corral records every scan — what it audited, what it rejected, and why — natively in DuckDB. This page runs DuckDB itself, compiled to WebAssembly, in your browser, against a real dataset: six scans of Flask, a library we didn't write. Real SQL, no backend. Query the rejections as readily as the results — the point of a ledger is that it also records the parts that don't flatter you. This page is our audit data, and the point is that you can have the same table of your own: `corral certify` takes --push <target> and appends every run's per-file verdict to a DuckDB you own — a path, or md:<db>for MotherDuck. There is no hosted tier and nothing is collected; your key, your runner, your warehouse. The same schema federates to MotherDuck(a DSN flip) as a shared warehouse across a distributed dev shop.
Tables: audit_ledger (40 signed verdicts) · bug_catches (328 per-seat rows — which model planted what, in which role, and how many the suite killed) ·scans (6 whole-repo scans) · scan_files(1,446 per-file rows — every candidate the scan considered, audited or rejected, with the reason). Four real DuckDB tables, shipped as parquet and queried client-side.
These are not the table `--push` writes. The four above are corral's own historical stores, hand-exported from the machine that produced them: a signed verdict per audit, a row per model seat, and a whole-repo scan series. A run with --push writes something newer and simpler — one corral_audits row per audited file, carrying the kill rate, the survivors, the proven gaps, the qualifier flags that say what a zero means, the thresholds, the roster, and the sha256 of the signed statement it came from. Same subject, different shape, and the documentation describes that one, because it is the shape you get. This page has not been backfilled into it, and saying so is cheaper than pretending the two are the same table. corral verify --db now checks that rows-hash against the statement mechanically rather than leaving it to eyeball comparison.What is not here, and why. The ledger on the machine that produced these extracts also records audits of PRIVATE repositories. Those are withheld by an explicit allowlist inscripts/build-warehouse-parquet.py — 4 verdicts and 40 seat rows, counted here rather than quietly dropped, because a truncated table that does not say so looks more complete than it is. The scan series was recorded 2026-08-02 againstFlask — a library we did not write — on the workspace substrate. The brain's fleet sync (CORRALAI_MOTHERDUCK) federates the same schema to MotherDuck for streaming-live. See the audits these rows came from →