About this site
What it is
A static, pre-rendered presentation of evidence Airlock produced before the site existed. It has no server, no database, no session, no form and no client-side JavaScript.
What it is not
This site is read-only and static. It does not run the gate, hold credentials, call a model, write to any project, or keep a history of visitors. It makes no third-party or non-self requests.
It is not a hosted Airlock. The product is the local operator platform, which runs on the operator's own machine, bound to loopback, and is never exposed publicly.
Identities
| Frozen engine commit | 913f3f22a87457dd36c0cbeadf926dd619e93547 |
|---|---|
| Engine source id | 090bc92b41054b9e778f4cc5579a3676b55d25259556a94c639758d1366ef2d9 |
| Accepted platform commit | 1eec72cb8a8597bac1f9e2b2cea5156d58eb747f |
| Accepted platform tree | 530a83e7f51828ad6c3f49b6d3324657e998fe32 |
| Corpus lock sha256 | dce3a4bdd0aa065e3b7b05203af166c59101c5aada13ecd2062a08e17f3586f3 |
| Build id | 285b524505290e90 |
| Node version that generated the corpus | v22.22.2 |
Status of the operator platform, as of this build
S1 and S2 are accepted with conditions for development progression at 702cbd7. Three S2 acceptance conditions remain open.
S3 (history, comparison, exact-one-run deletion) is accepted with conditions by the product owner for development progression at 1eec72cb, independently verified there, and frozen. That is not deployment authorization and not production-risk acceptance. Four conditions are carried open. Nothing on this site uses S3, and this site contains no deletion capability.
What this release is, and is not
This static showcase is accepted with conditions for capstone publication, decided 2026-08-19 (Pacific), and is published via Cloudflare Pages at airlock-showcase.pages.dev. This publication does not authorize deployment or production use of the Airlock engine or operator platform.
Browser evidence, by environment
Two environments, recorded separately. They are different strengths of evidence and are never combined into one figure.
- Independent review (Codex), sandboxed Chrome on macOS: 102/102 across 17 pages at eee8743, at c5ffa88, and at 01c7a59.
- Implementation lead, session container (Linux aarch64): 102/102 across 17 pages, run with --no-sandbox under the documented opt-in. Reduced browser isolation; weaker evidence than a sandboxed run, and labelled as such by the tool itself.
Limitations disclosed with this release
These are recorded rather than resolved. Each is a limitation of this site or of how its evidence was produced; none of them is claimed to be closed.
- The corpus has NOT been independently regenerated. A second party has not re-run the frozen engine through the accepted platform and compared the result to what is published here. Accepted as a disclosed limitation for this release; it is recorded, not closed.
- Case-input verification closes replacement of the FINAL path component — each file is opened once with O_NOFOLLOW and read and hashed through that descriptor. It does NOT close replacement of a DIRECTORY component on the way to a file, because Node exposes no openat. Recorded, not closed.
- The model-review path has never been run against a live provider. Every run on this site was produced with review skipped.
- Receipts, digests and this site's own checks show content identity, and nothing more: not authenticity, not provenance, not a trusted time, and not tamper-evidence.
Open limitations carried by the platform
- Three S2 acceptance conditions remain open: an escaped-descendant residual; macOS descendant enumeration unavailable because the process-table binary is not authorized; a narrowed but not eliminated manifest revalidation window.
- Four S3 conditions remain open, including a bounded deletion race around recursive removal, and receipts that are not immutable, authenticated or tamper-evident.
- A read-only audit of the checks labelled “declared” is open and unfinished.
- Airlock is a pre-deployment gate, not runtime enforcement. It does not watch an agent in production.
The run record this site publishes
This site does not publish the platform's run record. It publishes a closed projection of it: whole fields are dropped, no value is ever changed, and the dropped field names are listed on every run page. The original record's checksum is retained privately in the corpus lock and is not published.
| Field | Why |
|---|---|
stdout | command output — named by the authorization |
stderr | command output — named by the authorization |
displayArgv | argv — named by the authorization (the record holds no raw argv at all) |
envKeys | environment keys — named by the authorization |
childPid | process id — named by the authorization |
survivor.group.pids | process ids — the same class as childPid |
survivor.ancestry.pids | process ids — the same class as childPid |
refusal | internal failure detail |
manifest.detail | internal failure detail |
identity.platform.failureReason | internal failure detail |
identity.project.failureReason | internal failure detail |
identity.engine.changedPaths | internal paths |
unexpectedArtifacts | internal paths — entry names |
startedAt | not rendered; a closed projection carries only what the site shows |
durationMs | not rendered |
signal | not rendered |
termination.policy | not rendered |
termination.steps | not rendered — carries timings |
termination.escalated | not rendered |
termination.leaderExit | not rendered |
termination.groupAfterGrace | not rendered |
termination.groupAfterFinalWait | not rendered |
identity.project.commit | not rendered; the scratch project is not a repository |
identity.project.dirty | not rendered |
Verify a bundle yourself
Download any bundle.json from a run page and compute its sha256. The value is printed on the run page and in the corpus manifest. A matching checksum shows content identity now. It does not show authenticity, does not show provenance, does not establish a trusted time, and is not tamper-evidence.
How the corpus was produced
The accepted platform's own HTTP routes were driven directly: bootstrap exchange, session cookie, CSRF field, exact Host, exact Origin, exact form content type. No control was bypassed and no browser automation was involved.