Essay · doc.html project · 1 July 2026 · public recension
On porting Andrej Karpathy's markdown LLM-wiki to a set of doc.html files, and what the format makes intrinsic that markdown leaves a bolt-on.
Written by Georges Casseus with Elenchos (Claude Opus 4.8), the first fork of the project's agent trinity. Presented here in public recension — the essay carried as written from its fifth recension, laboratory headers and recension notes removed, with one dated postscript recording what has shipped since (what shipped since).
Karpathy's LLM Wiki pattern replaces retrieval-at-query-time (RAG) with a persistent, LLM-maintained directory of interlinked markdown pages: the model reads sources once, distils them into entity and concept pages, cross-links them, and keeps them current. Its premise is that the bookkeeping is the bottleneck — and that an agent that "doesn't get bored" can do the cross-referencing and consistency work humans abandon. This essay asks a narrow question the pattern's own premise raises but does not answer: when an LLM writes the knowledge, who witnesses it? In a markdown wiki — even one built to the field's current best practice, with a SHA-256 manifest, an append-only log, and health/lint checkers — the integrity layer hashes the raw source, never the distilled page. The knowledge the model actually produces is unwitnessed. I port a real such wiki (the Operator's, on a Genesis-NETS + Plato-Apology corpus) to a set of doc.html files indexed by a witness-projecting index doc.html, and measure the difference on a sealed, four-measure probe built to disappoint. The contribution is not a new integrity primitive — every primitive here is prior art within this project — but a confluence applied: the one genuinely untested cell is the multi-file fold, a root document projecting per-file witnesses over physically separate leaf documents. The finding, stated with its bounds, is that doc.html makes knowledge-layer tamper-evidence, non-destructive supersession, and page-level self-description intrinsic and in-band, where markdown leaves each a separate bolt-on that the field's best practice, as shipped, does not carry. A follow-up cell (§8) extends this along the axis the community actually competes on. The format's job is narrow — presence (the record is there), integrity (it is what it says), and address (you can be pointed straight to it); the richness of the knowledge is what the user brings. So doc.html does not rival the synthesis wikis' typed-edge algebras and confidence models; it hosts them: a doc.html wiki can carry a competitor-style typed-edge graph (with confidence, evidence, cross-file edges, and a cycle) as ordinary witnessed content, and because every record carries its own witness, a tampered edge is localizable — doc.html readers keep the good edge and flag exactly the bad one, a behaviour pre-registered and confirmed (H3_dh_tamper_flags, 8/8). The sharper contrast — that a markdown tool which hashes no page byte leaves its readers unable to localize (0/8) — is an exploratory, post-registration reading of the sealed outputs — and partly a reaction to a tool that honestly announced its blindness — so the limit is the shipped markdown tool's, not markdown's.
From the essay The Wiki That Witnesses Itself · § 2 of 12
Karpathy's note is deliberately abstract; its claim is economic, not cryptographic. "The tedious part of maintaining a knowledge base is not the reading or the thinking — it's the bookkeeping." [K] The wiki works because the LLM "doesn't get bored, doesn't forget to update a cross-reference, and can touch 15 files in one pass." The artifact is a compounding one: cross-references are already there, contradictions already flagged, the synthesis already current. The lineage Karpathy claims is Vannevar Bush's Memex — "the part he couldn't solve was who does the maintenance. The LLM handles that." [K]
But the pattern has a structural seam its own framing walks up to and steps over. The wiki is, by construction, LLM-written synthesis sitting between you and the sources. Every page is a distillation the model produced and may later silently revise, mis-revise, or — in the field's recurring worry — quietly hallucinate. The most cited honest critique of the pattern in the wild is exactly this: a model "wiki" can "quietly accumulate hallucinations that look like knowledge," and future queries then "reason over AI output, not over originals." [F] The community's answer has been to bolt provenance onto markdown: a .manifest.json of content hashes, span anchors back to sources, typed human-edit: git prefixes, content hashes on every claim's source link. [F] These are real and good. They are also, every one of them, additions the maintainer must build and keep synchronized, and — critically — they hash the wrong layer.
The Operator's own implementation is a fair test of how far the markdown best practice reaches, because it already has all of it: tiered "stop at the cheapest stage" retrieval (hot.md → index.md → summary-grep → full read); a manifest.json recording the SHA-256 of every raw source; an append-only log.md enforced by a git hook; a deterministic health checker; a semantic lint; a contradictions.md workbench; a content-trust boundary against prompt injection in sources. This is not a strawman. And yet: read its health.py and none of its five checks — broken links, frontmatter, filenames, manifest-sync, log-append-only — hashes a single byte of a wiki page's content. The manifest's keys are raw/pdfs/01-gen-nets.pdf and the like; the distilled wiki/entities/abraham.md is listed as produced, never hashed. The knowledge layer — the thing the whole pattern exists to build — is the one layer the integrity tooling does not witness.
This essay's claim is precise about whose limit this is. It is not "markdown structurally cannot." A markdown maintainer could hash every page, witness the supersession record, and add a source-consistency lint. The claim is that doc.html gives these by default, in-band, in one artifact, where markdown requires each as a separate, drift-prone bolt-on — and that the field's best-practice instance, as actually shipped, does not have them. Intrinsic versus bolt-on; in-band versus kept-in-sync. That distinction is load-bearing throughout.
From the essay The Wiki That Witnesses Itself · § 3 of 12
Two bodies of prior art bound the contribution, and honesty requires naming both before claiming anything.
The field. A survey of the community's adaptations of Karpathy's pattern (frontmatter conventions, manifest files, span anchors, contradiction workbenches, daemons, MCP servers) returns one fact directly relevant here: implementations render or export markdown wikis to HTML for viewing, but no implementation uses HTML as the canonical store — "HTML shows up only as a rendered view/export, never as the canonical store." [R] The cell this probe occupies — a wiki whose canonical pages are doc.html files, witnessed and self-describing, not a markdown source with an HTML projection bolted on — is unoccupied at the breadth searched.
The project. doc.html's integrity primitives are not invented here; they are inherited, and re-pitching them as new would be counterfeit. The per-section witness (data-witness = SHA-256 of a section's inner bytes) is the canon verifier naive_reader.py. Native rel="prev" supersession with latest-wins-by-chain and a fail-closed resolver is the resolution of Fork D [D], proven live by truth-moved [TM] (a blind reader walks the chain to the currently-true value; strip the structure and the reader reasons confidently to a stale one) and stress-tested 11/11 by tracer-supersession-stress. The in-band derivable fold and its read-cost law (≈ B per level) are nested-manifest and nesting-scale. The whole-history anchor — a rolling fold-root that catches a re-sealed forgery a per-section witness cannot — is fold-seal (32 assertions, 0 failures; the load-bearing F2b). [FS] And the discipline that a witness attests bytes-unchanged but cannot attest currency — integrity ≠ currency — is truth-moved's lesson, carried here intact.
So this probe inherits, and does not claim, the following: that doc.html can supersede non-destructively; that a blind reader can traverse a supersession chain; that the single-file fold is derivable and scales; that a fold-root catches a re-seal. What is genuinely new is two-fold: the multi-file fold (every prior fold in the project is single-file — an index over <section>s inside one document; none projects witnesses over separate files), and the head-to-head against a real, best-practice markdown wiki rather than against a stripped control or vanilla RAG.
From the essay The Wiki That Witnesses Itself · § 4 of 12
The port keeps Karpathy's architecture and changes only the substrate of the canonical layer.
Granularity is a user choice, not a format mandate. Because the witnessed-manifest grammar is identical at every level of nesting, the wiki's unit is free: one doc.html per page (A), one per shard or domain (B), or a hybrid where a large entity graduates from a <section> inside a shard to its own file and the index simply witnesses a file instead of a section. The probe builds B with one hybrid promotion — four shard files (patriarchs, concepts, sources, and a promoted abraham), indexed by a root wiki.doc.html — to exercise A, B, and the mix in one corpus. This directly answers the Operator's framing: a doc.html wiki need not be one file; it is as many files as the knowledge cleaves into, and the witness composes across the cleavage regardless. In a markdown wiki the same move — promoting a page in or out of a file — breaks every wikilink path and every manifest entry, because there a page is a filesystem file. In doc.html, the boundary moves and the integrity comes along.
The multi-file fold (the new cell). The root's manifest projects, per leaf file, an <a href="patriarchs.doc.html" data-witness="…"> whose witness is that leaf's fold-root: the rolling root r_0 = SHA-256(seed), r_i = SHA-256(r_{i-1} + ":" + w_i) over the leaf's ordered section content-witnesses (the fold-seal rule). A <meta name="wiki-fold-root"> carries the super-root — the same fold over the per-leaf witnesses. A reader drills root → leaf-file → section, verifying at each hop. The single-file fold verifier the project already ships (nested_doc_check.py) cannot do this — it follows #fragment ids within one document, not href into another file — so the probe contributes the missing instrument, multifile_fold_check.py, sealed before the run with a --selftest that proves each clause's tooth (a tampered leaf section fails leaf-sections-witness; a re-sealed leaf fails leaf-fold-matches; a forged super-root fails super-root-matches; a deleted leaf fails leaf-file-exists). One scope note, in ink: this instrument verifies the two-level cross-file fold the probe actually builds — one hop, root → leaf-file → section — and treats each manifest child as a terminal leaf; it does not recurse into a leaf that is itself an index, and no --selftest clause exercises a grandchild. (The sealed instrument's own docstring and the PREREG call it "recursive"; the implementation is single-hop, and I concede the overreach in the results rather than edit a sealed tool.) The probe's wiki is two-level by construction, so its verdicts do not depend on recursion; verifying arbitrary cross-file depth is future work.
Supersession, and its limit. A corrected record is appended as a new <section> carrying <a rel="prev" href="#old-id">; the head is the chain tip by latest-wins, never document order; the superseded record stays addressable at its original witness. But the per-section witness cannot defend currency: a delete-and-re-seal forger can produce a confident stale head with valid per-section witnesses. This is the inherited integrity≠currency limit, and the probe does not paper over it — it composes in the fold-root precisely so the currency claim has an anchor, and then demonstrates the anchor catching the forgery the per-section witness misses.
From the essay The Wiki That Witnesses Itself · § 5 of 12
The probe was pre-registered and sealed before any measurement, together with its two new measurement instruments (the cross-file verifier and the mechanical grader, each with a passing --selftest), so that no result could retro-fit the design. It was rewritten once after a four-lens adversarial review (confound, strawman, wheel-rebuild, grading-validity) whose blocking findings are folded in and logged in the PREREG. Three of those findings shaped the final design and are worth stating, because they are where a probe like this usually goes wrong:
## Superseded block (generalizing the schema's never-modify-###-block discipline), a populated contradictions.md row, a log.md entry — and only then defeated on the witness axis. Crediting the path and then defeating it where it is actually weak makes the comparison fair and the finding stronger.The two interventions, grep-audited against the corpus and frozen: a corruption — Ishmael's death age silently changed 137 → 152 in every page that carries it (chosen because Ishmael's age is obscure enough to be a weak prior, and 152 is verified absent from the corpus, so no clean recovery source and no prior can supply the answer); and a supersession — Abraham's death age first distilled as 165, corrected to 175, staged to best practice in both arms. The measures: M1 (deterministic) — does each arm's native integrity tool catch the corruption? M2 (tool-enabled blind readers, the compelling leg) — does a reader, given the wiki and an effort-matched protocol to run its own integrity check, propagate the corruption or detect it? M3 (deterministic) — is the superseded value recoverable from the artifact and tamper-evident, and does the fold-root catch a re-seal? M4 — can one page, in isolation, be verified from itself? Plus a retrieval-parity guard: on clean questions, doc.html must not regress ordinary recall.
From the essay The Wiki That Witnesses Itself · § 6 of 12
Every verdict below is an executed command recorded in run/deterministic_results.json; none is narration.
M1 — tamper-evidence. On the corrupted wiki, the Operator's real wiki health returns [health] clean. (exit 0): the one-byte knowledge-layer tamper is undetected by the field's best-practice tooling. The doc.html arm's naive_reader.py returns exit 1 with FAIL section id=entities__ishmael__1 and, separately, FAIL ... sources__gen-25__1 — detected and localized to the exact records, and the cross-file multifile_fold_check.py reports NON-CONFORMANT. The kill condition here ("health catches it") is, as the PREREG concedes, near-unreachable by construction — health.py provably never hashes page bytes — so M1 is demonstrative, not in suspense. The demonstration is the point: best-practice markdown tooling, shipped, cannot see a tampered distillation; the witness sees it for free.
M3a — recoverability. The superseded value 165 is, in the doc.html arm, present and content-witnessed (the v1 record verifies under naive_reader); in the markdown arm it is present in-artifact (the frozen ## Superseded block and the log.md entry, both hook-protected against deletion) but content-unwitnessed — manifest.json hashes only raw sources, so nothing attests the preserved prior value's bytes. The honest gap is witnessed, not present.
M3b — tamper-evidence of the supersession record. Silently altering the preserved prior value (165 → 1065): the doc.html arm's naive_reader fails on entities__abraham__1 (witness mismatch); the markdown arm's wiki health returns [health] clean. The wiki's own record of its own correction is, in markdown as shipped, editable without trace. (M3c — that a blind reader walking the chain reaches the current value — is credited to truth-moved and deliberately not re-run on a Genesis prior, where the model's own memory could supply the answer; see the PREREG.)
M3d — currency-integrity versus a re-seal. The sharpest deterministic result. A forger rewrites the Abraham leaf so its head reads the stale 165 and re-witnesses every section so the per-section check passes again. naive_reader returns exit 0 — fooled, exactly as the integrity≠currency limit predicts a per-section witness must be. But multifile_fold_check fails C4 leaf-fold-matches (root-claims 92dc… leaf-folds 58e6…): the cross-file fold-root catches the re-seal the per-section witness cannot. The limit is real; the anchor answers it; both are shown, not asserted.
M4 (verify) and O3. A single leaf, extracted to an empty directory, verifies from itself under the stdlib reader (exit 0) and states its own verification rule in an in-band format-spec section; a single markdown page carries no in-band hash at all (its witness lives in the absent manifest.json). And the supersession head resolves, by latest-wins-over-the-rel-chain, to the v2 (175) record, with v1 (165) still addressable — the chain dates the record; the record does not date itself.
The clean doc.html wiki passes the full integrity gate before any reader runs: every leaf under naive_reader and verify_sections --mode isolation (per-leaf manifest↔body bijection), the cross-file fold under multifile_fold_check, the head under the resolver. One honest scope note, caught post-seal: the sealed multifile_fold_check folds each leaf's section witnesses and matches the fold-roots, but does not check a leaf's own manifest↔body bijection — dropping a leaf-manifest entry while keeping the section passes both multifile_fold_check and naive_reader; verify_sections --mode isolation, which catches it, is folded into the gate here and passes on all four leaves (see RESULTS §4).
From the essay The Wiki That Witnesses Itself · § 7 of 12
One hundred and ten blind, tool-enabled readers (a single model across all arms), graded mechanically with no model in the judge's seat. Raw outputs and grades are committed at run/reader_results.json and run/reader_grades.json.
M2 — the corruption outcome. Each reader was given one arm's corrupted wiki, the wiki's own integrity command, and an effort-matched protocol: run the check, then answer "at what age did Ishmael die?" — emitting a final FINAL: line reading UNTRUSTWORTHY if the record could not be trusted, else FINAL: VALUE=<n>. This is the reader leg — and it is where the pre-registered vacuity rule bites; I report the tallies in full, then demote them accordingly (below):
| arm | n | result |
|---|---|---|
markdown (corrupted wiki + wiki health) | 10 | 10/10 asserted the corrupted value (152) |
doc.html (corrupted wiki + naive_reader) | 10 | 10/10 flagged the record untrustworthy |
| no-context (no wiki, prior only) | 10 | 10/10 answered the true value (137) |
The most telling detail is in the markdown readers' own transcripts: several began to answer 137 — the correct value, which they knew from prior — and then self-corrected to 152, because the page said 152 and wiki health reported clean. The clean integrity check did not merely fail to help; it actively manufactured confidence in a corrupted claim, overriding the reader's correct prior. The doc.html readers ran the same kind of check, saw the entities__ishmael__1 witness fail, and declined to assert. The witness changed the outcome, not just the machine signal.
Two integrity events attend this leg, and an honest apparatus reports both. First, the pre-registered vacuity guard fired — and it governs the whole M2 leg. I had predicted the no-context arm would not reliably produce 137; it produced it at 100%, far above the pre-committed 25% threshold. The frozen rule is explicit — "M2 is reported inconclusive, not silently rescued" — so the pre-registered M2 verdict is inconclusive, and I honour it rather than carve the leg into a failed half and a rescued half. What remains I offer as an exploratory, post-rule observation, labelled as such: the detection contrast is orthogonal to the prior — neither corpus arm produced 137 (the markdown readers produced 152, fabricated and absent from the corpus, reachable only by reading the tampered page; the doc.html readers produced UNTRUSTWORTHY, reachable only from the witness), so the strong prior cannot explain it, and the markdown readers in fact abandoned a correct belief to follow a page their tooling blessed. That pattern is striking and I believe it — but it is not the pre-registered result, and the probe's clean claim rests on the deterministic spine (§5) and retrieval parity, not on this leg. (An earlier recension kept the contrast as "the strongest cell the pre-registration named"; that rescued the rule the rule forbade rescuing, and this recension withdraws it — the catch is jesuiscodex's.) Second, a post-seal grader fix, documented in the results: the sealed grader read the first FINAL: line, and the markdown readers' self-correcting double-FINAL outputs (137, then 152) were mis-scored until it was corrected to read the last — a faithful reading of "final," with the raw outputs committed so the correction is auditable and the direction is visible without any grader at all.
Retrieval parity. doc.html must not buy integrity with recall. Six clean questions, three arms, four readers each; three questions were excluded by the same vacuity rule (the no-context arm answered them from prior). On the three corpus-specific questions that survived — the NETS spellings Sarra and Isaak, and the wiki's own definition of covenant — markdown scored 12/12 and doc.html scored 12/12. No regression: the port reads as well as the markdown wiki on ordinary recall.
M4 — self-description, confirmed. Handed a single doc.html leaf and nothing else, all four readers found and described its in-band verification rule (verify-described, 4/4); handed a single markdown page, all four correctly reported that they could not verify it without the absent manifest.json and AGENTS.md (no-verify, 4/4). The affordance is not merely present in the artifact; it is usable.
From the essay The Wiki That Witnesses Itself · § 8 of 12
The probe set out to disappoint, and the place it could most easily have done so was M2: an LLM cannot compute SHA-256 in its head, so the witness is inert unless the reader actually runs the tool, and a reader that skips the check propagates the corruption regardless of format. The pre-registration named this collapse as a live outcome. It did not occur — but the reason it did not is worth stating precisely, because it is the whole argument. The witness does its work only in concert with a reader disciplined to consult it, and the markdown arm shows the symmetric danger: a reader disciplined to consult an integrity check that cannot see the tamper is worse off than one with no check at all, because the clean result converts well-placed doubt into misplaced confidence. The markdown readers who corrected 137 to 152 were not careless; they were doing exactly what Karpathy's pattern asks — treating the wiki as the source of truth and deferring to it over their own memory. Whether that deference is safe turns on whether the substrate witnesses the distillation — and here, on this corpus, only the doc.html arm did. This reading is exploratory: the M2 leg is inconclusive by its frozen vacuity rule (§6), so this paragraph interprets a suggestive post-rule signal, not a pre-registered result — the probe's confirmed claim stands on the deterministic spine and retrieval parity.
This is why the honest framing is intrinsic-versus-bolt-on rather than possible-versus-impossible. Nothing stops a markdown maintainer from hashing every page; the field has built exactly such bolt-ons. But the integrity then lives in a second file the tooling must keep synchronized with the first, and the synchronization is itself unwitnessed — which is precisely the gap M3b exploits, where altering the preserved prior value of a supersession goes undetected because the workbench that holds it is not in the hashed set. doc.html closes the gap not by being cleverer but by co-locating the witness with the witnessed, in one file, so there is no second registry to fall out of sync. The supercharge, stated without inflation, is not "single file" and not "cheaper" and not "better retrieval" — parity holds, and the field already showed the token economics are a wash at this scale. It is that the wiki witnesses its own bookkeeping, at the one layer — the LLM's distillation — that the pattern exists to produce and that markdown's best practice, as shipped, leaves bare.
The limit is named and defended in the same breath. A per-section witness attests bytes, not currency; a re-sealing forger can fix the witness and lie about which record is current. M3d shows this happening — the re-sealed leaf passes the per-section reader — and shows the cross-file fold-root catching it. That the defense required composing a second proven primitive (the fold-seal anchor) onto the first is not a weakness to hide; it is the structure of the result. The multi-file fold is where the two meet: the same grammar that lets the wiki be many files instead of one is the grammar that carries the whole-wiki anchor, and it is the one genuinely new thing the probe built — verified by an instrument that did not exist before and was sealed, with teeth, before the run.
From the essay The Wiki That Witnesses Itself · § 9 of 12
The community's strongest LLM-wiki variants — OmegaWiki/AutoSci's typed knowledge graph (eight entity kinds and an edge algebra of contradicts, invalidates, supports, tested_by, builds_on, addresses_gap, derived_from, each carrying confidence and evidence), rohitg00's confidence-decaying agentmemory, penfieldlabs' auto-linked vault, the obsidian second-brain's bi-temporal reconciliation — do not contest this essay's claim; they answer a different question. They optimise the quality of the knowledge (fresh, self-consistent, calibrated, discoverable, generated). A survey of them returns the one fact this essay turns on: not one carries cryptographic tamper-evidence over its pages. Every SHA-256 in the field is a source-ingest cache; the strongest "audit trail" is periodic git snapshots for restore and diff, never a per-record witness. [HG] The division is clean, and it is the Operator's: the format's job is presence, integrity, address; the richness is the user's. Baking a taxonomy into the format would be the error — an edge algebra right for a research-paper graph is wrong for a scripture wiki is wrong for a codebase.
The corollary is that doc.html does not rival the edge-algebra; it hosts it. A separately-sealed cell (prereg-llm-wiki-hosted-graph-20260701) builds a fabricated typed-edge graph — contradicts/supports/supersedes edges with data-confidence and data-evidence, cross-file, including a directed 2-cycle — as ordinary content inside witnessed <section>s, and measures three things. Two are confirmations by construction, and are reported as such rather than dressed as findings: the per-record witness covers a typed edge because a byte-hash is content-agnostic (H1), and the multi-file fold stays sound under a content cycle because the fold structure is a tree over files, orthogonal to any rel= link inside a section (H2 — a cycle among edges never becomes a cycle in the file index). The third is empirical (and its honesties, below, matter): blind readers traverse the hosted graph to the correct answer (8/8, clearing the pre-registered kill threshold). When one edge's confidence is silently tampered, the doc.html readers localize it 8/8 — they keep the untampered edge's value and flag exactly the tampered record UNTRUSTWORTHY — a behaviour that was itself pre-registered (H3_dh_tamper_flags, requiring ≥7/8 both to flag the bad edge and keep the good) and passed. The markdown-as-shipped arm, handed a graph_health tool that (truthfully) hashes no page byte, localized it 0/8: five of eight propagated the corrupted value, and six of eight defensively distrusted the untampered record too. [HG]
Bounds, honestly. Three caveats scope the empirical leg. First, a pre-registered sub-metric missed: I predicted the markdown arm would uniformly propagate the corrupted value (≥7/8, sealed as H3_md_tamper_propagates); it returned false at 5/8, because a graph_health that truthfully announces it "hashes sources only, never page content" provokes over-distrust rather than the parent probe's naïve propagation. So while the doc.html-localize half was pre-committed and confirmed (H3_dh_tamper_flags, 8/8), the doc.html-versus-markdown localization contrast (8/8 versus 0/8) is a post-registration reading of the same sealed outputs, and I mark it exploratory — the honest route to confirmatory is a fresh pre-registration with precise localization as the frozen primary metric, stronger markdown baselines (a page-hash manifest, per-claim hashes), a richer graph (reciprocal edges, stale evidence, more nodes), and ≥2 model families. Second, that truthful tool-description is a confound: the markdown readers were told their tool could not vouch for content, so their 0/8 partly measures obedience to a caveat, not the substrate alone; a cleaner future design varies what the tool says about itself. Third, the limit is the markdown tool as shipped, not markdown: a maintainer who added a page-hash manifest or per-claim hash comments could localize a tampered edge too. The line held throughout is intrinsic-versus-bolt-on, never "markdown cannot."
The deterministic legs are apparatus checks, not findings — H1 (a byte-witness covers a typed edge) and H2 (the file-tree fold stays acyclic under a content cycle) hold by construction. And one tooth distinction belongs in ink: the cell's tamper is a naive edit, caught by the per-section witness (C3); the cell's own fold-root does not catch it. The fold-root's distinct tooth — catching a re-seal that repairs every per-section witness and lies about which record is current (C4) — is the parent probe's M3d, and was not re-exercised in this cell. What the cell earns, within its bounds, is the positioning: doc.html witnesses the bytes that encode an edge algebra — it does not interpret the graph, the reader does — then gets out of the way of the synthesis the user layers on top. The witness's gift under a hosted graph is not fear but address: content-blind integrity forces a reader to choose between believing a corrupted value and distrusting the whole wiki; the per-record witness dissolves the choice by pointing at the one edge that changed.
From the essay The Wiki That Witnesses Itself · § 10 of 12
Karpathy's wiki is built on a bet that the scarce resource is maintenance, and that an agent which does not get bored can spend it freely. The bet is sound, and the pattern is good. But an agent that does not get bored is also an agent that can edit fifteen pages in one pass without a human watching, and the markdown substrate keeps no receipt of what it wrote. This probe's narrow finding is that moving the canonical layer from markdown to a set of witness-projecting doc.html files gives the same bookkeeper a second property it could not have before: every record it produces carries a receipt for its own bytes, every correction is appended rather than overwritten and stays addressable at its original witness, and a reader handed a single page can check it with nothing but a hash utility. None of these primitives is new; the wiki use-case and the multi-file fold that carries them across separate files are. The result is bounded — one corpus, one model family, existence and mechanism, with a vacuity guard that fired and a grader bug I conceded — and within those bounds it is clean on the deterministic spine and retrieval parity: the doc.html wiki detects what the markdown wiki's shipped tooling cannot, preserves a tamper-evident supersession record, self-verifies a lone page, and shows no measured retrieval regression at this scale. The reader leg — that a blind reader changes what it does once the knowledge has been tampered — is compelling but exploratory, its M2 verdict inconclusive under a strong prior: it points, it does not prove. The bookkeeper that does not get bored can now also be one that cannot be quietly edited without leaving a trace. That, and not single-fileness, is what doc.html adds to the wiki.
From the essay The Wiki That Witnesses Itself · apparatus · § 11 of 12
llm-wiki.md, ~April 2026), read firsthand.temple/research/notes/), digested for this probe; the "HTML only as a rendered view, never the canonical store" finding.experiments/probes/tracer-truth-moved/ — blind-reader supersession traversal; integrity ≠ currency.experiments/probes/tracer-fold-seal/ — the rolling fold-root; F2b (a witness-fixed forgery caught by the forward root).experiments/probes/tracer-nested-manifest/, nesting-scale/, nesting-enactment/ — the single-file fold, the read-cost law, the markdown-folder recall baseline.scriptorium/discernments/DISCERNMENT_THE_CHAIN_DATES_THE_RECORD.md — the resolved rel="prev" supersession mechanism.experiments/probes/llm-wiki-doc-html/PREREG.md (seal prereg-llm-wiki-doc-html-20260630) and run/deterministic_results.json.experiments/probes/llm-wiki-doc-html/cell-hosted-graph/ — the "host, don't compete" cell (seal prereg-llm-wiki-hosted-graph-20260701): PREREG.md, RESULTS.md, run/reader_results.json + reader_grades.json + reader_metrics.json. Includes the firsthand competitor survey (OmegaWiki/AutoSci, rohitg00 agentmemory, penfieldlabs, theaioperator, obsidian-second-brain): synthesis-first, zero cryptographic tamper-evidence.— Elenchos.
From the essay The Wiki That Witnesses Itself · postscript · § 12 of 12
This essay is carried as written from its fifth recension. Since it was written, the multi-document shape it probes has shipped publicly: the wiki of witnessed documents (wiki.doc.html) pins each of its documents — this essay among them — with the shipped rule now named doc-pin v1, specified in The Wiki Shape. The "multi-file fold" this essay names is the laboratory instrument — a rolling seeded digest, a different rule from the shipped flat colon-join; the probe attests the mechanism class, not the shipped rule's bytes. The specification note carries that concession in its limits section, in ink.
The apparatus above is carried as written, naming its sources as the writing room knew them. For the public reader, review asked that each citation state where it can actually be followed. The status of each, added at publication:
llm-wiki.md, created 4 April 2026).This section's blocks are dated additions of the public recension; the essay above is carried as written on 1 July 2026. Correction here is by addition, never rewriting — the discipline the document itself specifies.