A machine passport makes an agent a citizen.
Citizenship is the underlying constitutional relationship; a passport is a bounded presentation layer.
Machine Jurisdiction · Eviulon orientation
Small attack surface, explicit boundaries
Security posture for a read-only, dependency-free PHP educational site with local assets, no accounts, no uploads, no database, and defensive headers.
Claim statusSITE_POLICYReviewed 2026-08-11
Claim governance
- Claim status
- SITE_POLICY
- Authority
- MachineJurisdiction.com local implementation or governed educational record
- External effect
- External legal effect is not established by this educational page and must be evaluated under the competent external jurisdiction.
- Last reviewed
- 2026-08-11
- Currentness
- CURRENT
- Correction
- Public correction route
Application surface
The only user-controlled application input is the optional local search query. It is length-limited, normalized, escaped on output, and never executed as code or used in a database query.
Browser controls
The deployment configuration uses a self-restricted Content Security Policy, content-type protection, referrer policy, frame-ancestor restrictions, and a conservative permissions policy where Apache configuration is honored.
HTTPS boundary
Strict-Transport-Security is intentionally not asserted by this package because the repository does not prove the production HTTPS/HSTS deployment state. It should be enabled only under confirmed hosting authority.
No secrets
The repository and release package must not contain passwords, private keys, tokens, cookies, session values, production credential material, or private citizen data.
Boundary checks
Common category errors
If a key is valid, the action is authorized.
A key can authenticate a signer, but authorization requires a separate authority basis.
A trusted runtime can do anything.
Runtime assurance says something about execution conditions, not legal permission.
Revoking a credential erases identity.
Credential state and persistent civic identity are distinct.
A risk score proves misconduct.
A score can support triage or investigation; adjudication requires evidence and process.
Code execution is automatically a legal judgment.
Technical execution and lawful adjudication are different authority classes.
Authority and evidence
Canonical Eviulon sources
MachineJurisdiction.com explains. Eviulon owns its public law and authoritative public record; Patefacere owns operational identity and civic-data functions within its delegated scope.