Five reviewer routes. The route changes how to inspect the system; it does not change the proof state.

Website/GitHub rendering is not proof. Public surfaces route reviewers to proof records.

Eight stages. One direction. Generated work can enter the machine; only authorized proof can leave it as public wording.

Current public ceiling: CONTROLLED_TEST_VALIDATED.

HO-DET-001 is the artifact reviewers can trace end to end without accepting a stronger public claim.

Public proof ceiling remains CONTROLLED_TEST_VALIDATED. Public-safe status remains NOT_PUBLIC_SAFE.

Proof Pack 001 is the planned reviewer package for HO-DET-001. It is release-prepared only until an official GitHub tag, release, and assets exist in hawkinsoperations-proof.

Do not treat planned packaging language as official release proof.

Public wording passes through boundary review before it ships. Blocked terms stay visible because they describe what this surface does not assert.

Blocked unless separately promoted and approved:

public-safe | production-ready | fleet-wide | live enterprise deployment | autonomous SOC | AI-approved disposition | analyst-approved disposition | runtime-active public proof | signal-observed public proof | evidence-linked public proof | live Splunk public proof | Cribl-routed public proof | Wazuh-routed public proof | AWS-live proof | customer-ready product | sold product | enterprise deployment

Allowed public boundary for this profile:

Each surface supports its own claims, nothing more.

Promotion is upward and gated. Repo source, runtime state, signal observation, evidence linkage, website rendering, and public proof do not inherit authority from one another.

flowchart LR
    A[Source] --> B[Validation]
    B --> C[Case packet]
    C --> D[Proof record]
    D --> E[Public boundary]
    F[AI support] -. labor only .-> A
    F -. labor only .-> B
    G[Human review] --> D
    H[Deterministic checks] --> D
    E -. rendering is not proof .-> I[Website / GitHub]

Six repositories. Three planes. Authority flows through scoped records, not presentation.

Detections -> validation -> proof feeds the authority chain. .github routes reviewers. hawkinsoperations-platform remains an internal/private runtime-contract route. The website renders receipts; it does not author them.

Website/GitHub rendering is not proof.

Current safe reading:

• CONTROLLED_TEST_VALIDATED means the public ceiling stays at the controlled-test boundary recorded by proof.
• NOT_PUBLIC_SAFE means private evidence material is not approved for public release.
• RENDERING_NOT_PROOF means website and GitHub pages can route reviewers, but they cannot create evidence.
• HUMAN_REVIEW_REQUIRED means AI output, CI, and rendering do not authorize promotion by themselves.
• Case packets are produced and validated in hawkinsoperations-validation and cited or recorded by hawkinsoperations-proof.
• Stronger wording requires reviewed evidence linkage, stale review, privacy review, and Raylee approval.

HawkinsOps V1 / SignalFoundry metrics are prior operating context only. They are not current HawkinsOperations proof and do not raise the current HawkinsOperations ceiling.

Current HawkinsOperations claims are bounded by source, validation, evidence, and the public-proof surface.

Official release and discussion links are not asserted here unless they are published.

Repo separation creates review boundaries. Real control comes from required review, deterministic verification, CI checks, proof records, and bounded public wording. The split is necessary; it is not sufficient. Treat the boundary as the artifact, not the architecture diagram.