Category: Startup Lab

01 · The threshold

Something built inside the House had to survive a system outside it.

Darja Rihla already contained research, frameworks, services and experiments. Evidence Capture was different. It had to become an installable artifact, behave predictably in a real browser and withstand technical, privacy and platform scrutiny.

The milestone was not generating code. It was completing the chain from a bounded product decision to an external submission whose status could be stated honestly.

02 · The problem

Research evidence fragments faster than researchers notice.

Useful material becomes scattered across tabs, screenshots, bookmarks, notes, copied passages and disconnected documents. Once the source, selection and interpretation separate, later verification becomes slower and less reliable.

The product question was narrow: could one explicit browser action preserve the active page context, selected text and an optional research note as a portable local record?

03 · The product decision

Deliberately small. Local by architecture.

The answer became a Manifest V3 Chromium extension with no Darja Rihla backend, account, analytics, telemetry, cloud synchronization or AI processing. It reads only the active page after the user invokes it, stores records in local extension storage and exports Markdown or JSON.

04 · Build

Prompt for the end state, not for code.

Codex served as the primary implementation agent. The instruction described a finished, testable release: product boundaries, Definition of Done, security constraints, required evidence, packaging and the permission to report an environment block instead of inventing a pass.

That changed the role of AI-assisted coding. Code generation became one step inside a release contract rather than the definition of completion.

1. Define the end state.Specify the artifact, constraints and acceptance gates.
2. Require tests during the build.Evidence is produced with the implementation.
3. Separate roles.Builder, reviewer and human operator do not collapse into one authority.
4. Inspect production output.Source inspection alone cannot prove what the shipped bundle contains.

05 · Verify

Thirty-four tests were the beginning of proof, not the end.

The final regression recorded 34 passed and 0 failed. TypeScript strict checks completed without diagnostics, the production build completed, the dependency audit reported zero known vulnerabilities, and the manifest, permissions, privacy claims and release archive were inspected.

Bundle inspection remained a separate gate. Build tooling can introduce behavior that is not obvious from application source, so claims about network isolation and remote code were checked against the production artifact as well as the source tree.

06 · Independent review

Builder ≠ final reviewer.

A second coding agent, Claude Code, performed an independent read-only release audit. The review re-examined the manifest, data flow, unsafe DOM sinks, storage behavior, hashing contract, exports, build output, package layout and supporting documentation instead of accepting the builder’s summary as proof.

The human publisher remained the final authority for submission and publication.

07 · Real browser acceptance

The artifact had to leave Linux and work in Edge.

Human acceptance ran in Microsoft Edge on a Windows 11 QEMU/KVM virtual machine. The extension loaded unpacked and was exercised on ordinary HTTPS pages, selected and unselected text, Arabic/RTL content, optional notes, local persistence, Markdown and JSON exports, deletion and restricted edge:// pages.

The popup console remained free of errors during normal operation and its network inspection showed no unintended extension-originated requests.

08 · What the test lab taught us

Product requirements and VM requirements are not the same thing.

Testing required QEMU/KVM, libvirt, virt-manager, SPICE guest integration, clipboard support, virbr0 networking, a Python standard-library HTTP server, a least-privilege UFW rule and checksum-based artifact transfer.

Those layers solved the host-to-guest test environment. They are not Evidence Capture product dependencies and would mostly disappear when testing directly in a supported native Edge environment. The distinction matters: infrastructure detours should create reusable operational knowledge without inflating product scope.

09 · Privacy as engineering

A privacy sentence had to map back to evidence.

“Local-first” was tested against permissions, source code, the production bundle and runtime network inspection. The extension requests activeTab, scripting, storage, downloads and clipboardWrite; it requests no host permissions and contains no remote executable code.

10 · Integrity without mythology

SHA-256 verifies the record contract—not external truth.

Each record receives a deterministic SHA-256 hash over the documented canonical serialization of its fields. Recomputing it can reveal whether that stored or exported record differs from the original canonical input.

It does not independently prove what a webpage contained at a historical time, establish legal authenticity, create a forensic chain of custody or make the outside world tamper-proof.

11 · Distribution

External review became a public release.

The Edge package was built with its manifest at archive root, checksummed, paired with store copy, permission justifications, privacy disclosures, screenshots and certification notes, and submitted to Microsoft Edge Add-ons.

12 · What this created

Not only an extension. A reusable release system.

13 · What comes next

The first artifact opens the lab; it does not define its limits.

Future work can extract deeper lessons about browser-extension publication, AI-assisted release discipline and Linux test environments. Those become real articles only after their own research and editorial approval.