Audit C - charter and ruling alignment

Method: read the four governing documents, then fetched the live site read-only (home/planner, /browse, /game/color-the-dino/, /account, /privacy, /terms, /faq, /packs/, /shopper/, plus the R2 PDF for color-the-dino). No sign-in, no Customize, no form submitted. Every status below cites a file or a URL.

Grade: DRIFTING. The shipped product tracks the founder's latest [[2026-08-31-product-model-rulings|rulings]] well. It does not track the [[2026-08-31-studio-charter|charter]], and the charter has not been amended to catch up, so the governing document now describes an operation that no longer exists.

Part 1a - charter commitments

Part 1b - numbered rulings 1-28

Part 2 - the top contradictions

1. Cost model (§4) vs actual gateway usage. The charter's settled premise is "generation stays local on the founder's Max subscription until volume forces the API." Production has been calling a metered AI Gateway (Sonnet for the planner and Customize words, Grok for art) since 2026-09-01. Ray logged the conflict as escalations.md item 2 with "default proceed" and shipped it. No founder ruling reversing the charter line exists in any of the four documents. Worse, the gateway is configured logs off, so the spend the charter said was the one unmeasured risk is now both real and unobservable. §4's own remedy - the Sonnet round-count test - has never been run.

2. "Done = critic-gated and deployed" is now "gated and waiting for a tap." Five artifacts (fraction-pizza, map-the-room, making-change, word-ladder, colorea-al-unicornio) passed their gates and sit pending-review pending a founder "flip them" - the founder-as-queue state §1 exists to prevent. In the other direction, PR #49 was deployed on mocked tests alone and took Customize down in production for six minutes. Both halves of the sentence are being violated at once.

3. QA gate map: two artifact classes shipped without their named gate. verify-pdf-output (which the map says blocks publication to R2) has never been run on any of the 22+ PDFs now in R2. build-landing-page four-layer (which the map says blocks production deploy of a site page) has not been run on Home, Browse, the game pages, /account, /privacy or /terms. design-critic was substituted by an ad-hoc "Ray independent fresh-eyes critic" for the whole 2026-09-02 overnight round. The three gates that were honored (behavior-critic, verify-vault-write, verify-strategic-output) are the ones that caught real defects, which is the argument for running the other three rather than against.

4. The org table's hard gate has been dissolved rather than amended. §2 marks production deploys, bill-starting resources, and anything touching payment as engineering's hard gate. On 2026-09-02 the studio executed 13 production deploys, created two D1 databases and a Worker, provisioned Turnstile and a Resend sending domain, and applied a production migration. Every one traces to an explicit founder word ("allow deploys", "ship accounts") - so this is authorized, not rogue. The problem is that the charter still reads as if the gate is in force. Separately, the four-role org itself was never stood up: the sw-* fleet lines have been commented since the 8/31 walk-back and all work ran as in-session subagents, which means the escalation table describes boundaries between agents that do not exist.

5. Cadence: the 4:41 round is the compliant part; the day is not. The overnight round is textbook §8c - 4 artifacts, breaker armed, nothing merged, deployed, uploaded or spent. The daytime waves that follow it have no breaker, no artifact cap, and deploy straight to production; 24 PRs merged in one day. The charter has no daytime clause, so the majority of the studio's actual output runs under no written circuit breaker at all.

6. Copy contradictions the missing gates would have caught.

   • /terms says "no accounts": "The headline: no accounts, no trackers, and your kid's name never reaches an AI model." Accounts shipped the same day; /privacy has a full Accounts section. Terms and Privacy contradict each other on the live site.
   • /faq says "ages 3-4": "Printable games for little learners, ages 3-4", while every other surface says 2-10 and Browse offers five age bands.
   • Ages 2-3 is a dead filter: header "Shop by age -> Ages 2-3" and the Browse facet both exist; the facet count is 0. Ruling 5 moved the floor to 2 in copy without any 2-3 game behind it.

7. Name adopted ahead of the clearance the charter made a precondition. "Clearance precedes adoption" (§5). Clearance is still queue item 3 ("this week, promised to founder"), the attorney packet is deferred, and in the meantime the name is on a purchased domain, the mail domain, the footer of all 22 PDFs, and two published legal pages. Charter §8b called this the expensive-to-reverse decision; brand surface is accruing against an unchecked mark.

8. Privacy promises vs features - mostly kept, two loose ends. The site keeps the hard promises: no trackers, no third-party analytics, one cookie only when signed in, name stripped before the model, no kid profiles. Two gaps: the retention sweeper enforcing the 90d/180d TTLs is listed in queue.md as "not built", and deletion is manual-by-email (honestly disclosed, but the charter says "real deletion, not a flag"). Minor: fonts.googleapis.com / fonts.gstatic.com are third-party requests from a parent's browser on every page.

Part 3 - drift in the studio process itself

• Batch size and breaker (rounds.md vs §8c): compliant inside the 4:41 round, absent outside it. The §8c amendment (up to 4, stop on 2 consecutive gate failures) was honored exactly once, on the only round it governs. Nothing governs a daytime wave that merges 24 PRs and deploys 13 times.
• Escalations discipline: escalations.md is well kept as a log and poorly used as a gate. Its dominant pattern is "Ray default applied, founder may veto" - shopper x4, customize x4, marketplace variants, wordmark size, ask-text storage, governing law, contact address, classroom use. Several of those are charter-level (metered API vs Max; policy contact; governing law) and were shipped on a default rather than escalated as the charter requires. The unresolved backlog is real: 10 numbered items, of which #7 and #9 closed within the day and the rest are still open.
• Decision-page usage: the charter's founder touchpoint is decision pages. Two were produced (studio charter; account relationship model) and both were gated with verify-strategic-output - that half works. But the operating channel is iMessage: rulings 20-28 all arrived as texts, and escalations.md tracks "founder taps owed" as a running list. The decision-page model has been replaced by a chat loop nobody wrote down.
• Self-correction is genuinely strong. Three misses were caught and logged inside a day: the false "Ray mark" blocker relayed to four builders (two builders pushed back with source evidence - correct behavior), the over-read of ruling 20 as a tier mapping (corrected by the founder), and the #49 production incident (caught by a source-blind live check, rolled back in 6 minutes, with a new standing rule attached). Clock labels drifted about an hour in the overnight log and were corrected against date. This is the healthiest part of the process.
• A rule the charter wrote and the studio has not applied: §7 signal 3 says twice-corrected means the cron reverts to on-demand. There have been at least two unasked-for corrections. Nobody has proposed reverting.

Part 4 - what the charter says should have been measured by now, and has not

The pattern: everything measurable about whether this is working is unmeasured, and everything about how much got built is measured in detail. That is precisely the failure shape §7 named in advance ("output is not the constraint").

Part 5 - is the site in alignment with the charter?

Grade: Drifting.

Split honestly: the product surface is Mostly aligned - the site matches the founder's site-tree, planner, three-door, GENERATED, UGC, entity and retention-wording rulings closely, the design contract is genuinely enforced (frame motif everywhere, bundled Andika in the PDFs, a bubble that carries real strategy, no photoreal children, no trackers), and the privacy page is unusually honest about what is not built. The governance layer is Off - the charter's cost model, hard gate, org table, queue seam, gate map, cadence and clearance-precedes-adoption rule are each either bypassed, substituted, or overtaken by a founder word that was never written back into the document. Net: Drifting, and drifting fast, because velocity is high and the document that is supposed to bound it is a week stale.

The three fixes that would most restore alignment

1. Re-baseline the charter against what the founder has actually authorized - today. Amend §2 (the engineering hard gate, now covered by standing allow-rules), §4 (generation is metered from day one, not local-on-Max), §8c (write a daytime clause, since most output ships there), and §2's org table (either stand up the sw-* agents or delete the table and say Ray-plus-subagents). A charter contradicted daily by authorized behavior provides no control at all; the fix is to make it true again, not to pretend the gates hold.

2. Run the two gates that have never run, and fix what they find. verify-pdf-output on the 22 live PDFs before any further R2 publication, and build-landing-page four-layer plus design-critic on the six shipped site pages. Three defects are already visible from the outside and would be caught immediately: /terms claiming "no accounts" while accounts are live, /faq saying "ages 3-4" while everything else says 2-10, and an Ages 2-3 filter with zero games behind it.

3. Turn the measurement back on before the next build wave. Switch AI Gateway logs on and publish a per-round cost line; run the Sonnet round-count test (queue item 7); and close the USPTO clearance the charter made a precondition of adoption, before more brand surface accrues. Then apply §7 honestly at the 2026-09-14 two-week review, including signal 2 (founder time) and signal 3 (unasked-for corrections have already happened twice).