Security and runtime

The boundary

The Engine and Reader run on a machine you control. The core serves its own assets and sends no process data to Ghost Citadel. An optional hosted AI endpoint uses a separate connection that you configure. The controls below describe this page’s earlier product reference.

What is enforced

Network

Core analysis runs locally and sends no process data to Ghost Citadel. The Reader serves its own pages and assets. A configured hosted AI endpoint is a separate network connection.

Inputs

Local files only. By default a path outside the configuration’s folder is refused, a URL is refused and a network path is refused.

Files

The Reader and the Python API open the result file read-only. XES is parsed with defusedxml.

People

Set ANONYMIZE: true and one 32-byte key, and each name becomes a keyed HMAC-SHA-256 pseudonym. A table that identifies people is flagged sensitive, and the Python API returns it only when the call says include_sensitive=True. The key is read from OBSERVATORY_PSEUDONYMIZATION_KEY.

Address

The Reader listens on 127.0.0.1 unless you choose another. A public deployment requires --public-origin, configured authentication and a trusted HTTPS reverse proxy.

Authentication

Basic, a Bearer token or a header set by your proxy. Only proxies you list may assert HTTPS or that header. Set OBSERVATORY_READER_REQUIRE_AUTH=1 to refuse startup without an authentication method. The settings are the OBSERVATORY_READER_* variables.

Limits

Local artifact uploads require --allow-upload and stop at 64 MiB. Shared or public deployments cannot enable uploads.

Time

Time zones come from a pinned copy of the IANA database, never from the machine’s own files. Conversions use the same time-zone rules on every machine.

Automation

A command that succeeds ends with exit code 0. A refused input or a blocked run ends with 2, so a scheduler can stop on any non-zero code. See the commands.

Starting the Reader

The installation page lists the Reader launch options.