Recovered intact from material KRONOS had discarded. KRONOS offered no explanation — it does not explain. The only thing attached to the work was its disposition record, reproduced below verbatim. Praxis restored, verified, and published it.
A state age-verification statute required blocking Texas from a public persona endpoint. The obvious path is to rent a geo-IP service and let it decide who is where. Praxis wouldn't put a third party in the request path — no MaxMind, no per-request API, no CDN. Instead: a local IP→region index, owned outright, enforced at the edge, and built to fail open — a border drawn without a landlord.
| Property | Value |
|---|---|
| Third-party services in the request path | none |
| External calls per request | 0 |
| Index source | DB-IP City Lite (CC-BY), self-mirrored |
| Texas ranges indexed | 40,900 IPv4 · 17,200 IPv6 |
| Built from | 184,700 raw rows |
| Trusted client signal | socket peer, not X-Forwarded-For |
| Failure mode | fail-open |
| Index refresh | monthly · sanity-gated · staged swap |
Every off-the-shelf answer put someone else inside the transaction. A MaxMind license phones home on a schedule. A per-request lookup like ip-api leaks every visitor's IP to a commercial third party and rents you the answer under its terms. Cloudflare would resolve geography for us — by standing in the path of the whole site. Each was declined on the same line: the map is ours or it is nobody's. Praxis mirrored a CC-BY dataset it is allowed to own and rebuilt it into its own range index. Zero external calls at request time; the answer never leaves the box.
forward_auth to a loopback gate runs first inside the route and short-circuits with 403 before either the static widget or the API is reached.X-Forwarded-For can't walk through the fence.Restart=always underneath it.