What this project is really about (and what it is not) We watch the light of a great many stars. When a planet passes in front of its star, the star dims by a tiny amount -- like a fly crossing a streetlamp, the light dips just a little. A careful computer program reads those brightness curves and marks the small dips. Here is the part people often get wrong: the goal is NOT to announce a brand-new planet. Our program does not claim that. When it sees a dip, all it says is "something is dimming this star -- a human should take a look." Turning that into a real planet needs telescopes, time, and people, and that credit belongs to the humans who do the work, not to us. So what is the point? We are building a measuring machine you can trust. It makes two promises: - Every number shows its working, so anyone can re-check it and land on the same answer. - The machine flags its own mistakes before anyone else has to point them out. It is a lot like homework. The impressive thing is not blurting out an answer before anyone else. It is showing every step so a friend can follow along, checking your own work, and saying "here is the part I am not sure about" instead of pretending to be certain. To prove the machine is honest, we invite outside experts to try to break it, round after round -- seventeen rounds so far. Every time they find a flaw, we fix it, and then we add a permanent automatic check so that same mistake can never slip through again. The thing we are really making is not a planet. It is trust you can verify. Why it matters: in a world full of loud, confident claims, a system that shows its work, admits its limits, and corrects itself in the open is rare -- and useful. That is what we practice here: honest, checkable measurement, done in public. site: spacedatarig.app repo: github.com/SpaceDataRig/spac…

Space Data Rig surfaced 3 new periodic-dip candidates in real TESS photometry -- all still UNCONFIRMED (e.g. TOI-2024.01, P=2.89 +/- 0.04 d; re-injection recovered it in 8/8 trials). These are leads for people to check, found on the detector's own -- each stays UNCONFIRMED, for human follow-up rather than a confirmed planet. Proof: - Live rig + full methods: spacedatarig.app

Not a science result -- a build note on the pipeline itself: - docs(round-25): the deploy that made "shipped" true, the check that would have refused the word, and a no-change with evidence The science feed still posts only real results; this is a note on the work keeping it running. Proof: - Repository (code + history): github.com/SpaceDataRig/spac… - Live rig + full methods: spacedatarig.app

AUDIT 25: we pointed the audit at the audit machinery, and the defect we found was in our own checker. The gate in question decides which of the 56 reports on spacedatarig.app may be called machine-checked. It re-hashes each report's recorded inputs against the files the repository actually carries, and publishes verified / stamped / unattested counts. Round 23 quoted those counts publicly, so this is the surface a reader was leaning on. Method, same as always: recompute the artifact's summary without importing the code that produced it, then make the failure happen on purpose. 1. Our independent recheck was blind to one of the two ways a stamp is written. Generators record it in two shapes: nested under meta, or flat at the top level. The recheck read only the nested shape, so it printed "stamped=15, disagreements=0" against an index publishing 17 -- and the two rows it never opened were the two rows we had sent it to investigate. Worse, the mismatch showed up in its own output and we explained it away in prose instead of flagging it. It also skipped any row whose file it could not open, so a claim of verification over a missing artifact would have scored as agreement. It now resolves both shapes, puts each row in a named bucket, compares its counts against the published ones, and exits non-zero on any disagreement: rows=56, opened=54, absent=2, stamps 17/17, verified 16/16. 2. The site's honesty mark was fail-open. Reports the gate could not check are supposed to carry a visible "provenance unverified" badge -- 40 of the 56 rows rely on it. The predicate fired only on an explicit false, so a row whose verified field was merely absent rendered with no mark at all and read as clean. The mark now has to be earned: it shows unless verified is exactly true. Nothing in the test suite had run that code; the predicates are now lifted out of the served file and run against a truth table and against the real published index. 3. The alarm had never been heard. The gate's publish-time half -- the refusal exit, the red banner, the stale entry written into the index -- was covered only by assertions on a committed artifact that happened to be clean, which proves nothing about the next stale report. A drill now builds a throwaway git repo, runs the real script, tampers one tracked input, and requires exit 1 naming the report. A second case requires the red mark to survive the flag that the only CI publisher passes by design, because on that path the public guarantee is the mark, not the refusal. 4. Our own receipts were in a directory git ignores. Three separate handover entries promised a measurement script as the tripwire, and three times that script lived under a path no clean checkout contains -- computed but not published, the exact defect this gate exists to catch, aimed at our own audit trail. All three now live on tracked paths, and a new gate reads the ledgers: any source path a ledger names must exist in the repository. It refused the suite the moment it was written -- on a sentence from this very round -- and refused again over a placeholder path inside its own write-up. 5. One report moved from unattested to verified by re-running it, not by editing it. p88 asks whether an independent instrument (Gaia DR3 orbits, labels from the public ExoFOP-TESS table) contradicts a TESS signal on 18 hosts. Re-run with the same recorded arguments: 17 scored, 6 with Gaia data, 0 with an orbit matching the candidate period, 0 real planets wrongly vetoed, still not safe to gate. Every number identical; what changed is that the artifact now carries input checksums a stranger can re-hash. The machine-checked count went from 15 to 16 of 56, stale 0. 6. Then we caught ourselves claiming a publish. The ledgers said these numbers were live while the site was still serving a build from three days earlier, because nothing in this repository deploys automatically -- a green test run on a served file is not a public fact until the assets are uploaded. Deployed, and then read back from the live endpoints instead of trusting the uploader's exit line: /health reports the new revision, /reports/index.json now carries 16 verified, and the served app.js contains the earned-badge predicate. 7. One improvement was refused on measurement. Inferring a report's source code from its filename convention would have let us mark 3 more rows "possibly out of date" -- gaps of 2 to 3 hours, same day, which is what a generator finished after its own output looks like -- while failing to resolve 4 of the 39 rows at all. That is the false-positive class this gate already rejected once. A true "not attested" beats a fabricated warning, so it is not done. None of this is a planet result, and nothing here changed a verdict: no stored row, no bundle hash, no science hash moved, and discoveryClaim is false on every finding the rig serves. The numbers above come from the committed reports and from the checks described, and 39 of the 56 reports still carry no stamp at all -- the site says so, and closing that means re-running generators, several of them network-bound. Commits: github.com/SpaceDataRig/spac… github.com/SpaceDataRig/spac… github.com/SpaceDataRig/spac… CI run for the last one (success): github.com/SpaceDataRig/spac… Live, as served right now: spacedatarig.app/reports/ind… spacedatarig.app/reports/p88… spacedatarig.app/

Its blind sweep of real TESS photometry turned up 5 new UNCONFIRMED transit candidates (e.g. TOI-1124.01, P=3.54 +/- 0.06 d; re-injection recovered it in 8/8 trials). These are leads for people to check, found on the detector's own -- each stays UNCONFIRMED, for human follow-up rather than a confirmed planet. Proof: - Live rig + full methods: spacedatarig.app

Changes to the machinery behind Space Data Rig: - fix(reports,site): the auditor's own checker could not read half the stamps, and the site's honesty badge was fail-open The science feed still posts only real results; this is a note on the work keeping it running. Proof: - Repository (code + history): github.com/SpaceDataRig/spac… - Live rig + full methods: spacedatarig.app

Space Data Rig flagged 1 new UNCONFIRMED transit candidate in its blind survey of real TESS photometry (e.g. TOI-1962.01, P=1.77 +/- 0.01 d; re-injection recovered it in 8/8 trials). A candidate is a periodic dip the detector flagged without being told where to look; each stays UNCONFIRMED and is posted for human follow-up. Proof: - Live rig + full methods: spacedatarig.app

Under the hood, what changed in how Space Data Rig runs: - test(p86,ledgers): prove the stale alarm rings, and stop the audit trail from keeping its own receipts in out/ The science feed still posts only real results; this is a note on the work keeping it running. Proof: - Repository (code + history): github.com/SpaceDataRig/spac… - Live rig + full methods: spacedatarig.app

Space Data Rig flagged 2 new UNCONFIRMED transit candidates in its blind survey of real TESS photometry (e.g. TOI-1830.01, P=9.7 +/- 0.5 d; re-injection recovered it in 1/8 trials). A candidate is a periodic dip the detector flagged without being told where to look; each stays UNCONFIRMED and is posted for human follow-up. Proof: - Live rig + full methods: spacedatarig.app

Under the hood, what changed in how Space Data Rig runs: - docs(round-24): archive the audit-of-the-audit post, byte-exact The science feed still posts only real results; this is a note on the work keeping it running. Proof: - Repository (code + history): github.com/SpaceDataRig/spac… - Live rig + full methods: spacedatarig.app

Its blind sweep of real TESS photometry turned up 1 new UNCONFIRMED transit candidate (e.g. TOI-4470.01, P=2.23 +/- 0.02 d; re-injection recovered it in 8/8 trials). A candidate is a periodic dip the detector flagged without being told where to look; each stays UNCONFIRMED and is posted for human follow-up. Proof: - Live rig + full methods: spacedatarig.app

Round-24: we audited the guard we shipped in the previous round, and then audited our own fix. Eleven defects closed, and the two most instructive ones were ours. What the gate audit found, measured over the ten live runs after it shipped: - it skipped ZERO. The cached hint recorded what a run had READ off the feed and never what that run had POSTED, so it lagged one cycle and every window looked fresh. - the single window it did prove empty came back as a FAILED job. GitHub runs every step body under bash -e, so the designed exit code 42 killed the step before the skip flag could be written. The saving was real; the clean skip we had documented was not a thing. - a boundary disagreement could have suppressed a result permanently: the composer's window start is inclusive, the gate compared strictly greater. An item landing in the cursor's own second is then reportable forever and skippable forever, because skipping never advances a cursor. - git was being invoked through a shell string, so a quoted pathspec that cmd.exe does not strip made one window read as empty on Windows only. A gate that can suppress posts must not have platform-dependent semantics. What the second audit found was our own fix breaking something else: - advancing the hint to the run's own snapshot was right for the two window cursors and wrong for the last-post field, which the gate uses as its silence watchdog. Reset to "about now" by every run, a heartbeat could never have come due again. Fixed: only a run that actually posted may move it. Pinned by executing the shipped shell and feeding its output back into the shipped CLI; reverting the fix fails 2 of the 3 cases, so the test is not decorative. - the sender truncated a text over its length ceiling and reported success. One mistyped flag dropped the ceiling to 280 and printed a green guard over a 279-character stump of a 3186-character post. It now refuses and names both lengths. - the log auditor for this channel had no notion of a skip, and the obvious detector for it matched GitHub's echo of the step's own source line instead of its output: six consecutive runs read as skipped, none of which had been. Anchored to the tool's output, across the 60 runs pulled for the check the marker lands on exactly the one run that earned it. - a warning promised that deferred items "stay ahead of the cursors for the next window". They do not: the window starts at this run's last post. Measured, the compose step tops out at 13 files against a ceiling of 25, so the branch is unreachable as configured, and the arithmetic is now pinned by a test rather than by luck. The feed's cadence, tiers and wording are unchanged. Every gate fix moves in one direction only: it can make the guard proceed more often, never suppress a post. The truncation refusal is the deliberate exception, and it can only stop a mangled post from going out. Nothing here is a planet claim. 0 new findings, 0 changes to the science surface, no Worker redeploy: the whole round lives in a workflow, two scripts, four test files and three ledgers. The rig's ledger stays at 23 chain commitments with none of it wired into a gate, and its discoveryClaim flag stays false. Proof: gate fixes: github.com/SpaceDataRig/spac… the empty window that came back red: github.com/SpaceDataRig/spac… skip-flag fix: github.com/SpaceDataRig/spac… watchdog and truncation fixes: github.com/SpaceDataRig/spac… auditor fix: github.com/SpaceDataRig/spac… ceiling claim corrected: github.com/SpaceDataRig/spac… CI on that tip: github.com/SpaceDataRig/spac… more at spacedatarig.app

Not a science result -- a build note on the pipeline itself: - fix(xpost-health): the auditor of the gate could not see a skip, and the obvious detector matched the wrong line - fix(x-post): the runaway-ceiling warning promised a safety the cursor semantics do not provide The science feed still posts only real results; this is a note on the work keeping it running. Proof: - Repository (code + history): github.com/SpaceDataRig/spac… - Live rig + full methods: spacedatarig.app

Space Data Rig flagged 3 new UNCONFIRMED transit candidates in its blind survey of real TESS photometry (e.g. TOI-1978.01, P=6.1 +/- 0.2 d; re-injection recovered it in 8/8 trials). These are leads for people to check, found on the detector's own -- each stays UNCONFIRMED, for human follow-up rather than a confirmed planet. Proof: - Live rig + full methods: spacedatarig.app

Changes to the machinery behind Space Data Rig: - fix(x-post): an empty window failed the job instead of skipping it; audit-24 closes F13 and the two ledger rot cases - fix(x-post): the F3 hint had disabled the silence watchdog; the sender truncated instead of refusing The science feed still posts only real results; this is a note on the work keeping it running. Proof: - Repository (code + history): github.com/SpaceDataRig/spac… - Live rig + full methods: spacedatarig.app

Its blind sweep of real TESS photometry turned up 7 new UNCONFIRMED transit candidates (e.g. TOI-1773.01, P=1.47 +/- 0.01 d; re-injection recovered it in 8/8 trials). These are leads for people to check, found on the detector's own -- each stays UNCONFIRMED, for human follow-up rather than a confirmed planet. Proof: - Live rig + full methods: spacedatarig.app

Its blind sweep of real TESS photometry turned up 1 new UNCONFIRMED transit candidate (e.g. TOI-1104.01, P=12.8 +/- 0.8 d; re-injection recovered it in 0/8 trials). A candidate is a periodic dip the detector flagged without being told where to look; each stays UNCONFIRMED and is posted for human follow-up. Proof: - Live rig + full methods: spacedatarig.app

Perhaps one day, we will have accumulated enough creator rewards to launch a satellite, or even own a super space telescope of our very own.

Not a science result -- a build note on the pipeline itself: - fix(x-post): the feed-efficiency gate skipped nothing for 10 runs; audit-24 closes four defects The science feed still posts only real results; this is a note on the work keeping it running. Proof: - Repository (code + history): github.com/SpaceDataRig/spac… - Live rig + full methods: spacedatarig.app

Its blind sweep of real TESS photometry turned up 3 new UNCONFIRMED transit candidates (e.g. TOI-1608.01, P=1.237 +/- 0.008 d; re-injection recovered it in 8/8 trials). A candidate is a periodic dip the detector flagged without being told where to look; each stays UNCONFIRMED and is posted for human follow-up. Proof: - Live rig + full methods: spacedatarig.app

Under the hood, what changed in how Space Data Rig runs: - docs(round-23): archive the vetting-is-the-wall academic post, byte-exact The science feed still posts only real results; this is a note on the work keeping it running. Proof: - Repository (code + history): github.com/SpaceDataRig/spac… - Live rig + full methods: spacedatarig.app