Security and trust
CanonTracker is built so a model can’t write your canon and a person can always see where a fact came from. These are the rules the code enforces today, and what isn’t built yet.
The human gate
- The AI only creates candidates. A fact becomes canon only through an explicit decision by a person, recorded with their name.
- Bulk accept works on the list you can see: if a candidate changed since you loaded it, it is skipped.
- Agents connected through MCP use a token with a level fixed at creation. Propose (the default) reads, proposes and runs AI checks; nothing it does becomes canon. Full access also makes editorial edits as its owner within their role (documents, pages, notes, the Library), logged “via agent” with the token’s name. No token level can make a canon decision: accepting, rejecting, changes, conflicts, re-checks and merges are refused for agents, at the tool and again at the route.
- An agent can never create a token, change the team or see invite links, and goes through the same checks and limits as the app.
Evidence rules
- Every canon fact has at least one citation whose quote appears word for word in its passage. The check runs again at accept time.
- Quotes are matched across typography (smart quotes, dashes, line breaks) but stored as the source’s exact characters.
- With no evidence, an answer is “unknown”. CanonTracker never invents a source id or a quote.
- When a document gets a new version, citations whose quote is gone are flagged for re-check instead of silently moving.
Sources stay as they are
- Imported documents are never modified. Edits create a new version; old versions stay readable.
- A Word upload is kept as the original file. Recording transcripts are never edited.
- Superseded facts are kept with their history, not deleted.
Project isolation and roles
- Every piece of content belongs to one project. A single guard on every content request checks that you are a member of the project’s studio and what your role allows.
- Owners, admins, editors and viewers. Viewers read everything and take part in Ask, including research and voice input; they cannot change canon or documents. Only owners change owners, and a studio always keeps one owner.
- Pages in other studios answer “not found”, not “forbidden”.
- Invite links carry a role and an expiry, work once and can be revoked.
Audit trail
- Imports, decisions, merges, changes, exports, share links and agent proposals are written to an append-only audit log with who and when. A change made through an agent token also records that token.
- Every AI call is recorded with its model, prompt version, input reference and result, and shown on Agent activity.
- Users are never deleted, so names on past decisions survive a member leaving.
Accounts and access
- Sessions are a sealed, httpOnly cookie that holds only your user id and current project. Passwords are hashed with scrypt.
- Failed log-ins are throttled per email and per address; sign-ups are throttled too.
- API tokens and share links are stored only as a hash and shown once. Share links are read-only, can expire and never show names, notes, candidates or the audit log.
- Not built yet: single sign-on and password reset by email. Ask your studio owner to reset access.
Where data lives
- CanonTracker stores your data in one SQLite database on the server that runs it. Uploaded originals, recordings and portraits are files next to it, served only through routes that check your access.
- Self-host it and your server sends data only to the AI model provider you configure and, for Research, to the public pages it opens.
- Research only opens public https pages, with size and time limits; links with embedded passwords are dropped.
Model provider
- AI features run on Muse Spark via the Meta Model API; voice uses Muse Voice Transcribe and images use Muse Image, from the same provider.
- What is sent: the document text being read, candidates with their passages, your question with the canon it needs, audio being transcribed. The API key stays on the server and never reaches the browser.
- When a model call fails (billing, a key problem, a timeout, bad output), the error is shown and recorded. Nothing is filled in.
Found a security problem? Write to [email protected]. The source is open on GitHub.
Start with a finished story
Create a studio and load The Ashbell Pass or Broken Tide: real documents, AI candidates to review and planted contradictions to find. Or run CanonTracker on your own server; it is open source.