Transparent by design
The method,
not the mystique.
The public demo is small enough to audit and complete enough to prove the full retrieval path.
Architecture
One engine.
Two hard boundaries.
01 / BROWSER
Static Astro site
No account, cookie, or origin secret.
02 / EDGE
Cloudflare BFF
Validates, limits, strips, and measures.
03 / ORIGIN
Go + SQLite FTS5
Token-gated and read-only on Fly.
The browser can ask
A bounded query, one reviewed source filter, and a result limit from 1 to 10.
The browser cannot reach
The origin token, local roots, private corpora, arbitrary modes, or mutable operations.
Corpus v1
24 public pages.
Every input named.
The deployment accepts only the files in its signed manifest. A new content digest requires review and a fresh eval.
SQLite
8
Public domain documentation
FTS5, WAL, JSON, query planning
Go
8
CC BY 4.0 website content, unless noted otherwise
spec, memory model, modules, pipelines
PostgreSQL
8
PostgreSQL documentation license
indexes, MVCC, JSONB, WAL
The source list is versioned at eval/sample-corpus/sources.md. Production uses the tracked, reviewed bytes. CI builds two new indexes from separate copies and requires byte-identical results.
Frozen baseline
Claims with a replay button.
The public fixture contains 24 identifier-style and natural-language queries. It uses BM25 only. No reranker or model call can improve the score.
Hit@1
95.8%
23 of 24 queries put a correct page first.
Hit@5
100%
Every measured query found a correct page in five results.
MRR
0.979
Correct pages appear close to the top across the fixture.
p50
<1 ms
Measured engine time on the frozen local baseline.
This proves
The exact engine and corpus can retrieve expected public pages at the published floor.
This does not prove
Human adoption, production usage, revenue, or performance on a private corpus.
Privacy and limits
Safe by a small surface.
No visitor state
- No account or cookie.
- No browser bearer token.
- No raw query in application telemetry.
- No local or private corpus path.
Bounded requests
- Query
- 2–160 chars
- Results
- 1–10
- Origin timeout
- 4 s
- Response
- 64 KiB
- Document excerpt
- 32 KB
- Search rate
- 30 / min
- Mode
- fts5 only
Rate enforcement: Cloudflare uses the connecting address only to derive an ephemeral rate bucket. The Worker does not write the address or its derived value to logs or analytics.
Reproduce it
No special access required.
Build the exact reviewed corpus and run its fixture with the open CLI. The optional network replay checks current vendor pages for drift.
$ git clone https://github.com/nstranquist/docs-puller
$ cd docs-puller
$ make verify-public-snapshot
$ make verify-public-sample # optional live drift check