{
  "schemaVersion": 2,
  "date": "2026.07.21",
  "publishedAt": "2026-07-21T15:20:18-07:00",
  "timeZone": "America/Los_Angeles",
  "title": "Protected remote Observatory no longer requires a Hiro browser key",
  "publicationStatus": "Published",
  "executiveSummary": [
    "The protected remote Evaluation Observatory was diagnosed and corrected so an authorized viewer needs only their Cloudflare identity, not a separately carried Hiro API key.",
    "The browser-side API-key prompt was obsolete for the read-only dashboard and was removed.",
    "The Observatory listener now preserves the tunnel's immediate loopback peer for its narrow reverse-proxy authorization path; non-loopback and tailnet behavior remains governed by the existing configuration.",
    "Local API and dashboard checks passed, and the protected remote page loaded successfully with no API-key control."
  ],
  "workstreams": [
    {
      "title": "Remote access diagnosis",
      "status": "Completed",
      "details": [
        "Identified a client-side retry flow that prompted viewers for a Hiro API key whenever a dashboard data request was unauthorized.",
        "Confirmed the dashboard is intentionally protected by Cloudflare Access and therefore should rely on that identity gate for remote viewing.",
        "Confirmed the tunnel forwards the viewer address, which initially caused the loopback-only listener to misidentify the immediate proxy peer."
      ]
    },
    {
      "title": "Narrow authorization correction",
      "status": "Completed",
      "details": [
        "Removed the browser API-key button, session storage behavior, and interactive prompt from the static Observatory page.",
        "Disabled forwarded-address interpretation only on the loopback-only Observatory listener, allowing its local reverse-proxy path without a browser API key.",
        "Retained the existing conditional trust controls for non-loopback clients."
      ]
    }
  ],
  "decisions": [
    "Use Cloudflare Access as the remote viewer authentication boundary rather than exposing or asking viewers to retain a Hiro API credential.",
    "Keep the exception local to loopback traffic so the dashboard origin remains read-only and does not create a broad anonymous API path.",
    "Do not publish raw ledger files or change Hiro's evaluation, schedule, proposal, or promotion behavior as part of this access correction."
  ],
  "validation": [
    {
      "check": "Focused dashboard and access tests",
      "status": "passed",
      "result": "Four focused tests passed, including a loopback access and no-browser-key regression check."
    },
    {
      "check": "Local read-only Observatory checks",
      "status": "passed",
      "result": "The dashboard page and overview API both returned successfully; the returned page contained neither the key prompt nor the former key button."
    },
    {
      "check": "Protected remote browser check",
      "status": "passed",
      "result": "After Cloudflare authentication, the remote page loaded its full ledger and metrics, contained no API-key button, and showed no ledger-load error."
    }
  ],
  "currentState": [
    "Remote viewers can use the protected Observatory from another computer by signing in through Cloudflare Access.",
    "The dashboard remains read-only; it does not expose a general-purpose Hiro API key in the browser.",
    "The existing append-only evaluation ledger and day/night evaluation process are unchanged by this access fix."
  ],
  "nextSteps": [
    "If an already-open browser tab shows an older cached page, reload the protected Observatory link once.",
    "Continue observing Daylab and nightly runs as independent evaluation evidence; do not count infrastructure failures as successful nights.",
    "Review access policy membership only when an additional authorized viewer is needed."
  ],
  "disclosureNote": "This public update intentionally omits credentials, user data, local paths, service addresses, raw ledger contents, and other deployment-specific information."
}