Console access model and redaction boundary

The console is a static artifact generated from status.json and workspace.json. This file decides who may read it and what it may contain. Publishing it to a public hostname is not part of this decision.

Access model

• Default access: loopback through the DSH web server. The only live serving path is the harness plugin site route (dsh-tcp site), which inherits the DSH browser-trust fence and its loopback binding.
• Tailnet access is allowed only by binding the DSH web server to the tailnet interface. No separate listener, proxy or tunnel is configured here.
• No public hostname. Exposing the console outside loopback or the tailnet requires explicit Lead approval, an authenticated front door and a new decision ticket. It is not a deployment detail.
• The committed site/index.html is a local artifact. It has no server state, no cookies, no script and no external asset, so a stale copy is harmless and a live copy cannot escalate.
• The console also carries <meta name="robots" content="noindex,nofollow"> and a Content-Security-Policy that forbids script, connect, frame and form sources.

Redaction boundary

The console may show:

• the snapshot timestamp and the fixed warning that a gate verdict is evidence about a tree, not proof a feature works;
• harness check names, statuses and summaries;
• product ids, lifecycle, branch, short HEAD and dirty flag as recorded in the snapshot;
• product gate status, exit code, duration, declared gate command and the classification reason;
• frontier ticket ids, types and titles;
• memory enabled/disabled, consent scope and availability, event count and the last gate verdict timestamp — never event contents or the consent identity (operator, timestamp, retention days, sink), which stays host-local.

The console must never show:

• credentials, tokens, environment values or policy consent details;
• absolute host paths, home directories or filesystem roots;
• product source, product logs, raw gate stdout/stderr or customer data;
• memory event subjects, summaries, data or redactions;
• session identifiers, cookies or request headers;
• any external URL or asset reference.

Enforcement

• harness/checks/console.mjs fails when the access document loses a required section, the committed page is stale, script or an external asset appears, a host path leaks, or a credential shape appears in the output.
• node scripts/build-site.mjs --check fails when the page does not match a rebuild from the snapshot.
• harness/checks/secrets.mjs scans every other tracked text file; the console check scans the generated page because the walk skips site/.

Change rule

Adding a field to the console requires a redaction review, a change to this document and a seeded failure in evals/fixtures/seeded-cases.mjs.