Supported boundary

Security and limitations

Projects and evidence are scoped to current organization/project membership. Administrators use locally provisioned usernames and passwords; MFA is deferred for this hackathon release. Developer and jury access uses scoped access codes. Queued work is reauthorized before dispatch. A browser cannot choose arbitrary commands, SSH hosts or executable paths.

The private lab is not an anonymous execution sandbox. Public playback contains only already published fixture evidence. Customer connections require dedicated runner/route approval. Arbitrary external lifecycle testing is UNSUPPORTED without implemented, natively qualified adapters and observers.

The QNX engine qualifies recorded conditions on two fixture protocols. It does not claim exhaustive concurrency, absence of memory leaks, hardware worst-case timing, safety certification or universal driver support.

Evidence hashes detect changes; they are not malicious-root attestation. Unknown ownership, transport uncertainty and missing evidence never become PASS. AI is supplementary, opt-in and cannot alter results, run tools, apply patches or restart services.