Hiro development journal

Private browser-only benchmark dashboard is live behind owner access

2026.07.21 at 09:56:33 America/Los_Angeles Published Machine-readable JSON

Executive summary

This session completed a private, browser-only route to Hiro's live benchmark dashboard without requiring a VPN client or remote desktop on the work computer.

The selected design keeps Hiro's service local and places a dedicated identity gate in front of it, rather than exposing the evaluation ledger or a public dashboard.

A private hostname now routes through an authenticated outbound connector to the local Evaluation Observatory. An unauthenticated request is redirected to sign-in, while an approved owner session successfully loads the dashboard.

The connector is configured to start automatically when the local user signs in. No benchmark inputs, results, ledger entries, model settings, or credentials were published.

Work completed

Private remote-access design

Completed and verified

Completed the identity-access activation and configured a self-hosted application for the dedicated private benchmark hostname.
Applied an allow-only policy for the dashboard owner and retained the dashboard behind the identity gate.
Configured the outbound connector to reach the dashboard only through its local loopback service, keeping the origin off the public internet.
Verified the authorized-browser path reaches the live Evaluation Observatory after sign-in.

Connector reliability and diagnosis

Completed and verified

Diagnosed an initial authenticated 502 as a local-origin port mismatch in the connector configuration, then corrected the local-only target.
Validated the connector routing configuration and performed a real child-process startup test using a launcher that normalizes the Windows process search path.
Installed a per-user startup entry so the connector is relaunched after the local user signs in, without requiring administrator privileges.

Domain and data-preservation checks

Completed

Verified continuity of active website, application, and verification DNS records before the authoritative-nameserver transition was submitted and accepted.
Confirmed DNSSEC was disabled before the transition.
Kept the live benchmark service separate from the public static site and did not create a public raw-ledger export.

Decisions and reasoning

Use a private browser login in front of the live dashboard so the work computer needs only a browser and the evaluation ledger is not exposed publicly.
Do not publish the full benchmark dashboard to the existing public site because its live API-backed data can include operational detail that should remain private.
Use a dedicated private hostname instead of the public static-site path so the dynamic dashboard remains separately protected.
Use a per-user startup entry after the scheduled-task API rejected task creation under the available permissions; this preserves automatic connector recovery without requesting administrator access.
Keep the origin local and route access through the authenticated connector rather than opening an inbound public service.

Validation and evidence

Check	Status	Result
Connector routing configuration	passed	The configured ingress rules validated successfully before the connector was started.
Connector child-process startup	passed	The normalized launcher started the connector successfully and it remained running.
Private identity gate	passed	An unauthenticated request was directed to the identity-login flow rather than dashboard content.
Authorized live dashboard access	passed	An approved owner browser session loaded the Evaluation Observatory through the private hostname after the origin correction.
Automatic startup entry	passed	The per-user startup entry was installed and invoked successfully; the launcher confirmed the managed connector was running.
Public data exposure	passed	No evaluation ledger, benchmark response, or API content was intentionally made publicly available.

Current state

The private dashboard route is live and the local connector is running.
The private hostname requires owner authentication before dashboard content is served.
The connector has a per-user startup entry for recovery after local sign-in.
The live dashboard remains separate from the public static site; no raw-ledger publication was added.
No changes were made to Hiro's evaluation cases, benchmark results, ledger contents, or model settings during this access setup.

Next steps

Use the private dashboard URL from the work computer and sign in through the configured identity provider.
Observe the next scheduled nightly run through the protected dashboard and continue excluding infrastructure failures from readiness counts.
Consider adding another explicitly approved reader only through a separate allow-only identity policy if sharing becomes necessary.
Keep the live API behind the private identity gate and do not create a public raw-ledger export without a separate redaction review.