Hiro development journal

Protected remote Observatory no longer requires a Hiro browser key

2026.07.21 at 15:20:18 America/Los_Angeles Published Machine-readable JSON

Executive summary

The protected remote Evaluation Observatory was diagnosed and corrected so an authorized viewer needs only their Cloudflare identity, not a separately carried Hiro API key.

The browser-side API-key prompt was obsolete for the read-only dashboard and was removed.

The Observatory listener now preserves the tunnel's immediate loopback peer for its narrow reverse-proxy authorization path; non-loopback and tailnet behavior remains governed by the existing configuration.

Local API and dashboard checks passed, and the protected remote page loaded successfully with no API-key control.

Work completed

Remote access diagnosis

Completed

Identified a client-side retry flow that prompted viewers for a Hiro API key whenever a dashboard data request was unauthorized.
Confirmed the dashboard is intentionally protected by Cloudflare Access and therefore should rely on that identity gate for remote viewing.
Confirmed the tunnel forwards the viewer address, which initially caused the loopback-only listener to misidentify the immediate proxy peer.

Narrow authorization correction

Completed

Removed the browser API-key button, session storage behavior, and interactive prompt from the static Observatory page.
Disabled forwarded-address interpretation only on the loopback-only Observatory listener, allowing its local reverse-proxy path without a browser API key.
Retained the existing conditional trust controls for non-loopback clients.

Decisions and reasoning

Use Cloudflare Access as the remote viewer authentication boundary rather than exposing or asking viewers to retain a Hiro API credential.
Keep the exception local to loopback traffic so the dashboard origin remains read-only and does not create a broad anonymous API path.
Do not publish raw ledger files or change Hiro's evaluation, schedule, proposal, or promotion behavior as part of this access correction.

Validation and evidence

Check	Status	Result
Focused dashboard and access tests	passed	Four focused tests passed, including a loopback access and no-browser-key regression check.
Local read-only Observatory checks	passed	The dashboard page and overview API both returned successfully; the returned page contained neither the key prompt nor the former key button.
Protected remote browser check	passed	After Cloudflare authentication, the remote page loaded its full ledger and metrics, contained no API-key button, and showed no ledger-load error.

Current state

Remote viewers can use the protected Observatory from another computer by signing in through Cloudflare Access.
The dashboard remains read-only; it does not expose a general-purpose Hiro API key in the browser.
The existing append-only evaluation ledger and day/night evaluation process are unchanged by this access fix.

Next steps

If an already-open browser tab shows an older cached page, reload the protected Observatory link once.
Continue observing Daylab and nightly runs as independent evaluation evidence; do not count infrastructure failures as successful nights.
Review access policy membership only when an additional authorized viewer is needed.