You are reading the third boundary.

This page is an artifact of the boundary it describes, and the honest description is simpler than the one you might expect. There is no filter standing between the lab's data and this site, because no lab data is sent to it. Every word here was written by hand. The site is a human account of the architecture, not a rendering of the inventory that architecture is built around.

That is a claim about the pipeline, and it should not be read as a stronger one. Nothing here can leak by ingestion: no automated path carries a hostname, an address or a credential from the lab into this build. It does not follow that nothing can leak at all. An author who types a real identifier into a page ships it, because the build compiles what it is given. Hand-authoring moved that risk from a mechanism to a person; the tripwire described below is what moves it back, and it gates every build that can reach the public: the pull-request check and the deploy. A local npm run build does not invoke it, so a hand-copied dist/ is not covered — the gate is on the path that publishes, not on the act of compiling.

Nothing crossed, so nothing had to be caught

The lab's source of truth lives in inventory.yaml inside theDescribe boundary. That file holds every host, network, VLAN, service route, and known issue in the lab. It is not published here. It is not copied here with sensitive fields removed. It is not read by this site's build at all: no code path in this repository opens it, imports it, or receives anything derived from it.

The explorer's physical layer is the one place a reader might reasonably expect real lab data, and it is not. It is a curated, deliberately generic stand-in — invented aliases, no real hostnames, addresses, or identifiers — hand-placed to show the shape of the architecture rather than the contents of the rack. The source file says as much in its opening comment, so a future contributor cannot mistake it for generated output.

No filter keeps the lab's secrets off this page. Nothing ever carried them toward it.

What the boundary enforces, and what it does not yet do

Hand-authoring is a narrow guarantee and a weak pipeline. It rules out one failure — no automated path carries lab data here — and rules out nothing else: it cannot stay current on its own, and it cannot stop an author from typing something real. Every fact on this site is a fact a human re-checked. Two mechanisms close those gaps, and it is worth being precise about which one is doing work here today: one runs on this build, the other is built elsewhere and is not connected to this site.

The first is an allowlist projection, which now exists inside the Describe boundary and is not wired to this site. Each field in the inventory schema may carry a publication marker; marked fields are emitted and every other field produces no output at all — not an empty value, absent. The point of a projection rather than a redaction is that a redaction is a scrub that can be done wrong, while a projection only ever emits what is explicitly named. Adding a field to the inventory keeps it private by default until someone deliberately marks it otherwise: fail-closed, not fail-open.

The second is an independent tripwire over the build output, and it runs here, on every build that can reach the public — the pull-request check and the deploy. It scans the compiled output for anything secret-shaped — private-range addresses, internal hostnames, key material, credential assignments — and fails the build on a match, before anything ships. Its value is that it is not the projection, and neither one's authors can talk the other out of its verdict. That independence is not yet doing any work here. Because the projection is not wired to this site, only the tripwire stands between an author's mistake and the public: one mechanism has to miss, not two. The two-guard property arrives with the wiring, and this page will say so when it does.

Static by construction

What ships is a fully static build: compiled HTML, CSS, and JavaScript. No server, no database, no server-side rendering touching live data. There is no runtime connection to the lab, no webhook listening for state changes, no endpoint that reflects anything internal. The pipeline terminates at publication. It does not reach back.

That property does not depend on the two mechanisms above and will survive them. Whatever eventually crosses this boundary crosses it once, at build time, in one direction, and arrives as inert text.