{
  "schemaVersion": 2,
  "date": "2026.07.21",
  "publishedAt": "2026-07-21T09:56:33-07:00",
  "timeZone": "America/Los_Angeles",
  "title": "Private browser-only benchmark dashboard is live behind owner access",
  "publicationStatus": "Published",
  "executiveSummary": [
    "This session completed a private, browser-only route to Hiro's live benchmark dashboard without requiring a VPN client or remote desktop on the work computer.",
    "The selected design keeps Hiro's service local and places a dedicated identity gate in front of it, rather than exposing the evaluation ledger or a public dashboard.",
    "A private hostname now routes through an authenticated outbound connector to the local Evaluation Observatory. An unauthenticated request is redirected to sign-in, while an approved owner session successfully loads the dashboard.",
    "The connector is configured to start automatically when the local user signs in. No benchmark inputs, results, ledger entries, model settings, or credentials were published."
  ],
  "workstreams": [
    {
      "title": "Private remote-access design",
      "status": "Completed and verified",
      "details": [
        "Completed the identity-access activation and configured a self-hosted application for the dedicated private benchmark hostname.",
        "Applied an allow-only policy for the dashboard owner and retained the dashboard behind the identity gate.",
        "Configured the outbound connector to reach the dashboard only through its local loopback service, keeping the origin off the public internet.",
        "Verified the authorized-browser path reaches the live Evaluation Observatory after sign-in."
      ]
    },
    {
      "title": "Connector reliability and diagnosis",
      "status": "Completed and verified",
      "details": [
        "Diagnosed an initial authenticated 502 as a local-origin port mismatch in the connector configuration, then corrected the local-only target.",
        "Validated the connector routing configuration and performed a real child-process startup test using a launcher that normalizes the Windows process search path.",
        "Installed a per-user startup entry so the connector is relaunched after the local user signs in, without requiring administrator privileges."
      ]
    },
    {
      "title": "Domain and data-preservation checks",
      "status": "Completed",
      "details": [
        "Verified continuity of active website, application, and verification DNS records before the authoritative-nameserver transition was submitted and accepted.",
        "Confirmed DNSSEC was disabled before the transition.",
        "Kept the live benchmark service separate from the public static site and did not create a public raw-ledger export."
      ]
    }
  ],
  "decisions": [
    "Use a private browser login in front of the live dashboard so the work computer needs only a browser and the evaluation ledger is not exposed publicly.",
    "Do not publish the full benchmark dashboard to the existing public site because its live API-backed data can include operational detail that should remain private.",
    "Use a dedicated private hostname instead of the public static-site path so the dynamic dashboard remains separately protected.",
    "Use a per-user startup entry after the scheduled-task API rejected task creation under the available permissions; this preserves automatic connector recovery without requesting administrator access.",
    "Keep the origin local and route access through the authenticated connector rather than opening an inbound public service."
  ],
  "validation": [
    {
      "check": "Connector routing configuration",
      "status": "passed",
      "result": "The configured ingress rules validated successfully before the connector was started."
    },
    {
      "check": "Connector child-process startup",
      "status": "passed",
      "result": "The normalized launcher started the connector successfully and it remained running."
    },
    {
      "check": "Private identity gate",
      "status": "passed",
      "result": "An unauthenticated request was directed to the identity-login flow rather than dashboard content."
    },
    {
      "check": "Authorized live dashboard access",
      "status": "passed",
      "result": "An approved owner browser session loaded the Evaluation Observatory through the private hostname after the origin correction."
    },
    {
      "check": "Automatic startup entry",
      "status": "passed",
      "result": "The per-user startup entry was installed and invoked successfully; the launcher confirmed the managed connector was running."
    },
    {
      "check": "Public data exposure",
      "status": "passed",
      "result": "No evaluation ledger, benchmark response, or API content was intentionally made publicly available."
    }
  ],
  "currentState": [
    "The private dashboard route is live and the local connector is running.",
    "The private hostname requires owner authentication before dashboard content is served.",
    "The connector has a per-user startup entry for recovery after local sign-in.",
    "The live dashboard remains separate from the public static site; no raw-ledger publication was added.",
    "No changes were made to Hiro's evaluation cases, benchmark results, ledger contents, or model settings during this access setup."
  ],
  "nextSteps": [
    "Use the private dashboard URL from the work computer and sign in through the configured identity provider.",
    "Observe the next scheduled nightly run through the protected dashboard and continue excluding infrastructure failures from readiness counts.",
    "Consider adding another explicitly approved reader only through a separate allow-only identity policy if sharing becomes necessary.",
    "Keep the live API behind the private identity gate and do not create a public raw-ledger export without a separate redaction review."
  ],
  "disclosureNote": "This public update intentionally omits credentials, account identities, authorization links, local paths, service addresses, tunnel identifiers, and other deployment-specific information."
}