Phase 1: content source of truth — 40 documents across six areas

Satisfies the Phase 1 Definition of Done:

- content/ validates cleanly against the frozen schema. `make validate`
  reports OK: 40 document(s) validated, 0 violations.
- Six areas exist, each with an L1 entry: ai-overview, platform-overview,
  edge-overview, products-overview, history-overview, about-overview.
- All six areas have an L2 entry: ai-systems, platform-estate, edge-fleet,
  products-business, history-engagements, about-narrative.
- 28 L3 artefact stubs under content/<area>/l3/. Every artefacts[].url in
  every document resolves to one of them; the validator proves there are no
  dangling references (and a deliberately broken copy exits 1).
- Every metric value traces to a source line in the evidence notes or the
  approved metric set in reference/content-map.md (per-metric citations are
  recorded in the AUD-131 completion comment).
- Every document carries confidence and last_verified=2026-10-26; the
  validator rejects a missing or non-canonical value.
- docs/content-redaction.md records the redaction pass: identifiers, third
  party personal data, credentials and infrastructure detail excluded, with
  reasons, plus the two numbers that are reported rather than smoothed.

Honesty positions held: 3 businesses active (12 adoptions over time),
Where-Woof deployed and pre-market, failures kept in (edge-failures), no
promotion of in-progress work to delivered.

No site code, no templates, no CSS, no rendering (Phase 2).

content/platform/l3/platform-network.md

@@ -0,0 +1,31 @@
+---
+id: platform-network
+area: platform
+level: 3
+title: "Artefact — Network layout and remote access"
+claim: "A private mesh and SSH everywhere · services bound to loopback · and one public listener at the edge terminating TLS for the sites that are allowed to be seen."
+confidence: running
+period: "2020–"
+tech: [Tailscale, SSH, Caddy, DNS, Termux]
+metrics: [{label: "public listeners per service", value: 1}]
+artefacts: []
+public: true
+last_verified: 2026-10-26
+tags: [platform, networking, security, artefact]
+---
+
+# Artefact — Network layout and remote access
+
+**Status: stub.** The topology diagram lands in Phase 7 with addresses and hostnames redacted.
+
+## What the artefact is
+
+The layout: hosts on a private mesh for remote access, SSH on every machine, a phone used as a terminal, and an edge host that terminates TLS and proxies to loopback-bound services. New services bind to loopback by default; making something public is an explicit edge change, not a side effect of starting a container.
+
+## What it proves
+
+Security posture chosen rather than inherited: no service is reachable because it happened to bind to all interfaces, and there is exactly one place where the outside world meets the estate.
+
+## When it is delivered
+
+Phase 7. Internal addressing, hostnames and public DNS names are excluded from publication by the redaction pass.