Collector release
Download the Linux collector source, MIT license and version / SHA-256 manifest. Compare the published SHA-256 with your downloaded file before using a release. A checksum identifies the release bytes; this release does not carry a publisher signature.
python3 header7f-linux-capture.py --version
shasum -a 256 header7f-linux-capture.pyThe default collector reads bounded textual sysfs evidence and writes JSON to standard output. It makes no network calls, starts no subprocesses and changes no device settings. Topology and optional config evidence can reveal information about your lab: review exports before sharing.
Raw config capture requires the explicit --include-config option. Some devices react poorly to config reads; use an approved device-specific procedure. Permission errors and partial reads remain visible. There is no BAR/MMIO or RAM reader, reset, driver detachment or register writer.
Offline and air-gapped use
Download the offline Console bundle and bundle SHA-256 manifest. The supplied offline Console edition excludes authentication and analytics; Google sign-in is not available in that edition. Serve its files on loopback using the included instructions. Its decoder and report exports work without a remote service. The bundle manifest identifies exactly what is included: do not assume the hosted Spec Lab or PDF importer is part of that download. Documentation links only open a network destination if you follow them.
Repeat the checks in your lab or CI
Download the local investigation CLI, its SHA-256 manifest and instructions. Node.js 22 or newer is required. It runs the same Linux and typed-map engines on saved JSON files, with explicit report outputs and separate exit states for a modeled issue, incomplete evidence and invalid input. It does not collect device data or call a network service.
The ZIP includes a clearly labelled synthetic map, baseline and incident that you can replay. Exit zero covers selected captured fields only; it does not prove hardware health or a successful DMA transfer. Engine files are supplied for local evaluation under the included notice.
Timing diagrams
The authored timing figures are rendered during the site build with WaveDrom. Pages load static SVG and downloadable WaveJSON from header7f.com. No WaveDrom browser library, eval permission, CDN, remote rendering request or visitor evidence upload is needed. Renderer and dependency notices · Published file hashes.
Hosted-site network inventory
| Purpose | Destinations |
|---|---|
| Site, assets, forms, optional aggregate events | header7f.com, hosted by Netlify |
| Google sign-in on Console and Projects | www.gstatic.com, apis.google.com, accounts.google.com, header7f.firebaseapp.com, identitytoolkit.googleapis.com, securetoken.googleapis.com and www.googleapis.com |
| Spec Lab PDF parser, worker and standard fonts | Vendored PDF.js and its resources load from header7f.com/assets/vendor/. The PDF file is read locally; it is not sent to Netlify, a model provider or a vendor. |
| Imported captures, maps, logs and draft tables | Processed in this browser. The separate Projects preview uploads a supported QDMA bundle only after an explicit save. No external model call or embedded AI service is enabled. |
Fonts, decoder code and PDF.js assets are first-party site downloads. PDF extraction and page previews use the file selected on your device; scanned pages have no OCR service behind them. A reference link may open a manufacturer or kernel-documentation website when you choose it; reference sites are not background evidence-processing services. Captures, register maps, PDF contents and logs are not included in usage counts. Optional private project content is stored separately under the verified owner; it is not analytics data. See the privacy notice for authentication, forms and measurement choices.
Private project preview
The private workspace accepts supported QDMA JSON bundles after explicit consent. Every request verifies the configured Firebase project token and uses a server-derived owner key. Account revocation is not looked up, so an issued token may remain usable until expiry, up to one hour. There is no public sharing, chosen data region or end-to-end encryption. Deleting a project removes its active versions; small retry receipts protect retries for 24 hours from a save and are cleaned on a later workspace change; provider backups/logs have separate policies. Review the full storage policy.
Report a security issue
Use the private contact form and choose “Security report.” Include the affected URL, version and a concise reproduction. Do not submit credentials, customer data, raw private captures or exploit other users’ data. The form has no upload field. Security intake currently uses this form. A direct security email and response-time policy have not yet been published.
Machine-readable security contact · Preview usage and limitations