 is the whole answer. UNGATED, for the reason the list half states. RULED by the founder 2026-09-12

SERVED 2026-09-12 (coverage wave W8): `Gitlab::Analytics::GroupActivityCalculator`'s own fold — what was created in the last 90 days, capped at its own RECENT_COUNT_LIMIT of 1000. THE CLOCK IS THE ARTIFACT'S ANCHOR, never Date.now(): the operation's window is relative to "now", and a replica that read the wall clock would answer differently on every request and differently again on a frozen pin a year from now. `group_path` is a REQUIRED parameter and resolves the container the same way `/api/v4/groups/{id}` resolves an id, so both containers this host lists answer and a path nobody has is GitLab's own 404 rather than a count of nothing. The count is over reader.listIssues(repo) across every repository the container owns; conformance recomputes it from the artifact rather than asserting a constant

SERVED 2026-09-12 (coverage wave W8): `Gitlab::Analytics::GroupActivityCalculator`'s own fold — what was created in the last 90 days, capped at its own RECENT_COUNT_LIMIT of 1000. THE CLOCK IS THE ARTIFACT'S ANCHOR, never Date.now(): the operation's window is relative to "now", and a replica that read the wall clock would answer differently on every request and differently again on a frozen pin a year from now. `group_path` is a REQUIRED parameter and resolves the container the same way `/api/v4/groups/{id}` resolves an id, so both containers this host lists answer and a path nobody has is GitLab's own 404 rather than a count of nothing. The one count that needs a JOIN DATE, which is why it alone of the three is generation-gated: `membership.added_epoch` ships with hello-16's access domain, and on an older artifact the row answers the membership generation gap rather than 0 — a zero would say nobody joined this group in the window, and an artifact carrying no membership row says nothing at all about when anybody joined. An invitation nobody accepted is NOT a member, so the pending rows are excluded exactly as `/groups/{id}/members` excludes them, which conformance asserts

no pipeline in olympus-labs serializes on a resource group — every job in canon runs without a concurrency lock; GitLab answers `[]` at 200 for a project with none. THE LIST HALF, served as GitLab's empty page with the pagination headers the operation declares. UNGATED: no generation of this universe takes a concurrency lock on a job, so every registered pin answers this same `[]`. Falsifiable: the `expectsEmpty` conformance entry reds the row the day canon grows one. RULED by the founder 2026-09-12

refuse — no pipeline in olympus-labs serializes on a resource group — every job in canon runs without a concurrency lock; GitLab answers `[]` at 200 for a project with none. THE NAMED HALF: no name resolves over a collection that is empty, so GitLab's own 404 is the whole answer — `[]` here would assert that the thing exists and holds nothing. UNGATED: no generation of this universe takes a concurrency lock on a job, so the 404 is true on every artifact. RULED by the founder 2026-09-12

the vulnerabilities related to one SBOM occurrence, and no occurrence in this universe has any: no security product is enabled on olympus-labs and no vulnerability exists (§A-R1 of the hello-20 batch, founder-approved 2026-09-14). THE OCCURRENCE IS A QUERY PARAMETER AND THE OPERATION DECLARES NO 404 AT ALL - 200 and 400 are its whole response set - so the honest answer for an occurrence nobody scanned is the empty list rather than a status GitLab does not return here, which is why this row is `empty` while the six addressed by a path id or digest refuse. UNGATED: no generation of this universe holds a SecurityFinding; conformance drives it against the oldest generation in the suite.

refuse — the export object can only be created by a POST we refuse, so the by-id read can only ever be the vendor's own 404

the gates this organization keeps on each subsystem's new behaviour, off reader.featureFlags(repo) in name order — one flag PER COMPONENT that has feature work (six at 90 d, two at 30 d), which is a uniqueness rule before it is a modelling choice: GitLab reads a flag back BY NAME, and a name pool shorter than the 13 feature storylines would wrap and hand two flags one name, i.e. a by-name route that cannot resolve. `active` is the artifact's own recomputed column — the gate is open exactly when the component's newest feature work started before this organization's most recent production deployment — and three of six are open at 90 d, which is what makes the operation's `scope=enabled|disabled` filter a real selector rather than a no-op; conformance drives BOTH branches and asserts a scope outside the enum is GitLab's 400. `version` is `new_version_flag` on every row and is GitLab's own fact rather than a default: GitLab has had one live flag representation since 13.0 and a client branches on this word to know whether `scopes` or `strategies` describes the rollout. `strategies` AND `scopes` ARE OMITTED because canon carries neither: GitLab's default strategy — everybody, everywhere — is GitLab's REPRESENTATION of a simple on/off flag rather than a fact about this organization, and a percentage rollout or a user list WOULD be a fact and there is none, which is the same finding that makes `/feature_flags_user_lists` an honest empty. (The Unleash routes DO send the default strategy, because there it is not an optional field but the protocol's own encoding of on/off — a client handed no strategy evaluates the flag as off.) Pagination walked to the last page with the five `x-*` headers asserted. SERVED 2026-09-14 (hello-20 `glDelivery`): gated on hasGlDelivery(); an older artifact answers the named delivery generation gap, because `[]` there would say this organization ships behind no gate while the same artifact records thirteen feature storylines over six components

the same flag BY NAME, off reader.featureFlag(repo, name) — the addressing the one-flag-per-component rule exists to make possible, and conformance reads EVERY flag back by its own name rather than only the first. Byte-identical to the list's own row. `404 Feature Flag Not Found` for a name nothing has, `%ZZ` included: NO decodeURIComponent on the segment, because Hono has already decoded it and a second decode THROWS on a malformed escape. Same omissions as the list (`strategies`, `scopes`). SERVED 2026-09-14 (hello-20 `glDelivery`): gated on hasGlDelivery(); an older artifact answers the named delivery generation gap

refuse — the instance-wide Pages domain list is an administrator surface

refuse — olympus-labs publishes no GitLab Pages site — no project in this universe has a pages deployment or a custom domain; GitLab's own 404 for a project with Pages unused is the whole answer. ALL FOUR ROWS REFUSE, the domain list included: a Pages domain collection is addressable only on a project that HAS Pages, and no project here does — a 200 `[]` there would advertise a Pages site with no custom domain rather than the absence of Pages. The vendored document declares `404 Not Found` on all four operations. UNGATED: canon has no PagesSite in any generation. RULED by the founder 2026-09-12

features.namespaces (hello-16) puts two cross-cutting labels on the subgroup; reader.labelsForNamespace(id) derives them with is_project_label false. The organization's own list is empty and include_descendant_groups reaches the subgroup's, which is GitLab's own rule; older pins answer the empty list. SERVED 2026-09-09 (hello-16)

SERVED 2026-09-12 (hello-18): one identity by the handle itself — THE ROW THE WHOLE DOMAIN WAS ASKED FOR, since a uid that resolves to a person instead of to nothing is what this clique has named as its blocker since 2026-09-09. Byte-identical to that person's entry in the list, which conformance compares directly; a handle of the right SHAPE that nobody holds is GitLab's own 404, so the refusal is about the value rather than about the path. Same deviation as its list. The subgroup resolves the family — the document restricts it to no particular group — and answers [] for a list and GitLab's 404 for a named read, because a subgroup federates nobody; the organization above it does. Gated on hasExternalUid(); an older artifact answers the named hello-18 identity gap rather than [], because an empty list there would say nobody here was provisioned by a directory while this same host publishes a SAML configuration with SCIM enabled — the replica disagreeing with itself (invariant #5)

SERVED 2026-09-12 (hello-18): one SCIM identity by the handle, byte-identical to the SAML identity for the same handle — one directory, one identity, asserted rather than assumed. Same deviation as its list. The subgroup resolves the family — the document restricts it to no particular group — and answers [] for a list and GitLab's 404 for a named read, because a subgroup federates nobody; the organization above it does. Gated on hasExternalUid(); an older artifact answers the named hello-18 identity gap rather than [], because an empty list there would say nobody here was provisioned by a directory while this same host publishes a SAML configuration with SCIM enabled — the replica disagreeing with itself (invariant #5)

olympus-labs documents its services in the parthenon repository, not in a wiki — no WikiPage exists at project or group scope; GitLab answers `[]` at 200 for the wiki list and its own 404 for a slug that names nothing. THE LIST HALF, served UNPAGINATED because the vendored operation declares only `id` and `with_content` — printing pagination headers on an operation GitLab does not paginate would break invariant #2 in the name of consistency. Both container ids answer it: the document says "for a group" and restricts the operation to no particular one, so the subgroup is not denied a family this host lists it under (invariant #5). UNGATED: canon has no WikiPage in any generation. RULED by the founder 2026-09-12

refuse — olympus-labs documents its services in the parthenon repository, not in a wiki — no WikiPage exists at project or group scope; GitLab answers `[]` at 200 for the wiki list and its own 404 for a slug that names nothing. THE SLUG/PAGE-ID HALF: no slug and no wiki_page_meta_id resolves, so GitLab's own 404 is the whole answer — a 200 `[]` on a wiki page's note list would assert that the page exists and nobody commented on it. UNGATED: canon has no WikiPage in any generation. RULED by the founder 2026-09-12

refuse — the /api/v4/internal/* family is GitLab-to-Gitaly/agent plumbing outside the public API contract; no client library calls it

refuse — GitLab mounts its Swagger description only outside production: lib/api/helpers/open_api.rb returns from add_open_api_documentation! before mounting anything when Rails.env.production? (read at the pinned commit ea02ef9f), so no production instance routes the per-API description either, and gitlab.com answers 404 {"error":"404 Not Found"} from the catch-all route at the foot of lib/api/api.rb (observed 2026-10-27 for `projects`). This host answers that catch-all body. The vendored OpenAPI document is not served in its place: it is the separate OpenAPI 3.0 file the gitlab:openapi:v3:generate task writes, not the Swagger 2.0 output grape-swagger returns here on a development instance, so serving it would be a body GitLab never sends (decisions/2026-10-27-2135-gitlab-swagger-doc-not-mounted.md)

refuse — application registration is a control-plane surface of the vendor's auth system; SandboxAPIs issues its own keys and the instance list is admin-only

refuse — application registration is a control-plane surface of the vendor's auth system; SandboxAPIs issues its own keys and the instance list is admin-only

reader.listPersonAuditEvents() — the PERSON half of `admin_audit_event`, which hello-20 writes: 91 rows at 90 days, one for every administrative act the event log already records (the organization created, the repository created, 44 memberships, 2 protected refs, 38 credentials issued and 1 revoked), every instant an existing event's instant and every actor an existing person. NEVER reader.listAuditEvents(): the bare three accessors default to the SUPPORT DESK's register, and a GitLab surface publishing a Zendesk instance's account audit would be a different organization's register under this one's path — conformance asserts no desk row reaches this surface and that no BOT is ever an actor. THIS HOST PUBLISHES 68 OF THE 91 AND THE 23 IT DOES NOT ALL NAME A TEAM: GitLab has no team object, so the 4 team rows, the 15 memberships scoped to a team and the 4 repository grants whose principal is a team have no GitLab entity, and an audit event naming an object no path here answers would be a dangling reference published as a fact (the same canon reaches GitHub, where a team IS a team). The exclusion is a property of the door rather than a rule to remember — the fold reads listMemberships and protectedRefs, whose own membershipScope() drops a team-principal grant by construction. entity_type/entity_id name the CONTAINER the act happened in (Group, Project or User) and details.target_* the administered object, both resolving to something this host serves; event_name is GitLab's own audit-event-type identifier, composed from (target_kind, action) plus the credential's kind; details.custom_message is the row's own change_description and details.ip_address the address canon drew, always RFC 5737 or RFC 1918 space. entity_type, entity_id, created_after and created_before are IMPLEMENTED rather than ignored — entity_type is not required here although the vendored document declares it so, because real GitLab answers a bare request with the whole register, and Gitlab::Audit::InstanceScope answers `[]` truthfully since nobody here ever changed an instance setting. Oldest first, which is the accessor's order and the order the ids were minted in. SERVED 2026-09-14 (hello-20 `auditActor`): gated on reader.hasAuditActor(); an older artifact answers the NAMED hello-20 gap (`the administrative acts of this organization's own roster`) rather than `[]` — which would claim nobody ever administered this organization — and never the desk's rows

THE CONTAINMENT FOLD, which the domain deliberately did not provide: personAuditEventsForTarget(kind, target) answers what happened TO one object, and this asks what happened INSIDE this group — the group's own row plus the memberships, the protected refs and the credential scoped to it. A row belongs to a container when the audited object's OWN CANONICAL SCOPE is that container, read through the scoped accessors that already publish it (listMemberships, protectedRefs, credential), so nothing is inferred from a name or an instant. The organization's group answers 18 rows at 90 days (its creation, its 16 memberships and its group access token) and the SUBGROUP KEEPS ITS OWN REGISTER of 6 (its 4 memberships and the 2 refs protected there) — an audit event names ONE entity and a subgroup is an entity of its own, so neither register contains the other's and conformance asserts they do not overlap. The 15 memberships scoped to a TEAM are in neither, because GitLab has no team. SERVED 2026-09-14 (hello-20 `auditActor`): gated on reader.hasAuditActor() after the group has resolved; an older artifact answers the named hello-20 gap rather than `[]`

THE OLD REASON WAS WRONG (DECISIONS 2026-09-06 [HELLO-15/avatars-reactions] finding a): the vendored spec's own summary is "Return avatar url for a user" and its one required parameter is email. It is a PERSON lookup, not an Attachment - PersonAvatar (hello-13) plus the org-wide login@{org}.dev convention every host joins on answer it. An address naming nobody gets avatar_url null, which is real GitLab with Gravatar disabled; a @users.noreply address deliberately does not resolve, because real GitLab looks up the PUBLIC email

OrgAvatar is canon as of hello-15 (features.orgAvatars): one identicon per repository, subjectKind "repo". orgAvatar("repo", ...) answers it and shapeProject's new avatar_url names the /uploads/-/system/project/avatar/{id}/avatar.png path that serves the same bytes

SERVED 2026-09-12 (hello-18): the credentials of this group's ENTERPRISE USERS, which the vendored document scopes the operation to in as many words. The set is the same sixteen people /enterprise_users answers and the rows are the person_credential rows they already hold — the same rows /users/{id}/keys and /personal_access_tokens serve, re-scoped to the directory's people rather than re-derived, and conformance asserts every row is also on its owner's own list so the inventory and the person cannot disagree. THE MACHINE ACCOUNT'S CREDENTIALS ARE NOT HERE, which is what the exclusion is for: an inventory scoped to enterprise users must not list a principal the enterprise-user surface says does not exist. The vendored operation declares `200: OK` and NO response schema at all — a real GitLab spec gap — so the shape is glPersonalAccessToken, the same object /personal_access_tokens serves, and conformance asserts every id, name, owner and active flag against the credential row rather than against a schema that does not exist. The subgroup gets GitLab's own not_found!, on the vendored description's own top-level scoping. Gated on hasExternalUid() (the set) and hasCredentials() (the rows); an older artifact answers the named generation gap rather than []

SERVED 2026-09-10 (hello-16): "all group and project access tokens associated with a TOP-LEVEL-GROUP" — the group token plus every project token below it, from the same two reader.listCredentials calls, and conformance asserts the managed list is exactly the UNION of the narrower ones so a token cannot appear here without appearing on its own container. THE SUBGROUP GETS GITLAB'S 404 rather than a list: the document restricts the operation to a top-level group, and an empty list would report a different fact from the one the provider reports. Gated on hasCredentials()

refuse — each of these reads reports on an export or import that a WRITE would have started, and writes are refused; GitLab answers 404 for an export nobody requested

refuse — each of these reads reports on an export or import that a WRITE would have started, and writes are refused; GitLab answers 404 for an export nobody requested

olympus-labs defines no custom member role — the five roles in canon's membership_role table are GitLab's own built-ins; GitLab answers `[]` at 200 for a group that has minted none. THE LIST HALF, served UNPAGINATED because the vendored operation declares `id` and nothing else. Both container ids answer it: the document restricts the operation to no particular group, so the subgroup is not denied a family this host lists it under (invariant #5). UNGATED: no generation of this universe mints a custom role — canon's five roles are GitLab's own built-ins. RULED by the founder 2026-09-12

refuse — instance-level custom roles are a self-managed admin surface; GitLab.com answers 404 for them

olympus-labs protects only branches — canon's protected_ref carries two branch patterns at namespace scope and no environment, tag, merge train, push rule or external status check exists; GitLab answers `[]` at 200 for each of these lists and its own 404 for a named one. THE LIST HALF, served as GitLab's empty page with the pagination headers the operation declares. UNGATED: no generation of this universe has ever protected an environment or a tag, queued a merge train, registered an external status check or set a push rule, so every registered pin answers this same `[]`. Falsifiable: the `expectsEmpty` conformance entry reds the row the day canon grows one. RULED by the founder 2026-09-12

refuse — olympus-labs protects only branches — canon's protected_ref carries two branch patterns at namespace scope and no environment, tag, merge train, push rule or external status check exists; GitLab answers `[]` at 200 for each of these lists and its own 404 for a named one. THE NAMED HALF: no name resolves over a collection that is empty, so GitLab's own 404 is the whole answer — `[]` here would assert that the thing exists and holds nothing. UNGATED: no generation of this universe has ever protected an environment or a tag, queued a merge train, registered an external status check or set a push rule, so the 404 is true on every artifact. RULED by the founder 2026-09-12

`global` on both containers, for two independent reasons. First, this replica serves exactly one organization, so the person's `org` row IS the global setting and a group has nothing of its own left to say - hello-20's `notification_preference` therefore mints no group-scoped row at all. Second, the SUBGROUP owns no repository (hello-16's founder ruling F1, the same fact `ci-policy.ts` rests on when it mints no namespace policy), so a preference on it would govern nothing; conformance asserts the two containers answer identically. `global` is GitLab's own inherit value and is a thing this host can print precisely because the persona HAS a setting to inherit. `events` is omitted for the reason the two rows above give. An unknown group is GitLab's own 404 on every generation. SERVED 2026-09-14 (hello-20 `watchGraph`), gated on hasWatchGraph(); an older artifact has no preference to inherit and answers the named hello-20 gap.

the caller's own level for one project: their `repo` row where they set one, off reader.notificationLevel(me, `repo`, repo), and otherwise `global`. A SCOPE WITH NO ROW INHERITS, AND THAT IS THE MODEL RATHER THAN A SAVING: hello-20's `notification_preference` carries a repository row only where somebody hears MORE about that repository than about the organization, because GitLab publishes the inheritance as a LEVEL (`global`) and a materialised row per person per repository would make that answer unreachable. `events` is omitted for the reason `/api/v4/notification_settings` gives. An unknown project is GitLab's own 404 on every generation. SERVED 2026-09-14 (hello-20 `watchGraph`), gated on hasWatchGraph(); an older artifact answers the named hello-20 gap rather than `global`, because `global` is a claim about a preference this replica would not have read.

THIS UNIVERSE HOLDS ONE PROJECT, so a cross-project job-token trust list has nothing to allow - §A-R6 of the hello-20 batch, founder-approved 2026-09-14, and the second half of the 2026-09-09 re-scope's own sentence. The allowlist names the OTHER projects a CI job's token may reach; there is no other project, and `repo` holds exactly one row on every generation. UNGATED: the one-project fact is a property of `template.ts`'s own `repos`, not of a snapshot, and hello-16's founder ruling F1 left the one subgroup owning no repository either - so the empty is true on every artifact and on every frozen pin; conformance drives it against the oldest generation in the suite. A collection under a project that resolves; `…/job_token_scope` itself is a settings object with no empty form and answers GitLab's own 404.

refuse — the CI/CD job-token ACCESS SETTINGS - `{inbound_enabled, outbound_enabled}`, which say whether other projects' jobs may reach into this one. It is a SETTINGS OBJECT AND NOT A COLLECTION, so it has no empty form: the three allowlists beside it are honest empties (this universe holds one project and there is nothing to allow), but the two booleans are a configuration canon does not carry, and inventing a pair would be the placeholder invariant #4 forbids. The operation declares the 404. §A-R6 of the hello-20 batch, founder-approved 2026-09-14; UNGATED, because the one-project fact is a property of `template.ts`'s own `repos` rather than of a snapshot. Driven in conformance through a project that resolves.

nothing here mirrors to or from another host: a remote mirror exists only because someone configured one, and this universe accepts no writes

refuse — the collection this id would index is empty in this universe, so the only honest answer is the vendor's own 404

olympus-labs stores no CI secure file — canon holds no secret VALUE and no uploaded secret FILE; GitLab answers `[]` at 200 for a project with none. THE LIST HALF, served as GitLab's empty page with the pagination headers the operation declares. UNGATED: no generation of this universe stores a secret VALUE or an uploaded secret FILE — hello-19's `ci_binding` stores secret NAMES and dates and has no column that could hold a value, which is asserted as SQL rather than reviewed — so every registered pin answers this same `[]`, and so does every generation after it. Falsifiable: the `expectsEmpty` conformance entry reds the row the day canon grows one. RULED by the founder 2026-09-12; the clause was narrowed on 2026-09-12 in hello-19 wave W-b (founder call F4) from the broader claim that canon holds no secret material of any kind — same conclusion, same mode, same review date, and a narrower fact that stays permanently checkable now that a generation stores secret NAMES

refuse — olympus-labs stores no CI secure file — canon holds no secret VALUE and no uploaded secret FILE; GitLab answers `[]` at 200 for a project with none. THE NAMED HALF: no name resolves over a collection that is empty, so GitLab's own 404 is the whole answer — `[]` here would assert that the thing exists and holds nothing. UNGATED: no generation of this universe stores a secret VALUE or an uploaded secret FILE — hello-19's `ci_binding` stores secret NAMES and dates and has no column that could hold a value, which is asserted as SQL rather than reviewed — so the 404 is true on every artifact. RULED by the founder 2026-09-12; the clause was narrowed on 2026-09-12 in hello-19 wave W-b (founder call F4) from the broader claim that canon holds no secret material of any kind — same conclusion, same mode, same review date, and a narrower fact that stays permanently checkable now that a generation stores secret NAMES