# YC identity-gate methods — September 18–21, 2026

This package accompanies the [dated identity-gate dataset](../yc-identity-gate-2026-09-18.json). It reproduces the URL-state partition from the existing [public compact homepage dataset](../yc-homepage-links-2026-09-19.json) without making network requests and shows the bounded metadata-only verification scope. The public packet contains compact URLs/statuses, derived JSON, response hashes, titles/headings/meta descriptions, and code; it does not contain the original 1,586-row roster, the raw homepage inventory, or full third-party response bodies.

## What the study measures

- The denominator is 1,586 current public YC directory rows from nine cohorts in a September 18, 2026 snapshot.
- The September 19 public compact homepage dataset records 1,515 2xx HTML pages and leaves 71 rows unknown (54 without an HTTP status and 17 non-2xx).
- The host partition is 1,476 same-host rows, 5 same-registrable-domain subdomain changes, and 34 cross-registrable-domain rows.
- The second check fetched only those 39 host-change final homepages on September 21. It retained status, content type, response size/hash, title, meta description, and at most eight headings. The 29 name signals are a subset of the 34 cross-domain queue, not 29 of 39.

A title or heading token is an escalation signal. An HTTP 200 or a missing token cannot prove a company identity, rebrand, acquisition, legal relationship, current operation, customer adoption, or product quality. Raw HTML can miss JavaScript-only page content, so missing tokens remain manual-review cases.

## Reproduce the offline recount

The [recount script](method.py) defaults to the public compact URL/status dataset and the bounded primary-verification file. Run it from a writable copy of this directory (or pass explicit paths) with no roster required:

```sh
python3 method.py \
  --inventory ../yc-homepage-links-2026-09-19.json \
  --primary ../yc-identity-gate-primary-verification-2026-09-21.json \
  --output ./yc-identity-gate-recount.json
```

For an internal exact replay, an archived roster can still be supplied with `--roster`; it is not part of the public packet. The script checks 1,586 rows and emits the same state counts and cohort table as [the public recount output](../yc-identity-gate-recount-2026-09-18.json). It does not make network requests. Its registrable-domain helper uses an explicit small second-level suffix table for the saved corpus rather than assuming that the final two labels are always enough.

The [bounded verifier](fetch_primary.py) is included for inspection and future, caller-controlled reruns of the 39 saved final URLs. It is credential-free, checks robots policy, rejects private-looking paths, follows only public redirects, caps response bytes, and stores metadata plus hashes rather than bodies. A future run is a new observation, not a replay of September 21.

## Public receipts

- [Primary metadata verification](../yc-identity-gate-primary-verification-2026-09-21.json)
- [Verification receipt and artifact hashes](../yc-identity-gate-receipt-2026-09-21.json)
- [Source ledger](source-ledger.md)
- [Offline derived recount](../yc-identity-gate-recount-2026-09-18.json)

All dates are observation or retrieval dates. The article publication date is September 21, 2026; it does not change the source snapshot dates.

The published rerun script validates every resolved address before opening a socket, rejects private/mixed address sets and nonstandard ports, pins the validated socket address, checks redirect destinations, and preserves TLS hostname verification. Ambient proxies are disabled. These guard corrections apply to future reruns; the historical observations above are unchanged.

Each homepage redirect destination receives its own robots-policy check before the page body is requested, including same-origin path changes. Missing robots files (404/410) permit the request; explicit denial and unverified policy stop it. Robots retrieval itself uses the same public-network guard and bounded redirect limit.

Before publication, six historical robots-status errors were rechecked and found to be 404 responses (no policy file), and one redirected same-origin path was rechecked at each hop. All seven page-title/heading/description observations were unchanged. The recount now rejects any row without affirmative robots-policy evidence, including an unverified final redirect. The primary packet records these later September 21 observation times separately.

The optional network collector requires Python 3.14.6 or newer (the patch version verified for longest-rule matching) for the standard-library robots matcher; older runtimes return an explicit unverified result without fetching a page. The offline recount has no network dependency. Robots parsing allows at least 500 KiB as required by [RFC 9309 section 2.5](https://www.rfc-editor.org/rfc/rfc9309.html#section-2.5); a truncated policy is unverified and never grants permission.