Unlisted and Encrypted Pages

This experiment contrasts two different mechanisms: an unlisted page remains publicly fetchable but is suppressed from standard discovery indexes, while an encrypted page replaces its body with ciphertext and presents a browser unlock form. Unlisted is discovery suppression, not access control, and the sandbox’s public manifest still lists the unlisted fixture. The encrypted fixture uses a deliberately public password for a toy demo, not a secret; the recorded proof establishes ciphertext and form presence, not successful decryption or a security audit.

Exact configuration from /home/loca/dev/quartz-sandbox/sandbox/engine/quartz.config.yaml, lines 317–320:

  - source: "@quartz-community/unlisted-pages"
    enabled: true
    options: {}
    order: 45

The same real file, lines 333–343, configures encryption and its layout component:

  - source: "@quartz-community/encrypted-pages"
    enabled: true
    options:
      iterations: 600000
      passwordField: password
      unlistWhenEncrypted: false
      outputPath: static/encryptedContentIndex.json
    order: 900
    layout:
      position: afterBody
      priority: 1

The manifest is independently enabled in lines 327–332:

  - source: ../plugins/sandbox-manifest
    enabled: true
    order: 900
    options:
      fileName: sandbox-manifest.json
      pretty: true

The standard discovery emitter uses these settings, copied from lines 140–149:

  - source: "@quartz-community/content-index"
    enabled: true
    options:
      enableSiteMap: true
      enableRSS: true
      rssLimit: 20
      rssFullHtml: false
      rssSlug: index
      includeEmptyFiles: true
    order: 50

Actual frontmatter from /home/loca/dev/quartz-sandbox/sandbox/vault/experiments/unlisted-demo.md, lines 1–8:

---
title: Unlisted Demo Page
description: "A real page that is reachable by direct URL but removed from search, graph, explorer and every content index."
tags:
  - sandbox
  - visibility
unlisted: true
---

The source description’s phrase “every content index” must not be read as a promise of total invisibility: the public sandbox-manifest.json inventory includes this page, as the receipt below explicitly records.

Actual frontmatter from /home/loca/dev/quartz-sandbox/sandbox/vault/experiments/encrypted-demo.md, lines 1–8:

---
title: Encrypted Demo Page
description: "A page whose body is AES-encrypted at build time and decrypted in the browser with a password that is published on purpose."
tags:
  - sandbox
  - visibility
password: sandbox-demo
---

The public sandbox-demo password is a toy demonstration value, not a secret. The body is deliberately not reproduced here. Public ciphertext remains available for offline password attacks; neither this demonstration nor unlisting substitutes for authentication or an explicit threat model. unlistWhenEncrypted: false means this encrypted demo is listed, not automatically unlisted.

What the rendered output proves

The prior capture in /home/loca/dev/quartz-sandbox/evidence/2026-09-15-quartz-migration-f1fd35c3/sandbox-experiments.json classifies this as Unlisted and encrypted pages. Its proof_route is /experiments/unlisted-and-encrypted-pages.html, corresponding to the live explanatory page. The exact classified markers are encrypted_page: 1, encrypted_data: 1, and encrypted_iterations: "600000". Its browser capture has title Unlisted and Encrypted Pages — Quartz Sandbox, 39980 bytes, reading_stats: 1, reading_words: "316", and reading_minutes: "2".

Those explanation-page markers are not proof of unlocking a fixture. The two independently captured fixture routes provide the relevant evidence:

• Unlisted fixture, /experiments/unlisted-demo.html: unlisted_demo_direct_route_exists: true; the static artifact has unlisted_demo_bytes: 21568. The browser capture has title Unlisted Demo Page — Quartz Sandbox, 26028 bytes, reading_stats: 1, reading_words: "88", and reading_minutes: "1". The different byte counts are static output versus browser DOM, not two claims about one byte stream.
• Encrypted fixture, /experiments/encrypted-demo.html: the browser capture has title Encrypted Demo Page — Quartz Sandbox, 29000 bytes, and encrypted_page: 1, encrypted_form: 1, encrypted_input: 1, encrypted_submit: 1, encrypted_iterations: "600000", and encrypted_data: 1.

The static-versus-browser distinction is explicit in visibility_checks: encrypted_demo_static_plaintext_marker_present: false, encrypted_demo_static_form_present: false, and encrypted_demo_static_iterations: "600000"; after Chrome execution, encrypted_demo_chrome_form_present: true, encrypted_demo_chrome_input_present: true, encrypted_demo_chrome_submit_present: true, but encrypted_demo_chrome_plaintext_marker_present: false. This supports a browser-created unlock form over encrypted output. It does not demonstrate password submission, successful decryption, incorrect-password handling, or cryptographic strength. No successful decryption claim is made.

The receipt records these artifact differences for the captured build:

Artifact and corresponding live URL	Recorded size and count	Unlisted fixture	Encrypted fixture
static/contentIndex.json	70351 bytes; entries: 43	includes_unlisted_demo: false	includes_encrypted_demo: true
sitemap.xml	5416 bytes; urls: 43	includes_unlisted_demo: false	includes_encrypted_demo: true
index.xml	5499 bytes; items: 20	includes_unlisted_demo: false	includes_encrypted_demo: false
sandbox-manifest.json	7782 bytes; entries: 44; unique_routes: 44	includes_unlisted_demo: true	No per-fixture inclusion flag recorded in this receipt
static/encryptedContentIndex.json	26 bytes; entries: 0	Not the ordinary discovery index	No shadow entry for this listed encrypted fixture

The receipt also gives unlisted_demo_absent_from_content_index: true, unlisted_demo_absent_from_sitemap: true, and unlisted_demo_absent_from_rss: true. The RSS cap is 20; the encrypted page’s absence from this particular feed is not evidence that all encrypted pages are categorically excluded from RSS. For the empty shadow index, the receipt reason is:

The configured encrypted demo is listed (unlistWhenEncrypted:false), so no unlisted encrypted metadata is emitted into the shadow index.

The companion sandbox-plugin.json describes sandbox-manifest as a published-content inventory, not a privacy boundary: it includes unlisted content unless a publication filter removes it. Its independent emitter_artifact records valid: true, entries: 44, unique_slugs: 44, every_entry_has_html: true, served_status: 200, and served_bytes_match: true against an earlier loopback URL. That evidence reinforces why unlisted does not mean undiscoverable.

All browser values above are prior Chrome DOM captures against dist-1789511778 on temporary loopback origin http://127.0.0.1:51963, not fresh observations of the public links. The receipt records Chrome exit 0 for all 22 captured routes, all_routes_raw_wikilinks: 0, and all_routes_internal_broken_class: 0. Discovery-file checks do not independently demonstrate every search, graph or Explorer interaction, and a DOM-present form is not an exercised unlock flow.

Safe for the shared engine?

Recorded assessment: safe_for_shared_engine: false.

Receipt reason, verbatim:

Unlisted discovery changes and PBKDF2/client decryption require an explicit threat model and privacy review across 51 wikis.

This is a recorded assessment, not deployment authority. Even a true verdict does NOT authorize a shared-engine change: any requirement to change /home/loca/dev/quartz/quartz must be reported as a BLOCKER, not an action. Do not adopt discovery suppression, encryption or the metadata-disclosing manifest across the 51 shared-engine wikis on the strength of a sandbox rendering demonstration.

Try it in the sandbox

The sandbox-only rebuild command is:

cd /home/loca/dev/quartz-sandbox/sandbox && ./build.sh

The real wrapper /home/loca/dev/quartz-sandbox/sandbox/build.sh pins the isolated engine to commit 3dff48b5df6d84c9544a5ae19c8f2cbb01dc44e5 and rejects an engine outside the sandbox project. It takes a nonblocking .build.lock, runs npm run install-plugins BEFORE bootstrap-cli.mjs build, and passes --directory pointing to sandbox/vault and --output pointing to a fresh timestamped sandbox/dist-<epoch>. It checks that index.html exists before atomically swapping current. The origin sees the new release on the next request without a restart. The wrapper uses umask 022 and retains the new release plus two prior timestamped releases.

Recorded runtime invocation from sandbox-runtime.json, reference only:

PATH=/usr/bin:/bin PORT=51947 SANDBOX_ROOT=/home/loca/dev/quartz-sandbox/sandbox/current NODE_ENV=production /usr/bin/node /home/loca/dev/quartz-sandbox/sandbox/serve.mjs

The production service already owns port 51947. Do NOT start a second process or restart the service. The runtime receipt records an earlier manual-origin exercise; it is not an instruction to recreate that process. No sandbox rebuild or service change was performed to author this documentation.

index