A docs compiler refuses to run until a human marks the manifest reviewed

`status: reviewed` sits at the top of the example manifest, and the compiler reads it before it reads a step: any other value and it prints "refuse: manifest is not reviewed" and returns 2 ^[13]. Under `teardown`, `human_owned: true` is a compiler hard stop, so the model never writes the cleanup section even though the smoke job ran `docker compose down -v` itself ^[9]. Four blocks get compiled from the manifest and the fifth is hand-written ^[3].

The fixture's coverage is narrow. The four steps are argv arrays with per-step timeouts: 60 seconds to clone, 120 to bring up the database with `--wait`, 30 to migrate, 15 to run the probe ^[8]. That is 225 seconds of proven behavior ^[1], on `os: linux`, in `/workspace/demo` ^[7]. The migrate step declares `env_from: ["DATABASE_URL"]`, so the credential is referenced by name and never pasted, and captured stdout is capped at 8 lines with deny patterns for `postgres://`, `Bearer ` and `AKIA` ^[8][11].

Two details in the example compiler would need attention before I ran it against my own docs. `argv_block` returns `" ".join(argv)`, and `digest` is a sha256 hex string truncated to 16 characters ^[15]. Joining on spaces discards quoting, so an argv element that contains a space renders as a block a reader's shell re-splits into two tokens ^[4]. Hashing the joined string instead of the array means two different arrays that join identically share a digest ^[5]. None of the four example steps has an argument with a space ^[8], and 64 bits is plenty for catching an edited flag ^[2].

The forbid list is where the compile boundary gets thin. The manifest forbids `secret_literals`, `production_safety_claims` and `host_network_assumptions`, checked against both compiled blocks and drafted prose before merge ^[10]. The published FORBID tuple is four regexes: a Postgres URL, a bearer token, an AKIA access key id, and the literal phrase "safe for production" ^[14]. Nothing in that tuple inspects host assumptions ^[6]. The article puts those on a named reviewer, on the grounds that they describe harm rather than syntax ^[2].

The post is explicit about its own standing: a proposal with labeled example files, not a report of production traffic or measured reader conversion ^[3]. It also does not cover API reference paragraphs, error catalogs, or release notes ^[4]. It describes how the failure happens and never measures it. A model drafting from chat memory smooths over flags, image tags, and working directories that exist only in one author's laptop session ^[19], and teams that let the model own the command column ship samples that break on the first missing environment variable ^[20].

For that freeze to hold in another repo, the docs smoke job has to be required. The article ties the freeze point to `ci_job` directly: if the job is allowed to fail, or renamed, or skipped on a branch, there is nothing to freeze against and generation should refuse ^[16]. The reader who copies blocks in order stops at the first unexpected prompt ^[5]. Port collisions on a shared laptop stay in the human annex ^[2]. On filling the manifest itself the article is blunt: do not paste a model's guessed `docker run` into it because it "looks standard" ^[18].