What talks to what

Five places, and a short list of what crosses between them.

Your browser. Desk runs here. Record’s checks run entirely in the tab. Words’ draft, notes and saves are kept here, with the browser's own Ed25519 key, which never leaves.

The site, habitat.ooo. Static pages on Netlify, with three small functions (kit request, kit download, view counts) and three edge functions (the route guard, the Desk password, page-view analytics that keep country, region, city and path, never the address): the receipts, the anchors and keys, the digests files, the Desk bundle, the password page. Before every deploy, a set of checks confirms that the pages, the kits, the list of receipts and the anchored files all agree; the build fails if they do not.

The reading server. The site proxies /api/reading/* to the Foundation's server, signed with a secret the two share, and the server answers those routes only through the sites. Anything that hands the server a text needs the Desk login first; the site checks it before the request leaves. It holds four texts today (King Lear, the Adams and Jefferson letters, Climate Migration, the Texas bill). Its read routes take a paragraph and answer with the text's own passages, keeping nothing. Its room, member and Gem-Space routes keep what they are given, and the reading the server computes from each remark's text; remarks, shares and gifts are append-only, a room's member list is rewritten when the writer changes it; there is no delete. A writer's room is read only by its writer and the members who joined the writer's share, each read signed.

The public log. Sigstore's Rekor. The Foundation posts a signed statement for each published receipt, kit and digests file; the log answers with an inclusion proof and a time; the anchor file keeps both. A stranger verifies an anchor offline with the two public keys the site serves.

Your own machine. The kits run here, on numpy alone, and reproduce the published numbers. The census tools run here over your logs, sign a report with your key, and, if you choose, anchor it.

What crosses, and what does not

from	to	what	kept there?
browser	reading server	a paragraph, for a read; your member ID, to learn membership; the search words and your recent reads' positions	no
browser	reading server	a remark with its place and a SHA-256 of the words it was made on, never the words; a gem	yes, append-only
browser	reading server	the writer's shared paragraphs, on Invite; a reader's join; an end	yes, append-only; an ended share sealed, never served
browser	reading server	a room's member list	yes, rewritten on each change
browser	site	the member request form (ID, name, email, page); the password page's contact form (email, message)	yes, in the site's form store
browser	site	the kit request form (kit, email)	yes: a token record with the email, case and download count, and an email to us
browser	site	the anchor files and keys, read for the Published check	read only
Foundation	public log	signed statements for anchored objects	yes, permanently
your machine	anywhere	nothing, unless you anchor a report

Where to go next

The served API, route by route · File formats · Run it yourself · What is public and what is licensed.