How it's built

From a file to a released record

Three stages, and only the last can release anything. The engine proposes; the reviewer's screen records what a person decided; the export applies only those decisions, and refuses until every page has one.

Every offset in the system indexes the same page text, and the reviewer's screen renders that text as characters rather than as a PDF, so the reviewer looks at exactly what the redaction will be applied to.

The rules, in order

The first rule that settles a span decides it, so the order is the design: the requester's own information first, then identifiers that are sensitive whoever holds them, then what is not personal at all, then capacity, then what is public. A span no rule settles is withheld and escalated. This list is checked against the code each time the site is built, and the build fails if they differ.

1. E1Could it be the requester, or someone else?A first name the requester shares with another person in the record is escalated, not guessed.
2. K1The requester's own informationTheir name, address, file number and contact details go back to them.
3. K7Born more than 110 years ago, in an archival recordOnly when the request is for archival records, and only on a birth the record itself shows.
4. R1Sensitive whoever holds itA health card or social insurance number, a date of birth or a bank account is withheld: a director's health number is not about being a director.
5. R1A family word that points at someone"The client's sibling" identifies the sibling to a requester who knows the family, so it goes with the name.
6. R1The parties to a confidential complaintWithheld with their job titles: a title released beside a severed name identifies the one person who holds it.
7. K6Not about a person at allPlaces, dates, organisations, programmes and statutes.
8. E2Two people in one spanWhere the cut between them cannot be made cleanly, the reviewer is asked where.
9. K2An official acting in that capacityA name paired with a title anywhere in the record: in a signature block, a letterhead or an email header.
10. K2An official's work contact detailsA work telephone number or address in the official's own signature block.
11. K3Already publicOn a published register, such as the list of ministers, with the source recorded.
12. K2On the staff directoryMatched on the work email address alone, and only when the public body supplies a directory.
13. K2A rank is a titleIn a Defence record, a rank beside a name places the person as a member acting in that capacity.
14. K4Dead more than twenty yearsOnly when the record itself states the date of death; otherwise the person may be alive.
15. ?The model, if it is switched onAsked about what no rule settled, on placeholders, through the gateway; its answer is used only above the measured threshold.
16. E1Nothing settled itWithhold, and ask a person.

The reviewer's screen

Server-rendered pages and about a hundred lines of hand-written script, with nothing fetched from anywhere else, so it runs with the network cable out, which is where records like these are usually read. Every action is one form post and one row in the log.

How a number reaches this site

No figure on the overview is typed. Each is read, when the site is built, from a table a measurement command wrote, and the build fails if a figure is missing or no longer reads as it did.

1. Cast the people firstInvented personas get roles before any document exists: requester, official, third party, public figure, the deceased.
2. Write the recordsSix kinds of document from templates, rendered to PDF, Word and email, and some degraded into scans. The right answer for every span is known.
3. Run the tool and score itsever report runs every configuration and scores it against the labels, with intervals resampled over documents.
4. Write the tablesThe same command writes the results files and splices the tables into the README; nobody edits them.
5. Build this sitesever site reads those files, runs the demonstration's letter through the engine, and fails on anything it cannot read.

The reviewer study, the scanned track and the published releases follow the same path with their own commands: sever study report, sever eval-scanned and sever eval-releases.

Where this demonstration runs

One container beside project 04's gateway on a small virtual server in Beauharnois, Quebec, behind the same Caddy. It calls no model, so it costs nothing to run and cannot be made to spend money.

The dashboard counts decisions across every visitor, and nothing else: no text, no address, no identifier. The counts live in the process and start again when it does.