strict access modeoperator evidence boundary
OpenTrust stays locked until the operator boundary is verified.
This surface exposes local traces, workflows, artifacts, and curated memory. Authentication happens before protected evidence renders, so the app can safely front local data without pretending the SQLite layer itself has a login screen.
App-boundary auth
The browser authenticates to OpenTrust first. The server then decides whether local evidence may be read.
Remote-safe posture
Shared-secret auth, CSRF checks, rate limiting, and audit logging now protect remote access paths.
Session-scoped trust
Successful authentication establishes a protected app session instead of exposing the underlying DB.
The intended flow is simple: authenticate to the app, then inspect evidence with operator confidence.
secure access
Protected
Authenticate to continue
Enter the configured OpenTrust token or password to unlock protected routes and local evidence views.
Authentication is required before the server can render protected traces, workflows, memory, and investigations.