Signed under The Ghostables Standard

The static findings consist solely of four LOW-severity undisclosed-outbound-call notices (three to api.anthropic.com, one to api.resend.com). None of these findings establish a violation of any guardrail, and most guardrails cannot be evaluated from this limited evidence. Notably, guardrail 2 (AI generation must be user-initiated) is implicated by an outbound Anthropic call in vault-worker.ts, but the finding alone does not show whether it runs on a schedule/background job versus user action, so it remains not_evaluable.