Startup Lab Build 003
Build Log 003: Darja Rihla Web Evidence Inspector
A local, evidence-first workflow for turning one controlled website visit into technical observations, traceable findings and reviewable reporting.
- Product status
- Functional MVP
- Commercial validation
- Unproven
- Scope
- One controlled page load
This record describes retained technical runs from 13 September 2026. It is not a current assessment of any website, a security verdict or a claim of commercial readiness.
01 The problem
Seeing a website is not the same as retaining evidence of what a browser observed.
A visual inspection can suggest where to look, but it does not automatically preserve the request sequence, redirects, browser storage metadata, console observations or the rule that led to a finding. The Web Evidence Inspector was built to keep those layers distinguishable.
The intended boundary is deliberately narrow: one public target URL, one controlled browser visit, a limited set of observations and a human reviewer who decides what the result means.
02 The hypothesis
Can a bounded browser workflow produce a traceable record without turning an observation into a verdict?
The project tests whether one controlled page load can collect privacy-minimised technical observations, derive deterministic findings and produce separate consultant and client-facing outputs. It does not test a general security scan, legal compliance, or a hosted monitoring service.
03 The system
One visit, separated layers of evidence and interpretation.
The workflow opens a target website in a controlled Chromium session and records a bounded observation set: requests, redirects, first-party and third-party domains, main-document response headers, tracker-rule matches, tracker transmissions where observed, browser storage-key metadata, cookie metadata, console messages and failed requests.
- Target websiteOne public target URL within the defined scope.
- Controlled captureOne bounded Chromium visit.
- Structured evidence
evidence.json - Findings
findings.json - Consultant report
report.md - Client output
client-summary.htmlandclient-summary.pdf
The capture design excludes request and response bodies, credential-header values, cookie values, storage values, query-parameter values, page content and form input. URLs are retained without query values; storage and cookie entries retain metadata rather than values.
04 What it produces
Five retained outputs per run.
evidence.json
Raw, redacted technical observations from the browser session.
findings.json
Deterministic rule results with evidence references.
report.md
A consultant-facing Markdown report that keeps observed facts and next checks visible.
Client HTML
A readable summary derived from the same evidence set.
Client PDF
A portable version of that client summary.
05 Validation
Technical evidence and commercial validation are different questions.
What the retained record supports
- Six retained bundles contain the same five output types.
- During the September recovery review, a local consistency check found every machine-style request or console reference in the retained findings in its matching
evidence.json. - Two isolated, non-browser-dependent current-source test files passed during the recovery check in a temporary environment: tracker transmission and console-origin classification.
What it does not establish
- A fresh full browser-dependent test-suite pass.
- Current findings about any website.
- Customer adoption, revenue, willingness to pay or market demand.
06 Real runs
Six bounded historical runs with a consistent output structure.
The retained record contains four internal technical runs and two external public-site runs, all made on 13 September 2026. They are historical snapshots of controlled sessions, not live claims about any website.
| Run type | Context | Output bundle | Evidence produced | Historical date |
|---|---|---|---|---|
| Internal technical runs | 4 controlled visits to the Darja Rihla public website. | Five retained files per run. | Bounded browser observations, findings and review outputs. | 13 September 2026 |
| External technical runs | 2 controlled visits to independent public websites. | Five retained files per run. | Bounded browser observations, findings and review outputs. | 13 September 2026 |
A REVIEW result means that a check requires human attention within the performed scope. It is not proof that a website is insecure, non-compliant or unsafe.
07 What worked
The useful unit is a chain a human can inspect.
The retained bundles demonstrate a complete artifact chain from browser observation to a deterministic finding, consultant report and client-facing summary. This makes it possible to distinguish a tracker rule match from a tracker transmission, and a missing header observation from a conclusion about overall security.
That separation matters. A tool can preserve the evidence and state the boundary. A consultant still decides whether an observation is relevant, contextual or actionable.
08 Limitations
Bounded by design.
- Each run is one page load, one URL, one viewport and one user agent.
- The retained sessions did not log in, navigate, submit forms or interact with a consent banner.
- Tracker detection is limited to the bundled rule set; headers are observed on the main document response.
- No public dashboard, account system, continuous monitoring, screenshot artifact or client self-service product was found in the retained project evidence.
- The full browser-dependent suite was not freshly reproduced in this recovery environment.
09 Result
Current classification
Functional MVP
The bounded end-to-end workflow exists, and retained output bundles demonstrate its stages. Commercial validation remains unproven: no evidence of paid clients, revenue, adoption, market demand or independently validated customer outcomes was located.
10 Build evidence
Artifacts exist. They are not decorative proof.
This page does not embed raw reports, screenshots or a simulated dashboard. The relevant artifacts are retained locally as a review record because they include target-specific technical observations. Before any public excerpt or image is used, it needs a human privacy, context and permissions review.
Retained output record
Each of the six bundles contains evidence.json, findings.json, report.md, client-summary.html and client-summary.pdf. The candidate page represents their structure and verified aggregate facts, rather than republishing their raw contents.
11 What I learned
Observation, finding and judgement need different owners.
Generic website scores hide the relationship between evidence and conclusion. A more useful pattern preserves what a browser observed, makes rule logic traceable and leaves the final judgement with a person who understands the client context.
It also made a product boundary visible: historical technical evidence shows that a workflow can produce artifacts. It does not show that a market wants the workflow, will pay for it or can use it without guided interpretation.
12 Next iteration