{# ═══════════════════════════════════════════════════════════════════════════ /r6-dashboard — the live guardrail measurement. What this replaced: fifteen panels of buttons, each POSTing to /r6/… , plus a "Security Posture" panel of nine hand-written rows reading Enforced / Required / Immutable beside green checkmarks. Two things were wrong with that page and only one of them was visible. 1. The nine rows were prose. No test could fail them. They are docs/defect-catalogue.md §1 — a reassuring word doing a check's job — on the most-linked page the project has. 2. Every button was dead where the page is served. healthclaw.io runs on Vercel with ephemeral storage, and api/index.py refuses mutating requests to /r6/ with 405. "Run 6-Step Guardrail Demo" POSTs to /r6/demo/agent-loop. Anyone who clicked it on the public site got a 405. So the page now shows the measurement instead of claiming the result, and states plainly which host it is on and what that host can do. Division of labour with /security: that page is the prose posture and deliberately prints no grade, because a copied number goes stale and a stale copy always reads as the better one. This page prints one because it is not a copy — it renders the endpoint's own output at request time and shows when the run happened and where it came from. ═══════════════════════════════════════════════════════════════════════════ #} {% extends "base.html" %} {% block surface %}surface-paper{% endblock %} {% block bstheme %}light{% endblock %} {% block title %}Guardrail conformance — live report — HealthClaw{% endblock %} {% block head %} {% endblock %} {% block mainclass %}wrap{% endblock %} {% block content %} {% set report = snapshot.report %}
Guardrail conformance · Live self-test
{# No hard break. It set the desktop rag nicely and produced a four-line heading with a one-word last line on a phone; text-wrap: balance handles both widths. #}

What the guardrails actually did, the last time anyone checked

A probe creates a synthetic patient, drives real requests through the running stack, and records what comes back. Every line below is something it observed. Nothing here is asserted by hand, and the failures are printed at the same weight as the passes.

{% if snapshot.measured %}
Measured against
{# NOT report.target. That field says 'local(test-client)' because the harness drives the app in-process, which is true and useless once the report crosses a host boundary: healthclaw.io rendered "measured against local(test-client)", local to a machine the reader cannot identify. The deployment is the fact a reader needs. #}
{{ snapshot.origin if snapshot.remote else 'this deployment' }}
This page
{{ 'fetched that report' if snapshot.remote else 'ran the report itself' }}
Tenant
{{ report.tenant or '—' }}
Run at (UTC)
{# Absent when the reporting deployment predates the measured_at stamp. Saying so beats printing a plausible time nobody measured. #}
{{ report.measured_at or 'not stamped' }}
Served from
{{ 'cache (10 min TTL)' if report.cached else 'a fresh run' }}
Source
/r6/fhir/$conformance
{% endif %}
{% if snapshot.measured %}
{{ report.grade }}
Grade
{{ summary.properties_passed }}/{{ summary.properties_total }} Properties passed
{{ summary.checks_total }} Individual checks run
{{ summary.checks_failed }} Checks failed
{{ summary.partial_coverage | length }} Properties graded on partial coverage
{% if writes_here %} {# The page's only control, and it exists only where it works. On the read-only host a re-run button would return 405 — which is precisely the defect this rebuild removed, so it is not rendered there at all. #}

Run a fresh check now Re-runs the harness against this deployment instead of serving the cached result. Takes a second or two.

{% endif %} {% else %} {# The state this page exists to get right. An empty report rendered as a blank scorecard reads as a clean bill of health — "examined nothing" and "found nothing" have to look different (docs/defect-catalogue.md §0). #}

No measurement. This is not a pass.

The report could not be obtained, so this page has nothing to show you and will not imply otherwise. An empty scorecard is not a clean one. Until this section is replaced by a grade, treat every guardrail claim about this deployment as unverified.

{{ snapshot.error }}

{% endif %} {% if snapshot.measured %}
The results

Seven properties, {{ summary.checks_total }} checks

Open a property to see every check inside it and what the probe observed. The bars are one mark per check, so a property resting on two probes looks thinner than one resting on seventeen. It is thinner. What each property means →

{% for row in summary.rows %} {# Failing properties start open. A reader should not have to click to find the thing that went wrong. #}
{{ '%02d' | format(loop.index) }} {{ row.name }} {{ 'pass' if row.passed else 'fail' }} {% if row.grade %}grade {{ row.grade }}{% endif %} {% if row.partial %} coverage: {{ row.coverage }} {% endif %} {{ row.checks | length }} check{{ '' if row.checks | length == 1 else 's' }}{% if row.checks_failed %}, {{ row.checks_failed }} failed{% endif %} {% for c in row.checks %} {% endfor %} detail
{% if row.caveat %}
Limit recorded by the harness {{ row.caveat }}
{% endif %} {% if row.reference %}

Probed {{ row.reference }} in the self-test tenant.

{% endif %}
    {% for c in row.checks %}
  • {{ 'PASS' if c.passed else 'FAIL' }} {{ c.name }} {# `detail` is the derived field: the observation on a pass, the observation plus the failure sentence on a fail. Reading it rather than `observed` is what keeps a failure's reason on the page instead of only in the JSON. #} {% if c.detail %}{{ c.detail }}{% endif %}
    • {% endfor %}
{% endfor %}
{% endif %}
Scope

What this grade does not cover

Listed at the same weight as the result, because you would find them anyway and finding them yourself is worse.

{% if snapshot.measured %} {% for row in summary.partial_coverage %}

{{ row.name }} was graded on partial coverage

Coverage is {{ row.coverage }}, not full. The grade for this property describes only the surface named there.

{% endfor %} {% for row in summary.caveats %}

{{ row.name }}

{{ row.caveat }}

{% endfor %} {% endif %} {# Not conditional on snapshot.measured: these hold on every run. #} {% for name, why in ungraded %}
{# "Not graded:" rather than "{{ name }} is not graded": the entries are a mix of singular and plural ("read authentication" vs "step-up refusals"), and one verb cannot agree with both. #}

Not graded: {{ name }}

{{ why }}

{% endfor %}

It is a self-test, not an audit

The deployment grades itself. There is no SOC 2 and no HITRUST report behind this number. It says the controls fired on a synthetic record a moment ago; it says nothing about the organisation running the deployment, its hosting, or its staff. The full posture, including what is missing →

It ran against synthetic data only

Writes land in a dedicated conformance-selftest tenant. No real record is read or written to produce this page.

Verify

Do not take this page's word for it

The endpoint is public and unauthenticated. Run it yourself; the harness runs on request, so what you get is what is true when you ask. 

# the same report this page rendered, as JSON
curl {{ stateful_host }}/r6/fhir/$conformance

# a human-readable scorecard, and a fresh run rather than the cache
curl '{{ stateful_host }}/r6/fhir/$conformance?format=text&fresh=1'

# 200 at grade A, 503 below it — so an uptime check can watch the guardrails
curl -o /dev/null -w '%{http_code}\n' {{ stateful_host }}/r6/fhir/$conformance
About this host
{% if writes_here %}

You are on the stateful deployment. It has a database, it accepts writes, and it ran the report above itself.

{% else %}

You are on the read-only deployment. It serves the site from ephemeral serverless storage and refuses every write to a clinical path with a 405, so it cannot run the harness — the report above was fetched from {{ stateful_host }}, which can. That is also where the interactive demo runs; buttons here would return 405, so there are none.

{% endif %}
{% endblock %}