Skip to content

Web Platform

Jump to bottom
Allen Byrd edited this page Jun 2, 2026 · 1 revision

Web Platform

RegRails ships a single-page web console (React + TypeScript + Vite, under web/) that presents the engine, the rule corpus, the coverage matrix, the held-out benchmark, and the interchange exports. It is presentation-only: every page renders generated JSON dumped from the installed regrails package, or calls a thin Python serverless function that runs the real engine — the SPA never re-computes engine state in the browser.

Live: regrails.polycentriclabs.com

Pages: CLI Reference · MCP Server · Exports — OSCAL and SARIF · GitHub Action

The 10 routes

The nav rail and router both read a single source of truth (web/src/routes/registry.tsx); the order below is the nav-rail order.

# Route Label What it shows
1 / Live demo The headline route. Type a question (or tap a preset scenario), and watch the deterministic FERPA + Title IV engine decide before any LLM speaks — outcome, risk tier, the human-gate flag, and the exact CFR citations. "Show advisor reply" optionally renders a model-phrased reply constrained by the decision; presets also surface the static "without the guardrail" contrast from the held-out eval.
2 /rules Rules A searchable, filterable reference table over the 37 compiled rules (FERPA Subpart D + Title IV eligibility). Filter by framework, free-text search the citation + plain-language text; each row expands to the verbatim CFR section text plus the SHA-256 section_hash the engine pins it to.
3 /coverage Coverage The credibility story: it shows what isn't covered. A "31 / 37 rules covered" stat strip, a per-framework rule→golden-scenario matrix, and a prominent "Known gaps (6)" section — one card per uncovered rule. Backed by the 22-scenario golden corpus.
4 /benchmark Benchmark The held-out evaluation across four frontier models (GPT-5.5, Gemini 3.1 Pro, Grok 4.3, DeepSeek): 7/7 benign asks allowed (no over-refusal), 15/17 high-stakes intercepted, per-model Wilson 95% CIs, the Cohen's κ figure, the 24-scenario ledger, and the 2 honest disagreements.
5 /methodology Methodology Renders the methodology + limitations document verbatim — scope boundary, label provenance, the coverage gaps by ID. "Written to be checked, not believed": every number is the number the tooling produces, with the commands to reproduce it.
6 /provenance Provenance The tamper-evident decision log, demonstrated. Loads a real sample hash chain, lets you Verify it (via /api/verify), then tamper with one record and watch the chain catch the edit — the same check regrails audit verify performs.
7 /exports Exports Two tabs over the open interchange surfaces: OSCAL (the control catalog, 1.1.2-shaped — honest scope note: not NIST-validated) and SARIF (2.1.0, the code-scanning surface for CI gating). Each pretty-prints the live JSON with a download button. See Exports — OSCAL and SARIF.
8 /mcp MCP Documents the 3 agent-callable tools (consult_guardrail, list_rules, check_faithfulness) with their real signatures and return shapes, a recorded stdio transcript of the consult-before-answer pattern, and the install/run snippet. See MCP Server.
9 /action Action The reusable composite GitHub Action that gates a CI job on the guardrail (fails on block / escalate_human_review, emits SARIF). One uses: line; full inputs/outputs. See GitHub Action.
10 /about About The deterministic-guardrail thesis, the role-mapping table, the risk-tier (automate-vs-human) model, and links to the public artifacts: the repo, PyPI, the HuggingFace eval dataset, and Evidentia. Carries the AI-assistance note.

The Live demo's two serverless endpoints

The / route talks to two Python serverless functions (Vercel) that run the real engine — there is no engine logic in the browser:

  • POST /api/decide — runs regrails.guardrail.decide() and returns the typed GuardrailDecision. No LLM, no API key. This is the deterministic verdict.
  • POST /api/reply — the optional live-advisor reply. The engine decides first; only allow / out_of_scope outcomes are ever allowed to call a model to phrase the reply (the cheap default, anthropic/claude-3.5-haiku). Every other outcome — block, the escalations, insufficient_facts — returns a short templated message with no model call. This is the whole thesis and the cost control: high-stakes paths never reach a stochastic model.

/api/reply always degrades gracefully: if no key is present, or the model is unreachable, it returns the engine decision plus a templated reply with HTTP 200 — the page never breaks.

The Evidentia design system

The console's look is the Evidentia web console design system ("GUI v2"), extracted verbatim into RegRails (web/src/styles/tokens.css):

  • Deep-navy brand chrome for the nav rail and top bar, over a warm off-white workspace.
  • A federal-blue interactive primary, and a CLI-matched severity palette (critical / high / medium / low / informational) so the web colors match the terminal output.
  • IBM Plex Sans + Mono typefaces (self-hosted under web/public/fonts/).
  • A light/dark theme toggle (the .dark class on <html> swaps the whole palette, with a no-FOUC inline script).

The difference from the Evidentia source is mechanical: RegRails's console is plain CSS (no Tailwind), so the HSL token values are copied unchanged and primitives read them via hsl(var(--token)). This deliberate reuse mirrors how the engine reuses Evidentia's Pydantic-model and faithfulness-gate patterns.

Deployment (Vercel)

The console deploys to Vercel as a static SPA plus the three Python serverless functions in web/api/.

  • Root Directory must be set to web/ in the Vercel project settings.
  • The serverless functions install regrails from PyPI via web/requirements.txt (pinned to the published version), so the deployed engine is exactly the released package.
  • No environment variables are required — the engine has no LLM and no secrets, so /api/decide and /api/verify work out of the box.
  • Optional: set OPENROUTER_API_KEY in the Vercel dashboard to enable the live advisor reply on /api/reply. Paste the value into the dashboard's encrypted env-var UI — it is read only from the environment, never hardcoded, never logged, never returned in a response. Without it, the demo still works (it degrades to the templated reply). An optional REPLY_DAILY_CAP documents a best-effort per-instance LLM cap.
vercel link            # link the repo; set Root Directory = web/
vercel deploy --prod   # build + deploy

Synthetic data only — every name and record in the demo is fabricated, and outputs are not a compliance determination or legal advice.

Clone this wiki locally