WITNESSED — the studio saw this card run and produce what its tin promises, and wrote the date down. What the marks mean →
What it is.
A sweep before every commit and every paste into an AI. secrets.py names every secret-shaped string by file and line — API keys of every major shape, tokens, private-key blocks, JWTs, connection strings with passwords, .env assignments, card numbers checked by Luhn, emails in bulk — and refuses. The hit shows the line and the first six characters of the secret, never the whole thing. The paste mode reads what is about to go into a chat and stops it at the door. The card carries secrets.py with a selftest.
the sweep knows the shapes of secrets; a secret shaped like nothing known passes, and the card says so Refuses: Refuse to pass a file or a paste that carries a secret-shaped string. Refuse to print a found secret in full.
What’s in the buy.
scripts/secrets.py — the machine, with its selftest
CARD.md + SKILL.md · TIN · LICENCE + LEDGER · MANIFEST, every file hashed · the two faces, card.json, card.html
PROOF · SELFTEST 8/8 · AN ANTHROPIC-SHAPE KEY, AN AWS KEY, A CONNECTION STRING, A .ENV SECRET AND A PRIVATE-KEY BLOCK FOUND BY FILE AND LINE; A CLEAN FILE RAISES NOTHING; LUHN BEFORE A CARD NUMBER COUNTS; THE HIT NEVER SHOWS THE WHOLE SECRET · 2026-09-09 · PUNCH 04CD46860DD40C5841C52552
ON EVERY DOOR · A CARD FOR YOUR AI, A FILE FOR YOUR COMPUTER
This card is an Agent Skill on the open standard: the same folder loads unmodified in Claude, ChatGPT and Codex, Copilot and VS Code, Cursor, Gemini CLI, Goose, OpenCode and the rest of the showcase. Its words are Markdown, so any chat with an instructions box holds them, any local model runs them offline, and any MCP client can load them — THE UNIVERSAL CUT: a pasteable system card, the rules-file family, an Ollama Modelfile, an MCP server, all cut from this card’s own SKILL.md by THE CARD FORGE. The universal cut is in this card’s box. And card.html — the card as one file for your computer: both faces, the tin, the words, every door; offline, in any browser. The machines aboard run wherever the host can run Python; the words run everywhere. The host marks →
Take it.
Nº 075 · PROPOSED —LAUNCHING SOON
Sold as is under the term printed. A card instructs an AI you operate; results depend on your model, your files and your judgement. Not legal, tax, medical or financial advice. The terms →
LAUNCHING SOON
THE TERM LADDER · PICK YOUR WINDOW
LAUNCHING SOONTHE WEEKLAUNCHING SOONTHE MONTHLAUNCHING SOONTHE YEAR
A term is a window of editions: every edition of this card issued inside it replaces your file. When the window closes, the file you hold keeps working — freeze, not loss. Nothing auto-renews; come back and take another term when you want the next editions.
