⚡ Honest status

How this becomes real.

Right now this page is a mockup. Nothing above is read from a live system, a model, or any customer. Here's the exact, Doug-gated path from this drawing to a real ledger — and the privacy line it would never cross.

1. 1 · per-product tick Each product serves its own slice at <product>/refusals.json, emitted from its own MCP / agent valve log. RadMail from its approval-valve, RadTask from its task valve, RadTalk from the call firewall, RadHealth from the front-office switchboard, RadRobo from the restraint feed.
2. 2 · count only Each tick is a tally and nothing else — no message content, no transcript, no recording, no identifiers, no PHI. The kind of action and how often the valve fired; never what it was about or who it was about.
3. 3 · the family sums This page fetches each slice and adds the totals into the one counter — the sum is computed here from the tributaries, never trusted as a pre-baked number. Each slice must declare synthetic: true until it's served from a real log; until then, the “synthetic” label stays on the number by construction.
4. 4 · no crossed streams Five separate products, five separate counts. No cross-business data flow — the ledger sums public tallies, it never pools anyone's data. RadHealth's slice is administrative chores only; anything clinical is routed to a human, untouched, and is never counted as a patient or outcome metric.

Status: pre-release mockup. The deterministic valve is real and shared across the family; the public per-product /refusals.json feeds are not built yet, so the only honest live count today is zero. Flipping these on is a Doug greenlight. A tool, not a guarantee. Never “fraud-proof,” “guaranteed,” or “HIPAA-certified.”