The removal log.

The three pages said that the live mint-authority values were asserted on a schedule by a workflow named in the text, and that if one of them flipped, the workflow would fail. GitHub Actions is disabled at the repository level. That workflow last ran on June 26, 2026, and its final five runs were all failures. So for roughly seven weeks, three public pages, one of them a risk page and one of them a direct comparison against another protocol's security posture, described a control that was not running.

What was true, and is kept, is the other half: those values are read on every request by /api/risk-status, which is what /risk and the homepage banner render. The pages now say that, and say plainly that the values are checked when someone asks rather than on a schedule.

The reason this went unnoticed is worth more than the fix. The workflow file still exists in the repository, and the tool that lists workflows still reports it as active, because active describes the file and not the repository switch above it. Reading the file, or the listing, tells you nothing. A note now sits beside those files recording that they cannot run, and naming the one command that actually answers the question.

One of the three carried the same claim a second time, inside its own structured data, where answer engines read it and no human ever would. That copy was found only by checking the built HTML rather than the source after the visible sentence had already been fixed. A claim removed from the prose and left in the schema is still being published, just to a different audience.

The repository carries 5,067 open dependency alerts. 4,831 of them, a little over 95 percent, sit in vendored copies of other people's repositories that are excluded from every deployment and are not part of anything Kerne ships. 236 are in code that ships.

Two automatic pull requests were open. Across the repository's entire history, the number of such pull requests that had ever been merged was zero, and with Actions disabled none of them could have been tested anyway. So the automation was producing failure mail and nothing else, into the same inbox where a funding reply arrives.

Alerts were deliberately left on. The thing removed is the automatic pull request, not the visibility. The honest reading of the ratio above is that the signal for the 236 that matter was already buried under the 4,831 that do not, and that is a separate problem this entry does not claim to have fixed.

One of them was titled with its own staging instruction: do not merge before a particular piece of work was done. That work has since been done, several times over. A conditional prohibition becomes an authorisation the moment its condition fires, and nothing in a version control system re-reads the sentence to notice. Kerne has been caught by this shape before, which is why thirty three branches were audited and six neutralised on August 3, 2026; these two were open pull requests rather than branches, and were missed by that pass.

Both were checked against the current main branch before closing. Every file either one would have added is already there, so neither carried unshipped work, and merging either today would more likely have reverted something than added anything.