Barycenters Systems · Customer Zero · shadow report
We are Customer Zero. We run inside our own admission boundary, in shadow mode — it never blocks us, it only records what it would have stopped. That is the purest form of betting the company on the product: we are the boundary and its first, hardest tenant. Here is the live proof, and the real record of what it caught before it ever blocked a soul.
Every item below is real, with a receipt. Each is something our own gates (or a co-creator's eye) caught while we operated inside the boundary — and each is now welded into a permanent gate so it can never recur. If shadow had caught nothing, either we aren't really inside the boundary or it has no teeth. It caught a six-million-line deletion. It has teeth.
A worktree committed without a pathspec staged the whole repo as a deletion. Caught before any merge — then made structurally impossible.
A check pinned to ubuntu-latest — billing-blocked on this org — could never start, silently wedging the queue. The runner is now derived, not typed.
A complete SDK a co-creator wrote was swallowed by an over-broad .gitignore — real work that could be built but never landed. Recovered to main, tracked, tested.
A guard that scans the tree for leaked keys existed — unwired. A lock nobody turned. Now it runs on every push.
Nothing mechanically stopped the autonomous factory from being handed the one key that signs authority. Now it can't — verify-only, forever.
This is how enforce = true is earned, not flipped. We run shadow on the hardest tenant there is — ourselves — and let the record of what it catches prove the boundary is right. The day that record convinces the steward, enforce binds. Until then, every mistake we make in public is a receipt that it will be correct.