English
Seges Trust

Private-pilot readiness control map

A private pilot begins with a control sequence—not a scan.

This local specimen translates the future authorization-to-report lifecycle into a readable operating model. It shows the gates a real review must pass without accepting a target, identity, or customer evidence.

Four gates, in order

No stage quietly grants authority to the next one.

Each control below mirrors the local lifecycle and report-release contracts. The labels describe the required future control state; they are not evidence that production operations are live.

  1. Authority

    Verify the right to review before a job can exist.

    A future pilot needs a customer-authorized signer, domain-control proof, an approved country packet, and an immutable scope. A public URL or self-attestation is never enough.

    Authorization
    pending → verified → expired / revoked
    Domain proof
    pending → verified → expired / revoked
    Scope
    immutable reference with expiry and revocation

  2. Dispatch

    Make a future job one-time, bounded, and revocable.

    A future control plane must reject a job outside a verified scope. It needs an idempotency key and a one-time lease so a review cannot be retried or expanded by accident.

    Job creation
    verified authority and active scope required
    Execution lease
    one-time claim; no renewal
    Out of scope
    deny before a browser can receive a target

  3. Containment

    Keep future evidence private before it becomes a finding.

    A future worker needs isolated network controls and tenant-private storage. Artifacts begin quarantined; they are not automatically usable in a report or an AI workflow.

    Artifact state
    quarantined → approved or deleted
    Retention
    bounded retention, legal hold, and deletion
    Evidence boundary
    no credentials, portal content, or raw public target on this page

  4. Human release

    Release a private report only after accountable review.

    Trust distinguishes observed evidence from inferences and review triggers. Regulated, clinical, legal, privacy, and security language needs a named human owner before a private report could be released.

    Report state
    draft → approved → released / revoked
    Release gate
    named human approval; no browser-only release
    Reader boundary
    revocable private delivery, not a public score

API-derived static trace

The local state machine emits this control sequence.

This checked-in artifact is generated by the FastAPI synthetic lifecycle and exposes only stable stage and action labels. It does not contain a client, target, identity, evidence bytes, queue, storage record, or report delivery.

  1. 01authorization_createdauthority
  2. 02authorization_verifiedauthority
  3. 03domain_proof_createdauthority
  4. 04domain_proof_verifiedauthority
  5. 05scope_issuedauthority
  6. 06job_createddispatch
  7. 07job_claimed_oncedispatch
  8. 08artifact_metadata_quarantinedcontainment
  9. 09job_completedcontainment
  10. 10artifact_metadata_approvedcontainment
  11. 11report_draft_createdhuman release
  12. 12report_approvedhuman release
  13. 13report_releasedhuman release

Synthetic local trace only. It contains no client, target, identity, evidence bytes, queue, storage, or report delivery.

Boundary still in force

A useful control map is not a live control plane.

Production activation still requires signed authority, domain proof, trusted edge location enforcement, tenant-private storage, network isolation, counsel-approved operations, and staging evidence on an authorized target.

Explore, do not submit

See the no-data eligibility gate or the fictional report anatomy.

Both routes remain local, noindex, and explicit about what they cannot decide.

Explore no-data eligibilityInspect report anatomy

Separately, the live instant page check at /critique already exists today—a different, narrower-scoped tool from the authorized private pilot this page describes.