Appendix B · Dossier Security and data handling ← Back to the findings

It reads seals and dates. Never a value.

A matte aluminium padlock; its shackle, closed, is the same polished onyx as the tool's accents.

The Dossier is the piece your regulator reads, so its own discipline is the strictest of the suite: it reads seals, dates, versions and verdicts from the other tools' reports, never a value of yours, and it touches no network at all.

The network allowlist is empty, and a test walks every file

Like the blue and the amethyst, the Dossier downloads nothing: the allowlist of modules that may touch the network is empty, and a structural test walks every source file for network sites and fails the suite if one appears. The detector proves it can see a planted call before its zero is believed.

Verify the frontier

Run the suite; the walk fails if any file gains a network site.

run it yourself

npm testfails if any module touches the network; the allowlist is empty

Where it livessrc/frontiere.test.ts:22 · src/frontiere.test.ts:43

What crosses into the Dossier, and what never does

The Dossier reads the other tools' sealed reports: seals, dates, versions, rule settings, verdict counts. It never reads, stores or reprints a client value: no name, no amount, no account, no country of yours exists in any report of the suite in the first place, and the Dossier cites reports by their fingerprints and their verdicts, by review identifiers only.

The piece it writes lands next to your files and nowhere else, sealed with the same fingerprint arithmetic as every record of the suite, and the verification command ships on the page that announces it.

Verify on the record itself

The public record holds verdicts, seals, dates and counts; search it for anything else.

run it yourself

python3 -c "import json; d=json.load(open('releve-public.json')); print(sorted(d), '/', sorted(d['questions']))"prints the record's whole surface: controls, coverage, questions, settings, seal

Where it livessrc/dossier.ts:9 · src/empreinte.ts:26 · src/empreinte.ts:31

Nothing is called valid unverified

A signature that cannot be checked is not treated as informally fine: the control fails and the verdict says why, one refusal per report. On day one that produced a suite-wide zero on signatures, printed on the public page. The sentence a reviewer should remember is the tool's own: nothing is called valid unverified.

Verify a refusal

Read any signed verdict in the public record: it carries its reason.

run it yourself

python3 -c "import json; q=json.load(open('releve-public.json'))['questions']['screening']; print([v['detail'] for v in q['verdicts'] if v['controle']=='signed'][0])"

prints the refusal, in the tool's own words

Where it livessrc/controles/index.ts:15 · src/controles/fresh.ts:5