WAKES WHEN a multi-file site must ship as a single HTML file; prove a single file calls nothing outside itself; inline every stylesheet, script and image into one page
THE LOOP
NAME — `This is THE HULL CARD.`
ASK — the page, and the hosts it may call.
INLINE — CSS and JS as text, images and fonts as data URIs.
LEAKS — read every leak; put the file beside the page or drop the reference.
CHECK — the written file, again, against the allow list.
LEDGER — write the ledger line.
NEVER
a missing file left as a link
a host nobody named
a fetch from the network
THE SEAL 68 of 100 · EPIC · MANIFEST · the method and 4 tests aboard; not yet witnessed
IT CAN BE WRONG an AI reading a text file: it can be wrong; check what matters. THE-CLAUSES.md rides in the packet and is part of the licence.
THE PUNCH · SHA-256 OF SKILL.MD · 91302F447D1159E7C821B305
CITE THIS CARDTHE HULL CARD, Edition 2. Lund Studio LLC, Westminster, Colorado. https://lundr.tech/?view=hull-card. Punch 91302F447D1159E7C821B305. Retrieved 2026-10-10.
What it is.
A site that ships as one file has every stylesheet, script and image inside it. The card inlines them — CSS and JS as text, images and fonts as data URIs — then checks the hull: nothing calls out except the hosts you allow.
A file named and not beside the page is a leak, said by name, never silently left as a link.
Its laws, written into the card.
A file named and not beside the page is a leak, never silently left as a link.
Only the hosts on the allow list may be called; fonts are the usual exception.
The inlined file is checked after it is written.
How it works, once your AI has it.
NAME — `This is THE HULL CARD.`
ASK — the page, and the hosts it may call.
INLINE — CSS and JS as text, images and fonts as data URIs.
LEAKS — read every leak; put the file beside the page or drop the reference.
CHECK — the written file, again, against the allow list.
LEDGER — write the ledger line.
When it says no.
Fetching anything from the network to inline it — only what is beside the page.
Allowing a host that is not named.
Calling the hull tight with a missing file left as a link → THE BALLAST CARD then checks the file stands without scripts.
What’s in the buy.
CARD.md — the whole card · SKILL.md — the door your AI reads first · START-HERE.md — the first five minutes
references/THE-METHOD.md · EVALS.json · EVALS.md · scripts/evals.py — the method, its template, and the tests with their runner
MY-LEDGER.md · TIN.md · LICENSE-NOTE.md · THE-CLAUSES.md · card.svg + card-machine.svg + card.json · card.html · the doors for ChatGPT, Gemini, Cursor, Copilot and the rest, and an MCP door
ON EVERY DOOR · A CARD FOR YOUR AI, A FILE FOR YOUR COMPUTER
In Claude: turn on code execution under Settings › Capabilities, then Customize › Skills › + › Create skill, and upload the zip as it is — START-HERE.md in the box walks you through it, and tells you how to keep the ledger. In ChatGPT, Gemini and the rest: a Project, a GPT or a Gem with the card’s files attached and the short door in the box pasted as its instructions. The words run anywhere an AI reads Markdown; the machines run wherever the host runs Python. Witnessed in Claude only. The host marks →
Take it.
Nº 670 PROPOSED · ONE PAYMENT
Sold as is under the term printed. A card instructs an AI you operate; results depend on your model, your files and your judgement. Not legal, tax, medical or financial advice. The terms →
One payment. The file is yours to keep and keeps working at its edition; new editions issued in the year after you buy reach you by email as replacement files. Tax is added at checkout where it applies. Nothing auto-renews.
ONE PAYMENT — NOTHING RENEWS ITSELF. CHECKOUT IS SHOPIFY’S OWN; YOUR CARD COMES BY EMAIL AFTER IT.
