// how this is built
Most portfolio sites ask you to take their word for it. This one is built so you don't have to.
The rule underneath everything here is verify, don't assert: every number on this site traces to something that was run, read, or measured — and when a value isn't known, the repositories say so, in writing, with the exact command that would resolve it. You will find MANUAL INPUT REQUIRED markers in public files on this estate. They are not unfinished work; they are the receipts of a policy that honest gaps beat invented completeness.
This page explains the machine that policy runs on.
The estate, at altitude
Three layers, one direction of flow:
- The build side — an operator workstation and the DRIFTDECK suite (the Splice
video module and the Quill document module): local-first pipelines whose deterministic core runs entirely on the operator's own hardware, with zero network dependency at runtime. Source masters are read-only, always. Any AI assist is bring-your-own-key; the tools send nothing anywhere.
- The platform — rootdrifter.io: a hand-built Ghost theme (launched on Ghost
6.44.1) behind nginx and Cloudflare, serving the portfolio, the transmission log, and the utilities surfaces. Alongside it, eight public GitHub repositories carry the projects themselves.
- The projections — the public status surfaces:
/console/and the token-gated
/deck/quill/ panel. These look live. They are not. Each is a stage-time baked snapshot — a strict reduction of local pipeline state down to counts, verdicts, states, and class labels — installed as static, escaped HTML.
Nothing on the public side holds a connection back into the build side. The arrow only points one way.
The gate chain — refuse, never redact
Between the build side and anything public sits a fail-closed gate chain. Every baked projection passes, in order:
- Provenance guard — the bake consumes a handed snapshot file; it never reaches into
a working tree to find one. Being handed the file is the contract.
- Strict-render marker — only a strict-mode render may reach a public surface. A
strict render refuses on violation instead of quietly cleaning up.
- Content scan — an automated sentinel scans the snapshot for anything shaped like
private data: paths, internal filenames, operational identifiers. It reports by class and count, never by content — reproducing the string it caught would be the very defect it exists to stop.
- Output scrub + post-write re-scan — the assembled page is checked again before it
touches disk, and once more after.
The design principle is the interesting part: a violation refuses the whole bake. Nothing is ever silently redacted. Redaction on a public surface hides the defect; refusal stops the ship and forces the fix. The gate itself is tested the honest way round, too — its self-test must fire on known-dirty fixtures and stay silent on a known-clean control. A sentinel that cannot fail proves nothing.
Build → deploy → verify
Every change to the public estate lands through the same loop, and the verification is recorded where it can't drift from the change — in the commit itself:
- Build — theme and content changes in a repo split down a privacy firewall: a
private source tree (blanket-gitignored, fail-closed, mechanically verified) and the public theme/content/deploy tree. A whitelist-inverted emission gate fronts every push.
- Deploy — deploys are human-executed, deliberately. No pipeline pushes to
production without an operator's hands on it.
- Verify — theme releases carry their evidence in the release record: full route
sweep (all 14 theme routes returning HTTP 200 over loopback), Ghost's own theme validator at 0 errors, and the public-surface scrub gate passing on every target. When production behaviour is attested, it is attested from the box — the origin's TLS state is read with the certificate tooling on the origin, because a wire probe against a proxied hostname answers a question about the CDN edge, not about your server.
The release pipeline, end to end
The figure below is the whole loop in one drawing — and it practises the house rule: every stage shows its evidence. Select any stage (click, tap, or Tab + Enter) and the panel prints what that stage claims, how the claim was verified, and when. The dashed path is the prepared one, not the happy one: rollback exists before it is needed, or it doesn't exist at all.
// estate pipeline — select any stage for its evidence · dashed = the prepared path
01BUILDsplit repo · emission gate02GATE CHAINfail-closed · refuses, never redacts03DEPLOYoperator-hand only04VERIFY200s · validator · route sweep→ one direction of flow — a violation at any gate refuses the whole run05ROLLBACKbackups · documented pathsdashed = prepared path, not the happy pathEvidenceSelect a stage — every stage on this diagram carries the evidence for its own claims.01 · BuildTheme and content changes land in a repo split down a privacy firewall: a private source tree — blanket-gitignored, fail-closed, mechanically verified — and the public theme/content/deploy tree. A whitelist-inverted emission gate fronts every push: only whitelisted shapes pass, so a new kind of leak is caught by default, not by an ever-growing denylist. Its self-test must fire on known-dirty fixtures and stay silent on a clean control. [O] repo records · 2026-06-19 → 2026-07-1902 · Gate chainEvery baked status projection crosses, in order: provenance guard (the bake consumes a handed snapshot; it never goes looking for one) → strict-render marker → content scan (reports by class and count, never by content) → output scrub → post-write re-scan. A violation refuses the whole bake; nothing is silently redacted. The recorded real-run bake shows every gate passing with scan total 0 — and the negative control (the same snapshot minus its public projection) refused with nothing written. REFUSED (gate 2): sentinel flagged the snapshot — a violation refuses the bake, never redacts [V] gate scripts read · [O] release record · 2026-08-2103 · DeployDeploys are human-executed, deliberately — no pipeline pushes to production. The scripted lane refuses early: the theme validator must report 0 errors or the run aborts before a single file is copied; only then do install, restart, and health check run as one unit. The verified snapshot hand-off is the transfer contract between build side and platform: being handed the artefact is the authorisation to install it. [V] deploy script read this run · [O] estate law04 · VerifyA deploy only counts when the site answers HTTP 200 with the expected title — retry-aware, so a just-restarted instance gets boot time before being called unhealthy. Releases carry the full evidence in the release record: all 14 theme routes HTTP 200 over loopback, validator 0 errors, public-surface scrub gate 8/8 targets. Origin TLS is attested from the box, not the wire — probing the proxied hostname answers for the CDN edge, not the server. [V] health-check script read · [O] release record · 2026-08-21/22 MANUAL INPUT REQUIRED — current production platform + theme versions (operator, on the box)05 · RollbackPrepared before it is needed: timestamped content backups, integrity-tested at creation (the archive must pass its compression self-test) and pruned on a 14-day retention; the admin rate-limit hardening and the migration cutover each ship with an explicit written rollback section; the theme itself rolls back through its own version history. A change without a way back is a change that hasn't been thought through. [V] backup script + rollback docs read this run
Why it's built this way
This estate is a security portfolio, so the infrastructure is part of the argument. A site that claims security engineering and then wires its status pages straight into production state has already lost that argument. The one-way flow, the refuse-don't- redact gates, the human-only deploys, and the evidence-in-the-commit habit are the same disciplines the portfolio projects document — practised on the thing you are reading right now.
The full change history is public in the platform changelog, and the pipeline figure above lets you walk the release path stage by stage — every stage carries the evidence for its own claims.