The contract you can read, run and reproduce

Data boundaries live on this site

• The vault holds fixture data only: seven calendar events, one private note, three fictional contacts, created in the visitor's tab on Start.
• Nothing persists: no cookie, no storage, no request after Start during the measured guided sequence on the workbench page (Start → Grant → Run → Brief → Revoke → Export); pressing Verify there downloads listed files from this origin and lies outside that measurement.
• The vault's public interface is exactly fields · policy · read · trace · accessLog · reset · exportJson; it is frozen, and no accessor returns data without a traced read (a regression test proves it).
• A function receives a context with read(field, why) only — never the vault.

Permission rules live on this site

• A grant is for one actor and one field: grant(actor, field) → rule R-n.
• There is no default allow: without an active rule a read is refused with R-none.
• Revocation keeps the rule's id: a later refusal names it, R-n revoked.
• Every read attempt — allowed or refused — writes a trace entry and an access-log line before it returns or throws.
• The picture (the scene, the diagram) only listens; it never decides.

Versioned schema live on this site

JSON Schema, draft 2020-12, one version per file — a later version never edits an earlier one:

• /schema/trace-entry.v1.json — one decision: seq, t and the nine ledger fields.
• /schema/rule.v1.json — one grant: id, actor, field, by, granted_at, revoked_at.

Both schemas are published in English.

Tests and the module live on this site

Download both files into one folder and run the tests yourself:

Both files, and the tests they run, are English-only technical material.

• workbench-core.js — the enforcement module, unminified, exactly as served to the workbench.
• workbench_core_test.mjs — 15 tests: allowed, denied, revoked, per-actor grants, the nine fields, the export, the reset, the interface regression.

node workbench_core_test.mjs

Expected last line: workbench_core_test: 15/15 PASS (Node 20 or later, no dependencies).