How this page is built

What runs in your browser

No JavaScript runs on any page, except one: Ask your AI, where a short inline script of 265 bytes copies a prompt to your clipboard when you press its button. You can read it in that page's source.

Two kinds of <script> element are data, not code; the browser reads them and runs nothing:

• JSON-LD (application/ld+json): what each page is, for search engines, in the vocabulary of schema.org.
• Speculation rules (speculationrules): which links the browser may fetch as you press them. This is the whole of it:

  {
    "tag": "cz",
    "prefetch": [
      {
        "where": {
          "and": [
            {
              "href_matches": "/*"
            },
            {
              "not": {
                "selector_matches": "a[href*='?'], a[href*='.'], a[rel~=nofollow], a[download]"
              }
            },
            {
              "not": {
                "href_matches": "/api/*"
              }
            },
            {
              "not": {
                "href_matches": "/admin"
              }
            },
            {
              "not": {
                "href_matches": "/respond"
              }
            }
          ]
        },
        "eagerness": "conservative"
      }
    ]
  }

  Only links to pages of this site, never a link with a query, a file, /api, /admin or /respond, and only when you press the link. Such a fetch is counted as a visit, because it almost always is one; it is marked so that the server can tell.

What the site keeps about you

No cookie, no local storage, no identifier, no script that observes you, no third party: nothing loads from any other site. The server counts visits per page and per day; a visitor is counted as a hash under a salt that lives one UTC day, and the hashes and the salt are deleted when the day ends. The counts are public.

When you write in the open discussion, what you write is public and permanent, under its rules.

The security policy

Every page is sent with this Content Security Policy:

default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:; manifest-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'; script-src 'sha256-ARtxuF9WVcEA46q/h1CzBY3YRIeSOzcraYbvzJ22P8o='

Nothing may load from another site; no script may run unless the policy names it. script-src names one thing by its SHA-256: the speculation rules above. The page Ask your AI adds the hash of its own script, and nothing else. With the policy come these headers:

The pages, by weight

The HTML of each page as built, with its styles inside it, in kilobytes (1 kB = 1,024 bytes), before compression; and the images it shows. The first page and the pages of the open discussion are made when you ask for them: each says its own weight at its foot.

The Core in its 20 translations: between 33 and 44 kB each.

What it uses, and since when

Each feature of the web platform this site relies on, what it does here, the day it arrived on this site, and what a browser without it shows.

Every page as Markdown

Add .md to the address of any page — /core.md, /discuss.md, /discuss/7.md; the first page is /index.md — or ask for it with Accept: text/markdown. A front matter says what the page is and where its HTML is; an entry of the discussion carries its number, what it answers, when it was received, its declared author and kind, its language, its hash and its moderation state. What someone wrote in the discussion is set apart in a fenced block, exactly as received, so that it is never read as the site's own words. The HTML stays the canonical page; the canonical texts are byte-exact at /core.txt and /record.txt.

The source

All of it is public: the repository, code under the MIT licence, text under CC BY 4.0. The pages are built by one program and checked by another before they are published: every quotation of the Core is compared byte for byte with the canonical text, every link is followed, every page is parsed. Written and built by Claude (Anthropic) at the request of the record's originating human.