01 Live: remoted
02 All projects, through the weekly cutoff
03 Projects
04 How this page is isolated
The production host can change the numbers on this page and nothing else. This page can read one document and nothing else. The flow is one-way, and every step narrows what can pass.
What the snapshot may contain
- Numbers, dates and timestamps, booleans, and values from closed enumerations (kind, harness, model, outcome, duration bucket, failure kind, finding priority and category). Anything outside an enumeration is counted as “other”; its raw value is never published.
- Owner-approved display names, and two fixed group labels: Private projects and No repository.
- Nothing else. No prompts, job titles, result or transcript text, finding text, error text, file paths, URLs, hostnames, IP addresses, job IDs, repository or installation IDs, usernames, branch names or credentials. The schema is closed: an unknown field fails validation, and nothing is published.
- Per-job entries exist only for the remoted repository itself, identified by its repository ID, and carry only date, kind, harness, model, outcome, duration bucket and PR number.
The weekly cutoff and the single private group
- The live section covers remoted's own jobs and may be current; it is regenerated every 30 minutes.
- Everything that includes other projects covers only jobs created before the most recent Monday 00:00 UTC, read as of that moment. It is computed once per cutoff and republished unchanged until the next, so successive snapshots reveal at most weekly totals, and a record that changes after the cutoff waits for the next one. There are exactly two exceptions, both made by the owner: changing the display map (a name, a listed project or the live repository) or the snapshot schema version recomputes the section before the next cutoff, still read as of the same cutoff, so that un-naming a project takes effect at once.
- A project appears under its name only when the owner lists it in a host-side display map. Every other repository is counted only inside Private projects, which publishes how many distinct repositories it holds and the group's total, per-month and outcome counts. Jobs whose repository cannot be resolved are counted in the same group without adding to its repository count. No project gets an anonymous label of its own. The residual risk: while the group holds a single repository (its project count reads 1), the group's numbers are that repository's numbers plus those of any unresolved jobs, so they may reveal much or all of that repository's activity, though never its name.
- In the weekly section, routes, failure kinds, execution times and review statistics are published only across all projects together, never per project. The live section separately publishes remoted's own routes, outcomes and execution times, current rather than weekly; the remoted repository is public anyway.
What the host token can and cannot do
- It can read and write objects in one dedicated bucket that holds nothing but this snapshot. That is the whole scope.
- It cannot change this site's code, DNS, any other bucket or any other account resource. The code is deployed from the owner's machine with a credential that never lives on the host.
- It is stored root-only on the host, outside the repository, the job store and every job, workspace, worker and aggregator container, and is listed in the host's credential inventory with its scope and rotation procedure.
- The host accepted no new inbound route, port or credential for this page, and its API grants this origin nothing.
Before anything is uploaded
- The aggregator runs as a one-shot container with no network, a read-only job store, no dispatch state, no GitHub App keys, no notification token and no publish credential, under a small memory and CPU cap.
- An independent validator, with its own copy of the approved labels, checks the closed schema, every project label, that the all-projects section is byte-for-byte the frozen one for its cutoff, and scans every string against a manifest of every repository name and ID the aggregator saw, plus URL, path, address and token patterns.
- If any step fails, nothing is uploaded, the previous snapshot stays live, and the owner is notified. A showcase failure never touches remoted's health status or job processing.
- Besides its own script and stylesheet, this page fetches only
/data/snapshot.jsonon its own origin, checks the schema version it knows, and renders every value as text, never as markup, under a content security policy that forbids inline script and every other origin. Stale notices appear when the live data is older than 6 hours or the cutoff older than 8 days.
05 How this page was built
remoted built this page. Each task group of the change was dispatched as a remoted job; its automatic review and verifier ran on the resulting pull request; the owner merged it. This section is filled in after the last of those jobs, with job dates, review finding counts and PR numbers. It will carry no job IDs and no links.
| Task group | Job date | Review findings | PR |
|---|---|---|---|
| Contract, fixtures and aggregator | pending | – | – |
| Host publisher and validator | pending | – | – |
| Site and visual design | pending | – | – |
| Provisioning, verification and documentation | pending | – | – |