# TrustLab

TrustLab is the browser-neutral executable model of Browsec's trust-plugin
protocol. It currently runs under Node.js without external dependencies, but
plugins receive only portable JavaScript values and TrustLab capabilities.

The initial runner separates two phases:

1. Evidence plugins independently inspect the same immutable TLS facts. Their
   attributed results are appended deterministically to the journal.
2. Decision plugins inspect the sealed evidence view in configured order. The
   first authorized Boolean verdict is terminal. Browsec's immutable built-in
   handler finalizes that result or supplies the safe fallback.

Run:

```sh
npm test
npm run demo
npm run ui
```

`npm run ui` serves the browser-hosted testbed at `http://127.0.0.1:4173`.
The page uses synthetic TLS records and the same portable TrustLab runner used
by the tests. It does not make real TLS decisions.

## Current protocol boundary

Plugins may return evidence, warnings, and a scoped Boolean trust verdict. They
cannot access Node.js facilities through the protocol, mutate TLS facts or
journal entries, or perform browser actions.

This first slice intentionally omits persistence, package signatures, community
identities, networking, and real X.509 parsing. The included interactive UI is a
security-surface prototype, not browser integration.