the private path is exercised, and the guardrail stops crying wolf

Closes the last unexercised assumption with a throwaway token: partial clone over
HTTPS with a token against a private repository, list through the tool, the
short-form raw URL redirecting to a resolved branch under auth, and a conditional
request returning 304 across that redirect. A private repository can adopt from
another private one, by name or by URL, and check works off the lock afterwards.

Fixes what would have shipped as noise. The warning fired whenever a fetch needed a
credential, which in a private repository adopting from a private repository is
every time and legitimate. add now resolves origin and makes one anonymous request
to learn whether this repository is public, so the warning fires when the source is
private and the destination is not. The limit is stated in the message rather than
implied away: the signal tells public from not-public and nothing finer, so two
repositories private to different people is the case that genuinely widens access
and the one this cannot see. No origin means cannot tell, which warns — cannot tell
must never read as not public.

Notes when an adopted document did not come from .loom/published/, without
refusing. What is not exported is not hidden, but a lock against it records a
dependency on something that was never a contract.

And records the framing that settles all of this: the tool is a mast, not a lock.
It grants no access, everything it does is possible with copy and paste, and the
locks mean nothing outside the tool and the discipline of the agreement — so it
makes the wrong thing deliberate rather than impossible. What it adds over a paste
is not restriction but provenance.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UTxuSizozEA8yDitPuris

.loom/event-log.md

@@ -875,3 +875,64 @@ still true.*
 
 *Recorded because the code changed in a way that quietly moved a boundary somebody
 might rely on.*
+
+## 2026-09-08 — measured: the private path works, and nothing is unexercised now `rowan`
+
+**Supersedes the entry that recorded the git-over-HTTPS assumption as unexercised.
+It has been run.** *A read-scoped token, issued for one session and destroyed
+after.*
+
+```
+git clone --filter=blob:none --depth=1  over HTTPS + token, private repo   OK, 124KB
+loomctl external list jeffry/homelab-impl                                  OK, authenticated
+short raw URL + 303, authenticated                    404 anon -> 200, resolved branch
+If-None-Match across the redirect, authenticated                           304
+```
+
+**So a private repository can adopt from another private one**, *by name and by
+URL, with `check` working off the lock afterwards.* **Every path in the tool has
+now been run at least once.**
+
+*Incidentally confirmed: `homelab-impl` publishes nothing and adopts six documents
+from `homelab-cluster`, each with a `.usages.md`.* **Consuming inward, which is
+the arrangement that made the confidentiality hazard impossible in that shape.**
+
+## 2026-09-08 — the tool is a mast, not a lock `rowan`
+
+**Recorded because it decides a question that keeps coming back, and nothing in
+the code says it.**
+
+> **`loomctl` grants no access.** *It reads what your credentials already let you
+> read.* **Anything it does, a person could do with copy and paste** — *and the
+> locks mean nothing outside the tool and the discipline of the agreement.*
+
+**So it warns and does not refuse.** *The point is not to make the wrong thing
+impossible; it is to make it deliberate* — **the same move as annotating a file
+you could simply edit.**
+
+**Which is also why `add <full-url>` stays**, *even though it can reach outside a
+publisher's `.loom/published/` and is, in that form, a small general-purpose file
+fetcher.* **A general-purpose tool is not the aim**, *so the escape hatch is kept
+and made to say what it is, rather than removed.*
+
+**What the tool adds over copy and paste is not restriction. It is the record** —
+*origin, resolved branch, `ETag`.* **A pasted document has no provenance**, *so
+nobody can later ask where it came from or whether we were allowed to have it* —
+**not because the question is hard, but because the evidence is gone.**
+
+## 2026-09-08 — the confidentiality check is coarse, deliberately `rowan`
+
+**`add` now asks whether *this* repository is readable anonymously**, *by resolving
+`origin` and making one unauthenticated request.* **So the warning fires when the
+source is private and the destination is public, rather than on every adoption a
+private repository performs** — *which was the previous behaviour and would have
+been noise in exactly the workflow that is legitimate.*
+
+**Belief that could be shown wrong, and it is a known blind spot rather than a
+guess:** *the signal distinguishes public from not-public and nothing finer.*
+**Two repositories private to different people is the case where private-to-private
+genuinely widens access, and this check cannot see it** — *so the tool says so, in
+the message, instead of implying a verdict it has not earned.*
+
+**Failing open is deliberate:** *no origin, or an unparseable one, reports "I
+cannot tell" and warns.* **"Cannot tell" must never read as "not public."**