Security and publication boundaries

Public-site boundary

• The browser makes no calls to private Ontogony services.
• No customer records, private credentials, or raw model exchanges belong in the public build.
• No public surface accepts uploads or triggers consequential external actions.
• Public data must be versioned and publication-approved.

Threats this boundary addresses

• Accidental secrets, private URLs, or personal-data publication.
• Unsafe rendering of untrusted evidence or executable artifacts.
• Artifact substitution or a misleading verification result.
• Private-service coupling and over-broad analytics collection.

Publication controls

• All-or-nothing approved registry and evidence sets.
• Schema, graph, freshness, path, allowlist, and denylist validation.
• Escaped rendering and explicit downloadable content types.
• Dependency lockfile, private-link audit, and output scanning.

1. 01

   Source export

   Candidate evidence begins outside the public tree.

2. 02

   Staged candidate

   Projection and redaction write into ignored generated state, never directly into a public destination.

3. 03

   Digest-bound denylist

   Structured denylist rules scan the exact candidate and remain bound to the approval policy.

4. 04

   Approval

   Approval identifies the exact staged publication-set digest and its policy boundary.

5. 05

   Versioned destination

   Validated bytes move to a previously absent immutable versioned destination and never overwrite another version.

6. 06

   Offline verifier publication

   The standalone verifier checks bundle byte integrity without a private service; it does not determine correctness or compliance.

Evidence boundary

Pending mode publishes no scenario bundle, public registry, verification result, or operational status record. Evidence must carry its own scope, provenance, approval, and limitations.