Make private knowledge useful to others. Define what they can ask, control what can leave, and keep the source under your control.
Check code for explicit risk patterns.
function total(items) {
return items.reduce((sum, item) => sum + item.price, 0);
}Preparing the example.
Request · policy · result · traceOne saved example supplies the request, policy, result and Capsule. Playback and stage selection preserve its ID, time, digests and disclosure history. The animation uses presentation time. Open Console to run a new request.
Capabilities
v1.1.0private-code-risk
code-textInternal risk experience
verdictcategorydisclosuresourcecredentialsinternalRulesmemoryDeclare a task interface with accepted inputs, allowed outputs, forbidden fields and a clear access lifetime.
Array totalfunction total(items) {
return items.reduce((sum, item) => sum + item.price, 0);
}verdictcategorydisclosureCheck code for explicit risk patterns.
Choose a capability, send a limited task, and let the request and output checks decide what can return.
Preparingdecide what needs a code review.
Read the actual output fields, policy version, disclosure change and trace. Integrity checks cover the recorded content.
These views share one public sample and its saved result. Playback creates no new call or ledger entry. Inspect opens the corresponding Capsule with its saved policy, time and digests.
Capability scenarios
Check code for explicit risk patterns.
function run(userInput) {
return eval(userInput);
}dynamic executionInput & result
USE THE ANSWERDecide what needs a code review.
PERMITTED OUTPUTverdict · category · disclosure
Inspect interfaceClassify whether proposed sharing includes restricted material.
Share the published product documentation with the project team.
public sample scopeInput & result
USE THE ANSWERCheck whether a task crosses a boundary.
PERMITTED OUTPUTverdict · category · disclosure
Inspect interfaceCompare lexical overlap between two summaries separated by a line containing --- .
Battery storage efficiency improves in urban microgrids.
Battery storage efficiency improves across urban microgrids.
high overlapInput & result
USE THE ANSWERCompare the wording of two research summaries.
PERMITTED OUTPUTverdict · category · disclosure
Inspect interfaceClassify supplied operational log text.
Oct 25, 2026 · 05:00:00 EDT request timeoutOct 25, 2026 · 05:01:00 EDT retry failedOct 25, 2026 · 05:02:00 EDT critical errorrepeated incidentInput & result
USE THE ANSWERDecide what to investigate in an event log.
PERMITTED OUTPUTverdict · category · disclosure
Inspect interfaceSelect the format directly expressed in a user preference.
“I prefer short, concise replies with the next step first.”
explicit format preferenceInput & result
USE THE ANSWERAdapt a response to an explicit preference.
PERMITTED OUTPUTselection · category · disclosure
Inspect interfaceScore whether a proposal states a goal, a metric and a deadline.
criteria metInput & result
USE THE ANSWEREvaluate a candidate against declared criteria.
PERMITTED OUTPUTscore · scoreBand · category · disclosure
Inspect interfaceExamples · Select an alternate input to compare its public rule match and actual bounded answer.
These deterministic public rules illustrate each interface. Sample selection does not issue a request or write a ledger event. Research compares lexical overlap. Exact scores and coarse bands are shown only when present in that sample’s output.
Protocol
Ownership
Two questions use one controlled source. Each receives its own bounded answer and record, while the owner keeps the underlying knowledge and the terms for the next call.
Private code risk
Request 1
function total(items) {
return items.reduce((sum, item) => sum + item.price, 0);
}Request verdict · category · disclosure
Awaiting this call
The first bounded answer appears after its output check.
Awaiting this call
A second input uses the same controlled source.
The outlet admits only declared, requested and currently permitted fields.
Read moreExample
Call 1 of 2 · Request arrives
Two public inputs run through the same sample adapter once and are cached as separate records. Playback, sample selection and owner-control illustrations preserve their IDs, times, digests and disclosure history. Inspect opens the corresponding local example record. To submit a new request, use Console.
Economic model
Task terms connect delivery to interface validity, record integrity and agreed business acceptance. Fees can follow accepted work under the agreement.
Acceptance conditions are declarations. This local example does not execute payment.
Example run
Cell lifecycle
Define the contract, make its scope clear, and control future access.
01Define
Declare accepted inputs, allowed outputs and forbidden fields. Broker sees the task; Guardian sees the policy; Vault keeps the source.
private-code-riskCheck code for explicit risk patterns.
code-textverdictcategorydisclosuresource · credentials · internalRules · memoryThe declaration fixes what callers may ask and which fields may return.
02Validate
Validate the Manifest and bind a version to its digest. A valid declaration does not certify an execution environment.
Compile the shared draft to form its policy digest.Compilation checks the declaration and computes its SHA-256 digest. It does not certify a private runtime or publish the capability. Editing updates the shared draft.
03Make available
Discover what can be asked. A local example can run here; a published interface still needs its own execution adapter.
private-code-riskA registry entry makes an owner declaration discoverable. It does not automatically connect a private executor. Choosing an example opens a request draft.
04Guard
Related calls can tighten later disclosure. Explore a sample model without changing the real local ledger.
verdictPermittedcategoryPermitteddisclosurePermittedThese sliders change no ledger. Declared fields come from the compiled Manifest. Real calls also intersect permitted fields with requested returns; released fields come only from the actual result. Successful calls use the policy’s rolling 24h window.
Fields, precision and rolling windows →05Revoke
Revoke local example access to block new calls. Discovery and the form reflect that boundary. Existing records remain available to inspect.
request →Stays outsideThe closed entry above explains revocation. Scrolling changes no access. Only this explicit button changes local example access; restoration grants future access without rewriting records. Registry revocation remains a separate signed owner action.
private-code-riskCheck code for explicit risk patterns.
code-textverdictcategorydisclosuresource · credentials · internalRules · memoryThe declaration fixes what callers may ask and which fields may return.
Owner control
Five steps from a declared task to controlled access.
Console
Select a stage to inspect its role, then run the request to see its actual checks.
Draft · No result has been attached to this request.
Requested return fields
Expires Policy lifetime 120s
Explicit tests for request and output boundaries. Each test run creates its own recorded result.
Stored as the same UTC instant; the editor uses America/New_York.
Requests are checked against the current capability policy.
The same capability, request, trace and Capsule power the walkthrough and workbench. Owner publishing uses a separate signed session.
Open full Console →A clear task. A bounded answer. An inspectable record.