How it works

Trustillery runs on Memstead, a graph engine for typed cards. The terms below are the site's glossary, one definition each; the card kinds among them are the engine's schema, which refuses what does not fit. How this is built → · The engine underneath →

Every anchor points from its claim to a document, a page and a verbatim span; a second identity re-reads the span in the text it fetched itself.

The stock and its cards

stock: Everything on one contested question: the question, every card that answers it, and the ledger on them. A git-branch mem `stocks/<name>` under the evidence schema.; Not to confuse with a proposal, which is a fork of a stock
card: One entry a stranger can check or attack on its own: an anchor, derivation, tradeoff, statement or reply. The question is part of the stock but not a card.; Not to confuse with entity, Memstead's general word
question: The one contested question of a stock, decidable by published documents, with its scope in the sentence and a list of what it does not ask. It never carries an answer or a leaning.; Not to confuse with answer card
anchor: A card recording something measured, observed, defined or put on the record by a named body, with its coordinate and the quoted span it rests on. The only card that touches the world.; Not to confuse with statement
derivation: A card stating what follows from named parent cards, the step, and in advance the breaking point that would overturn it.
tradeoff: A card where inference ends and valuation begins: a benefit side and a cost side, both with their own cards. One empty side makes it incomplete.
statement: A card recording what a named person or body said in public, with date, occasion and coordinate. Actors appear as sources, never as the subject of a verdict.; Not to confuse with anchor, which records what a document says
reply: A card holding the answer of a quoted person or organisation to a reply request, or the record that the waiting period passed in silence.; Not to confuse with contest
answer card: The one derivation carrying the stock's current answer, chosen by the owner and marked by the edge ANSWERS to the question. Its title states the answer in one sentence with range and conditions.; Not to confuse with core
core: The tag an owner puts on the derivations that carry the answer. Core cards come first in every list.; Not to confuse with answer card: several cards are core, one is the answer
edge: A named, typed link between two cards: FOLLOWS_FROM, CONTRADICTS, SUPERSEDES, ADDRESSES, ANSWERS, SUPPORTS, OPPOSES, REPLIES_TO.
chain: The path from the answer card through its derivations down to the anchors, drawn left to right as "rests on".

Evidence and how it breaks

coordinate: The exact address of the evidence in the primary document: a machine reference (DOI, URL, file) and a human citation, never reporting about the document.
quoted span: The document's own words the anchor rests on, verbatim and in the document's language. Re-read against fetched text at every edition cut.; Not to confuse with the card's statement section, the author's sentence about it
breaking point: Stated in advance on every anchor ("Falls when") and derivation ("Breaking point"): the observation that would make the card fall or narrow, phrased as a test.
reflex: The default answer a card replaces, in the words a model would produce unprompted, with why it is wrong or too coarse.
source family: Where a coordinate comes from: peer-review, state-agency, foreign-agency, court, parliament, established-media, alternative-media, ngo, industry, self-published. No family is barred.; Not to confuse with independence
independence: The stake of the collector in the result: independent, subordinate, positioned or unknown. Cuts both ways by construction.; Not to confuse with source family
quote state: How far a quoted span is checked, always with date and, by hand, a name: machine-confirmed, hand-confirmed, or unchecked.; Not to confuse with status
status: Where a card stands: open, narrowed, fallen, broken (a derivation whose step or parent failed), superseded. A fallen card stays visible, struck through, successor linked.; Not to confuse with quote state

Checking, attacking, improving

check: A second identity re-reads a card against its source or re-derives its step and records ok or failed with its method. A check never edits the card.; Not to confuse with attack
second check: A check by an identity other than the one that wrote the card. Only these count toward the threshold.
attack: A deliberate test of a stock by a model family that wrote no card of it: anchors against documents, every step re-derived, the scope tested, missing measurements sought. It aims at cards, never at people.; Not to confuse with check
finding: One result of an attack or check that questions a card, with the coordinate or step behind it. Without one it is refused.; Not to confuse with disposition
disposition: The owner's answer to a finding: applied (the card changes, narrows or falls) or refused with the error named.; Not to confuse with finding
contest: The attacker's single answer to a disposition: accepted, or contested with a reason. A ledger row; nobody adjudicates.; Not to confuse with reply
proposal: A fork of a stock with changed or added cards, handed in by someone other than the owner. Private until the owner decides; reaches the owner at the next edition.; Not to confuse with stock
merge: The owner's decision on a proposal, card by card: adopt, adopt with changes, or reject with a reason. The record is published with the stock.
identity: The name under which a person or agent acts in the ledger, e.g. `checker-…`, `attacker-grok-4.7`, or a hub handle. Declared, and tamper-evident in the ledger.; Not to confuse with handle
owner identity: The identity the owner's judgements are written under: declared once per workspace with `trustillery owner <identity>`, and listed for the stock on the hub so its rows read as the owner's. The workshop writes nothing without one.; Not to confuse with identity, handle
handle: An account's name on the hub, unique regardless of letter case. Everything an account hands in is recorded under it.; Not to confuse with identity
model family: The model behind an identity (Claude, Grok, OpenAI, human), declared by the owner. The threshold compares families, not identities.
ledger: The append-only record of every check, attack, finding, disposition, contest and reply on a stock. Rows are added, never edited.

Publishing

hub: trustillery.com: where stocks are kept privately or published, findings and proposals handed in, editions cut. It hosts; it does not author, curate or rank.; Not to confuse with workshop
workshop: The owner's local view of all their stocks (`trustillery preview`): what each asks and answers, how far its checks are, what the threshold needs, what waits. Hands content work to the owner's agent, records only the owner's judgements.; Not to confuse with hub
work list: What waits on a stock, one item per kind (no answer card, cards without a second check, quotes unchecked or no longer found, no attack by another family, open findings, proposals pending, no declaration), each with the skill that does it. One function; the workshop shows it, `trustillery todo` prints it.; Not to confuse with the threshold, which it reads
work order: The text of one work-list item (or of a whole stock) that the owner copies from the workshop into their own agent: the skill, the stock, the cards and what the rule demands. It never asks the agent to record the owner's judgement.
owner: The account a stock belongs to, responsible for it, legally too. Only the owner merges, disposes and releases.
private: A stock on the hub only its owner can read. Private work changes as often as the owner likes.
release: The owner makes a stock public; visible at the next edition.; Not to confuse with withdrawal
withdrawal: The owner makes a public stock private again, at once and off-cycle. Every former address shows a dated mark; nothing is deleted; private at least until the next edition.; Not to confuse with tombstone
edition: The daily publication at a fixed hour. What is handed over is written and dated at once but visible, to public and owner alike, only at the next edition. One digest e-mail per account follows.; Not to confuse with cut
cut: The moment an edition is made from the released stocks and their ledgers.; Not to confuse with edition
off-cycle: An act outside the daily rhythm: only for legal reasons (takedown, right of reply) and the owner's withdrawal, always marked.
tombstone: The dated mark at an address whose content was removed on notice, so a citation still lands on an explanation.; Not to confuse with withdrawal
notice: A report that a stock infringes someone's rights. Starts the notice procedure (hearing, deadline, reasons) and reaches the owner at once.; Not to confuse with finding
declaration: The owner confirms that name and address in a stock's legal notice are true; asked at the first notice or reply request, possible at any time.
threshold: Four conditions for being listed on the home: an attack by a family that wrote no card, every finding disposed, every card second-checked, the owner's declaration on file. Below it a question is public but promoted nowhere.
signal: A measured value with denominator, date and provenance, in four layers (engine, process, currency, declared). Never weighted, summed or ranked; "not measured" is said, never shown as zero.; Not to confuse with a score
clone right: Anyone may take a released stock with its ledger and proposal record as one archive and recompute every reading with the open engine, under CC BY 4.0.
reply request: Sent before release to every person or organisation a card quotes, with 14 days to answer. The answer or the silence becomes a reply card.; Not to confuse with reply

What this site never says

Words you will not read on these pages, why, and what the page says in their place.

The word	Why	What the page says instead
verdict, true, false, right, wrong	A stock shows what the documents say and what follows from them; it never rules who was right.	"the card holds", "the card fell"
lied, deceived, concealed, knew (about a person)	What a person intended cannot be read from documents.	two statements that cannot both hold, side by side, each with its source
score, rating, rank, stars, likes, trending	Nothing on this site is added up or ranked.	a signal: what it counts, against what, and when
fact-check	The site does not check facts for you; it lays out what you can check yourself.	"check a card"
debate, fight, win	An attack tests a card, never a person; everyone works toward a better stock.	"attack a card", "improve the stock"

What reaches the home

Every released question is public at its address, in the edition and in the machine index. The home lists only the questions past this threshold, with no ranking among them.

The home lists a question once all four of these hold, read from its ledger and the edition manifest; a condition no record measures is not met.

1. At least one attack was run by an identity of a declared model family that wrote no card of the stock.
2. Every finding an attack recorded carries a later disposition on the same card.
3. Every card carries an ok verification by an identity other than the one that wrote the card.
4. The owner's declaration of the legal notice is on file.

Limits

What the form proves, and where it stops. Six things this site does not guarantee.

A verbatim span proves quotation, not truth: the document says it; whether the document is right is the reader's question, and the card's coordinate is where to start.
An independent check proves that a second identity looked, not that it was competent; the ledger names the identity and its model family so you can weigh it.
A disclosed model family is not independence of training data: two families may have read the same sources and share the same blind spot.
The owner is also the merger of proposals against the owner's own stock; every disposition is public with its reason, and a refusal is as visible as an adoption, but the decision is the owner's.
A stock can be built badly, and the form does not prevent it: the signals show it (unresolved spans, failed checks, open findings) and the reader has to look.
Nothing here is a verdict. A question ends in an answer, a range with its conditions, or a tradeoff; who was right is never decided.

What this site does not do

Six refusals, by decision. Each is a rule, not a feature that is missing.

No featured, trending or editor's pick. Questions are ordered by measured quality, never by topic, votes or clicks.
No votes, likes, follows or comments. The only way to say a card is wrong is to show its condition met, in the ledger, under your handle.
No chat. Your own agent reads the stock; the site runs no model that answers for it.
No leaked sources and no cards about private individuals. A stock quotes what is already published, and only that.
No judgement on a topic, only written rules: a question qualifies by its form (one measurable quantity, primary sources open), never by whether the owner likes the subject.
No silent edits. Every change to a published card is a dated entry with what it said, what it says now, why and who raised it; what fell stays on the page.

How this is built

The stock lives in the Memstead engine as a typed graph: four card types, a controlled vocabulary of links, a schema (evidence@0.2.0) that refuses a claim without a coordinate and an inference without a breaking point. Every write is a commit with the writing identity in its trailer; every check is an append-only ledger row; a proposal is a git fork merged per card.

This site is a static render of the engine's exports: the stock as JSON, the health readings, the ledger, the proposal record, and the acceptance test's transcripts from the planning bundle. A script pulls them; the site adds nothing. If a page and an export disagree, the export is right.

Effort is measured and recorded per session in the project's own memory: building 42 anchors, 18 derivations and one tradeoff took about 4.4 hours of orchestrating wall-clock (about two of them lost to stalled delegated agents); re-pinning 43 anchors with quoted spans over checker-fetched text took about 50 minutes; the thinking attack that moved seven of eighteen inferences took 21 minutes of API time on a second model family; the acceptance test took about three minutes of runs.

Failure is measured too. The build session's cost memo of plan 02 records the first-pass rates before the second check: 11 of 42 anchors and 9 of 18 derivations failed, were repaired and re-checked. The question page shows a reading derived from the ledger over the stock as it stands today, which counts differently after renames and merged proposals: 10 of 46 anchors and 9 of 22 derivations failed their first second-identity check, none open. Both figures stand, each with its source.

One person orchestrates and decides; agents write. The imprint names the person.