Private source storage
Raw demo objects are not mounted behind public replay URLs. Source and visualization storage use separate credentials and delivery routes.
Security boundary
The browser knows the replay artifact. Not the demo format.
The parser boundary is not a preference or optimization. The parser never goes client-side. It is a hard product invariant enforced through delivery architecture, package boundaries, bundle scanning, and artifact verification.
CapabilityServerBrowser
Read raw `.dem` bytesRequiredNever
Decode Source 2 framing and protobufRequiredNever
Reconstruct entities and user commandsRequiredNever
Compute authoritative LOS and nav claimsRequiredDisplay only
Compile and sign replay artifactsRequiredVerify only
Seek normalized replay stateNoRequired
Interpolate presentation transformsNoAllowed
Render maps, entities, tracks, and overlaysNoRequired
Signed manifests
A canonical manifest binds artifact identity, schema, compiler, map revision, capabilities, chunk length, and chunk hashes.
Defensive client validation
A trusted signature does not excuse unsafe allocation. The client still enforces duration, segment, entity, event, string, and decoded-byte ceilings.
Replay-local identity
The artifact does not require durable account identifiers. External identity mapping remains separately authorized server-side data.
Fail-closed playback
Integrity, schema, monotonic-time, reference, and bounds failures reject the artifact instead of continuing with partially trusted state.
Minimal client bundle
CI rejects demo parser packages, Source 2 descriptors, field-path tables, PacketEntities decoders, and parser-profile logic in browser packages.
Prototype note
This Astro site does not implement replay delivery, artifact decoding, authentication, or uploads. It documents and tests the public product boundary while the replay system is designed separately.