Loopback only
The report and product server binds to a random 127.0.0.1 port, not a public interface.
Security model
Local-first is an architectural boundary.
The public site does not receive evaluation data. Full StructTrace runs use a capability-protected loopback server and local evidence store.
The trust boundary.
Security claims below follow the implementation and repository policy. They are not certification claims.
Capability URL
Every server uses a fresh random 256-bit URL capability and checks Host, Origin, and Referer boundaries.
Verified assets
Manifest-bound report files are rechecked before serving. Unbound files, unsafe paths, symlinks, and changes fail closed.
Constrained network
There is no telemetry. Network calls occur only for model endpoints explicitly configured by the user.
Bounded retention
Raw outputs, provider envelopes, logs, report sizes, and subprocess streams have explicit limits and configurable retention.
Label isolation
Live adapters receive opaque transport tokens and model-visible fields, never golden expected values or dataset identifiers.
Public website controls.
The static site adds no account, form, analytics, cookie, runtime font, or evaluation API.
| Content security | Self-only scripts, styles, images, media, fonts, and connections; objects and framing disabled. |
|---|---|
| Browser permissions | Camera, microphone, geolocation, payment, USB, sensors, and display capture disabled. |
| Tracking | No analytics, advertising, fingerprinting, telemetry, or cookies. |
| Data flow | The `/try` route displays checked-in fixture results in the browser. It does not upload files or execute a hosted evaluator. |