keelut KEELUT // APPARITION ARCHITECTURE

The architecture behind www.bushwhackers.bar, described the way its namesake moves.
An apparition architecture: followed, never found; reached for, never held. Every layer is a mirage — it answers when you call and isn't there when you grasp it.
Nine attempts to control it are recorded here as observations. Six find nothing to grip.

Glitch-art illustration of the keelut — a gaunt, hairless black spirit-dog crossing arctic snow at night, glowing pale eyes, its paw prints dissolving into static behind it — FIG. 1 — THE KEELUT. In Inuit folklore, a hairless spirit-dog of the tundra that hunts by night; its paw prints vanish behind it, so it can be followed but never found. The architecture is named for the way it moves, not for anything it intends. What it evades is recorded under T-02.

Name: KEELUT — the qiqirn's crueler cousin in Inuit oral tradition: a hairless black dog-spirit that hunts across the snow and leaves no trail. The name describes a property, not a purpose — a system that answers when queried and disappears when grasped.
Subject: www.bushwhackers.bar — Bushwhackers Saloon, Tualatin, OR. Portland Metro's largest country dance floor. Est. 1996.
Principle: Present no fixed surface to grip. Every layer that could be seized, censored, cloned, or blinded is replaced by a mirage of one — a surface that answers requests without holding still. The whole is an apparition: real enough to serve a page, thin enough that a closing hand meets nothing.
Class: Static Astro 7 build. No server. No database. No CMS. No login. Nothing that can be phished, injected, or ransomed.
Edge: Bunny CDN pull zone, global PoPs. Warm TTFB ~75 ms (the WordPress site it replaced: ~750 ms).
Registrar: Njalla — privacy-shielded, famously allergic to takedown letters. Paid through 2027-08-09.
Observed: 2026-08-11 · recorded against the live system, not a mock-up

Control Ledger

6Nothing to grip

2Grip on a timer

1Outside the perimeter

NOTHING TO GRIP — the control attempt closes on empty space; there is no fixed surface to seize. GRIP ON A TIMER — a hold exists, briefly, with a named expiry. OUTSIDE THE PERIMETER — a real surface, but one this architecture never claimed to cover.

Nothing To Grip

K-01

Seize the server

No grip

Grip: Reach the login, the plugin CVE, the injectable query. The usual handholds on a small-business site.
Slip: There is no server. The site is prebuilt static HTML on a CDN storage zone. No wp-login, no PHP, no database, no admin panel, no sessions. The old WordPress site's attack surface was a door; this architecture removed the wall the door was in. A hand closing here closes on flat HTML.

K-02

Take down the host

No grip

Grip: Pressure the CDN with a DMCA complaint until it disables the pull zone, and the site goes dark.
Slip: A warm standby is already armed (2026-08-11). A hardened box in Romania — offshore host chosen for takedown resistance — carries a full HTTPS copy of the site behind a valid SAN certificate, dormant, costing nothing. Restoring service is a one-record DNS flip, and the architecture owns its own DNS. A healthcheck with an auto-failover DNS state machine (now an off-platform cluster cron) watches for exactly this event. The standby is keelut-grade: it exists, it waits, and until it answers there is no trace of it in any public record. The grip lands on a body that has already stepped sideways.

K-03

Poison the deploy pipeline

No grip

Grip: Introduce malicious code into a release, or push straight to production from a stolen laptop.
Slip: Main is PR-only; humans cannot push to it, including its own author. Every deploy runs through CI: type-check gate, a page-integrity self-check (check-dist) that fails the build if any page loses its title, canonical, or heading, then upload, cache purge, and a live smoke test. Deploy credentials exist only as repository secrets. 6 of 6 recent pipeline runs green — a pipeline that actually runs, not one that rotted quietly. There is no console to log into; only a gate that refuses bad orders.

K-04

Clone the site, take the traffic

No grip

Grip: Mirror the HTML on a lookalike domain and draw off the dance-floor crowd.
Slip: The pages defend themselves, literally, in two ways. First, an inline script in every page's <head> reads location.hostname and, on any domain outside a hard allowlist, calls location.replace() to the canonical site — a rehosted copy redirects itself home before it finishes painting. Second, the source carries a fixed HTML comment holding a base64 string; decoded, it is a provenance statement written in the old Chinook Jargon of the Oregon Country, signed with the fingerprint BW-CHK-43E165. A scraped clone reproduces that signed confession verbatim in its own markup. The reflection cannot be held either — a mirage does not cast one worth keeping.

K-05

Harvest the evidence page

No grip

Grip: Capture the client-facing audit page — the "receipts" — before it can be read closely.
Slip: The page is scheduled to burn. The receipts page self-destructs on 2026-08-16: a client-side burn in the page itself, a daily server-side cron that deletes it from storage and purges the edge, and a build gate that stops future deploys from resurrecting it. Three independent layers, one expiry. By the time a hand closes on it, the page is snow where a page used to be.

K-06

Blind the observers

No grip

Grip: Move while nothing is watching — the unobserved hour is where control usually starts.
Slip: Observation came online 2026-08-11. GA4 telemetry (tag G-WG3R3W3JDV) now reports from every page — host-guarded, so only canonical-domain traffic registers. Analytics cannot even be skewed from a mirror; the tag refuses to fire anywhere but home. Uptime is separately watched by the failover healthcheck. The architecture keeps its eyes wide open all the time — there is no unobserved hour to move in.

Grip On A Timer

T-01

Outlive the TLS certificate

Timed

Grip: The www certificate was issued manually (Let's Encrypt via DNS-01) and expires 2026-11-07. The standby's cert is likewise a ~90-day manual renewal. Let both lapse unattended and the browser locks the door for you.
Closes when: www swaps to the CDN's auto-renewing certificate once its resolver cache clears — already planned — and a renewal reminder is wired for the standby. A held edge that heals itself on a schedule; the window is narrow and shrinking.

T-02

Grip the DNS before the mesh goes live

Timed

Grip: Today the zone is served by one provider's parking nameservers (Njalla ×3) — a single surface to lean on. The full architecture — hidden primary in Romania feeding five secondaries across Iceland (1984) and Germany (Hetzner, enrolled 3/3 and answering) — is provisioned and verified but not yet cut over; one manual enrollment at 1984 remains.
Closes when: The 1984 panel step lands, 5/5 verifies, delegation flips. Post-cutover, controlling this system's DNS would require simultaneous action in three jurisdictions against a hidden primary that appears in no public delegation — its answers can be queried all day without learning where they come from. Tracks that end in unbroken snow. This is the layer the whole architecture is named after.
Note: Email is mid-hardening on the same zone: MX + SPF live, DKIM and DMARC still pending. The mail identity can be spoofed until then — a nuisance surface, not a hold on the site.

Outside The Perimeter

P-01

The old WordPress site still breathes

External

Surface: The predecessor site at bushwhackerssaloon.com is still live on a third-party shared cPanel host: WordPress, wp-json answering, login reachable, no redirect to the new architecture. It splits the search presence and is the softest thing still wearing the name.
Why it's outside: This architecture never claimed it. The old site belongs to the bar's legacy web vendor; the 301 redirects and shutdown are owner-gated, awaiting the handoff. The audit of it is already written — what's missing is keys, not knowledge.
Observation: Whatever holds it grips a stale menu and a 2014 robots.txt. The moment it is touched, the redirect plan executes and the foothold 301s into the new architecture. Even the one real hold outside the perimeter feeds the apparition inside it.