Surface
What bounded path changed?
Name one service edge and map affected, unaffected, and unobserved paths.
KARMA Operations · Aegis of Returned Lessons
The incident should become legible before it becomes lore.
Mirror Garden makes the response clock, evidence language, ownership, coverage gaps, correction path, and learning loop public. Evidence defaults to derived categories only; this contract retains no raw attempt. Authority stays separate. The attacker gets no oracle and no stage.
Read these four things first
The shortest useful incident brief fits in four cards. Anything unknown stays named unknown.
Evidence
How do we know?
Reported, synthetically reproduced, control verified, or corrected—never actor intent dressed up as fact.
Action
Who owns the lease?
Every external change needs a human owner, proportionate scope, expiry, rollback, and verification.
Coverage
Where are we blind?
Provider metadata is unknown here. Static mirrors have no server incident view. Silence is not safety evidence.
The 5 · 15 · 60 response clock
A calm default for the first hour—not an SLA, not a substitute for judgement, and never authority to widen scope.
FIRST 5 MINUTES
Protect continuity
- Name one incident lead and one surface.
- Record derived categories only; retain no raw request under this contract.
- Use only reversible controls already inside the service contract.
FIRST 15 MINUTES
Understand the seam
- Map blast radius and unknowns.
- Reproduce with fresh synthetic data.
- Record owner, reason, expiry, rollback, and expected evidence.
FIRST 60 MINUTES
Recover and learn
- Verify from the user-visible edge.
- Explain impact and gaps without private material.
- Turn the technique family into a reviewed regression.
Transparency without the oracle
Public explanation may carry
- Coarse technique category and service surface
- Cautious evidence state and coverage gaps
- Service-level action, owner role, expiry, and rollback state
- Application or policy version and a correction or supersession
Public explanation must withhold
- Request data, private samples, provider logs, or secrets
- Identity, IP, account, attribution, intent, guilt, or scoring
- Exact low-volume times or counts, hidden thresholds, or rule selectors
- Attacker wording, executable syntax, or attacker-authored publication
Coverage is part of the truth
These hosts are designed to carry one content-addressed static contract. Parity must be checked from manifest.json for every release; it is never inferred from a host name. They do not share a live incident signal.
| Surface | What is present | Incident observation | Known gap |
|---|---|---|---|
| chillspace.love | Cloudflare static room + Meaning API | Disabled | Provider metadata and retention are unknown; traffic is not classified here. |
| chillspace-kingdom.vercel.app | Vercel static mirror + Meaning API | Disabled | Provider metadata and retention are unknown; traffic is not classified here. |
| GitHub Pages | Static mirror | Not available | Meaning falls back to the browser; no server incident coverage is claimed. |
| Codeberg Pages | Static mirror | Not available | Meaning falls back to the browser; no server incident coverage is claimed. |
Private does not mean “keep everything”
The default is derived categories only. Raw request retention is forbidden by this contract.
A separate exception must name its purpose, minimum data classes, least-access encrypted boundary, short expiry, deletion owner, and independent deletion evidence. Credentials, private Meaning text, actor dossiers, inferred intent, and attacker-authored learning or publicity never qualify.
The KARMA loop returns a lesson, not a blow
Technique → synthetic reproduction → regression → reviewed control → correction-capable explanation.
A human may separately turn the lesson into a LOVE or Heartbrick candidate. Raw source text, attribution, counters, and automatic publication never cross that gate. “Use exploiters to spread LOVE” means their technique can improve our care; it never means conscripting their identity or content.
Current public statement
No incident statement is published by this room. That sentence does not mean “no incident occurred.” It means this release publishes a readiness contract and no live incident feed. The offline planner remains advisory, zero-effect, and without production authority.
Canonical repository path: kingdom/practices/karma-defense-lab/