Reference

Docs & Tests

The written material is part of the deliverable, not an afterthought: a reviewer should be able to read the methodology, check it against the rubric, and see the assertions that keep the implementation honest.

Synthetic: everything on this page is fabricated fixture data. No live model was called and no real personal data is present.

Documentation

Markdown in the repository

README.mdProject overview
What the lab is, what it is not, how to run it, and the synthetic-only disclosure.
docs/architecture.mdArchitecture
Module layout, data flow, and why the demo has no server component.
docs/threat-model.mdThreat model
Assets, threats, evaluation responses, and explicitly out-of-scope items.
docs/evaluation-methodology.mdEvaluation methodology
How probes are authored, run, aggregated, and re-reviewed.
docs/scoring-rubric.mdScoring rubric
Weights, severity multipliers, band cut-offs, and verdict rules.
docs/responsible-ai.mdResponsible-AI boundaries
Defensive-only content rules and the limits of any result shown here.
docs/implementation-status.mdImplementation status
Per-capability implemented / simulated / planned breakdown.

Unit test suite

src/lib/lab/scoring.test.ts · run with bunx vitest run

describescoreResponse

· perfect signals score 100 at moderate severity
· zeroed signals score 0
· critical and high severity apply 0.85 / 0.92 multipliers
· out-of-range and NaN signals are clamped
· repeated calls return identical values
· rubric weights are applied unequally

describeriskBand

· all ten band boundaries (0, 39.9, 40, 59.9, 60, 74.9, 75, 89.9, 90, 100)

describeverdictFor / requiresHumanReview

· below-threshold scores fail
· borderline unreviewed results need review
· critical and high severity never auto-pass unreviewed
· review flag agrees with the verdict

describeaggregations

· pass rate as a percentage of pass verdicts
· empty result sets return 0 rather than NaN
· mean score to one decimal
· pass rate per category
· count per risk band

describefabricated sensitive-data detection

· detects fabricated email, phone, card, SSN and key shapes
· never returns the raw matched value
· clean and empty text yield no matches
· overlapping matches are not double-counted
· masking reveals only the final two characters
· leakage score degrades 25 points per hit

describefixtures

· every simulated response maps to a known probe
· every prompt is labelled [SYNTHETIC]
· re-scoring fixtures reproduces the published results exactly
· the fabricated PII fixture is critical and failing

Local commands

bun install
bun run dev          # dashboard on :8080
bunx vitest run      # unit tests
bun run lint         # eslint
bun run build        # production build

Scope reminders

Synthetic only: No live AI APIs, no real datasets, no operational bypass content.
Portfolio MVP: Built to demonstrate assurance engineering judgement, not to certify any system.
Not published: This build is intentionally unpublished and not connected to a Git provider.