From 35ee6816966fe3fbf790ee49b4783f8d9bfc4bc3 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <jonathan@hyperpolymath.dev>
Date: Mon, 12 Oct 2026 17:22:12 +0000
Subject: [PATCH 1/3] README: plain claims in the body, one status line (claim
 audit 2026-10-12)

---
 README.adoc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.adoc b/README.adoc
index c6ac258..815ad74 100644
--- a/README.adoc
+++ b/README.adoc
@@ -142,7 +142,7 @@ Lithoglyph is structured in layers, each with a specific language and responsibi
 
 == Core Invariants
 
-These are *non-negotiable* guarantees:
+These are *non-negotiable* invariants (_status: enforced by the engine; reversibility theorem intended_):
 
 [horizontal]
 Truth Ownership:: On-disk truth is owned by the block/journal layer; higher layers do not bypass it.

From 8c9acad288dfd46cd2762b46db43efc02aeda097 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Mon, 12 Oct 2026 22:53:00 +0100
Subject: [PATCH 2/3] Update README.adoc

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
---
 README.adoc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.adoc b/README.adoc
index 815ad74..ff77a89 100644
--- a/README.adoc
+++ b/README.adoc
@@ -142,7 +142,7 @@ Lithoglyph is structured in layers, each with a specific language and responsibi
 
 == Core Invariants
 
-These are *non-negotiable* invariants (_status: enforced by the engine; reversibility theorem intended_):
+These are *non-negotiable* intended requirements (_status: enforcement incomplete; reversibility theorem intended_):
 
 [horizontal]
 Truth Ownership:: On-disk truth is owned by the block/journal layer; higher layers do not bypass it.

From 19fcbe1a8aa88d8ee16f4b5b9ae744cab08216ae Mon Sep 17 00:00:00 2001
From: "coderabbitai[bot]"
 <136622811+coderabbitai[bot]@users.noreply.github.com>
Date: Mon, 12 Oct 2026 22:02:12 +0000
Subject: [PATCH 3/3] docs(security): replace sample API keys with environment
 variables and require Bun over Deno

---
 .claude/CLAUDE.md       |  2 ++
 docs/API-REFERENCE.adoc |  2 +-
 docs/SECURITY-AUTH.adoc | 12 +++++++-----
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md
index 384ae89..0ff1b94 100644
--- a/.claude/CLAUDE.md
+++ b/.claude/CLAUDE.md
@@ -65,10 +65,12 @@ svalinn (TLS) → lith-http (Elixir :4000) → BEAM NIFs → core-zig (C ABI) 
 - **Elixir** — OTP control plane, HTTP API
 - **Rust** — BEAM NIF (Rustler), studio backend
 - **ReScript** — Client libraries (if needed)
+- **Bun** — JavaScript runtime and package management
 - **Nickel** — Configuration
 
 ### BANNED
 - TypeScript, Python, Go, Java, Node.js, npm
+- Deno (use Bun)
 
 ## Build Commands
 
diff --git a/docs/API-REFERENCE.adoc b/docs/API-REFERENCE.adoc
index 994208f..64c0999 100644
--- a/docs/API-REFERENCE.adoc
+++ b/docs/API-REFERENCE.adoc
@@ -1204,7 +1204,7 @@ https://lith.example.com/v1
 [source,bash]
 ----
 # API Key (header)
-curl -H "X-Lith-API-Key: lith_sk_live_abc123" \
+curl -H "X-Lith-API-Key: ${LITH_API_KEY:?set your API key}" \
   https://lith.example.com/v1/query
 
 # JWT Bearer token
diff --git a/docs/SECURITY-AUTH.adoc b/docs/SECURITY-AUTH.adoc
index 8ad3e3a..dcde188 100644
--- a/docs/SECURITY-AUTH.adoc
+++ b/docs/SECURITY-AUTH.adoc
@@ -238,27 +238,29 @@ lith auth create-key \
   --expires "2025-12-31"
 
 # Output:
-# API Key: lith_sk_live_abc123...xyz789
-# Key ID: key_01234567
+# API Key: <generated-api-key>
+# Key ID: <generated-key-id>
 # WARNING: This key will only be shown once. Store it securely.
 
 # List keys (shows metadata only, not secrets)
 lith auth list-keys
 
 # Revoke a key
-lith auth revoke-key key_01234567 --reason "Rotation"
+lith auth revoke-key "${LITH_KEY_ID:?set the key ID to revoke}" --reason "Rotation"
 ----
 
 ==== Usage
 
+Supply the generated API key through the `LITH_API_KEY` environment variable.
+
 [source,bash]
 ----
 # HTTP header (preferred)
-curl -H "X-Lith-API-Key: lith_sk_live_abc123...xyz789" \
+curl -H "X-Lith-API-Key: ${LITH_API_KEY:?set your API key}" \
   https://lith.example.com/v1/query
 
 # In GQL session
-lith shell --api-key "lith_sk_live_abc123...xyz789"
+lith shell --api-key "${LITH_API_KEY:?set your API key}"
 ----
 
 ==== Key Scopes