KEEP EXISTING SIGN-IN
Sign-in verifies identity; it does not grant every operation.
SEMANTIC FIREWALL · CAUSAL SECURITY SYSTEM
SEMANTIC FIREWALL CAUSAL SECURITY SYSTEM
Successful sign-in verifies who you are. It does not authorize every operation.
I designed this system to preserve an enterprise's existing authentication and security controls without treating successful sign-in as operation-wide authorization. Before a protected operation, it evaluates whether subject, device, environment, time, work, rules and responsibility establish authority for this specific effect. Compute may propose a candidate only inside the admitted boundary.
DEFINERWENYAO HSU / SHEN-YAO 888π
INTEGRATION POSITIONFIXED SYNTHETIC NARRATIVE
01EXISTING
SIGN-IN
→SIGN-IN
02 / 05SEMANTIC
FIREWALLPRE-CHECK ↔ REVIEW
↔FIREWALLPRE-CHECK ↔ REVIEW
04BOUNDED
COMPUTE
→COMPUTE
06 / 07EXECUTE
+ REPLAY
+ REPLAY
Credentials stay in the existing system; compute cannot adopt rules or execute effects.
01 / CONTROLLED PATH
ONE OPERATION. SEVEN STAGES THAT CANNOT BE SWAPPED.
ESTABLISH RELATIONSHIPS
Bind subject, device, environment, time, work, rules and responsibility to one operation.
PRE-CHECK EFFECT ELIGIBILITY
Stop on missing evidence; compute cannot invent the gap.
BOUNDED COMPUTE CANDIDATE
Compute receives only admitted work data and may only propose a candidate.
REVIEW THE EXACT CANDIDATE
Input, version, scope and candidate cannot be swapped in transit.
CONTROLLED SYSTEM EXECUTION
The executor creates an effect only after checking a single-use grant.
REPLAY THE RESPONSIBILITY PATH
Keep traceable positions for relationships, candidate, review and effect receipt.
02 / RELATIONSHIP LEGALITY
NOT FILLED FIELDS—RELATIONSHIPS THAT SUPPORT THIS EFFECT.
The same signed-in identity does not automatically inherit the same operation grant across devices, environments, times or work. Existing relationships retain version and source; a change rechecks only the affected relationship.
SUBJECT
CHECKSUBJECT
Who acts this time
DEVICE
CHECKDEVICE
Whether this device belongs to the relationship
ENVIRONMENT & TIME
CHECKENVIRONMENT & TIME
Whether observations support this work window
WORK & SOURCE
CHECKWORK & SOURCE
Whether source data belongs to this work
ALLOWED SCOPE
CHECKALLOWED SCOPE
What the candidate may and may not do
RESPONSIBILITY & CONTROL
CHECKRESPONSIBILITY & CONTROL
Who may execute, stop, repair and answer
03 / THREE PUBLIC SCENARIOS
SEE THE DIFFERENCE—SEE WHAT THE FIREWALL STOPS.
ARELATION
A map is an observation; relationships determine admissibility.
A synthetic map shows an observation, allowed boundary and uncertainty, then relates it to the device, environment, time and work. GPS, IP or VPN alone cannot grant authority.
BSTOP
Missing evidence stops the affected operation.
Identity remains valid; only this operation loses effect eligibility. The system identifies the missing environment or responsibility relation instead of letting a model invent it, then waits for rule-based revalidation.
CBLOCK
Review blocks a candidate that exceeds scope.
Even after sign-in and pre-check, a candidate that adds operations, alters sources or mismatches the calculation receives no effect authority; the executor creates no file.
04 / WEBSITE FIXED-CASE DEMO
I REPLAY IT TO WEBSITE STANDARD WITHOUT ALTERING THE ORIGINAL INTERACTIVE DEMO.
I built the website version as a fixed synthetic scenario with no visitor input. It automatically replays integration placement, missing-evidence stops and out-of-scope candidate blocks, while the public interactive walkthrough keeps its original design, code and pacing.
SF-07SEMANTIC FIREWALL CAUSAL SECURITY SYSTEM
AUTO / NO INPUTFIXED SYNTHETIC DATAAUTO / NO INPUTNO LIVE VERIFICATION OR AUTHORIZATION
LOGINFIXED SYNTHETIC CAUSAL WALKTHROUGH
KEEP EXISTING SIGN-IN; CHECK ACTION ELIGIBILITY SEPARATELY
A fixed synthetic identity enters from the existing system. Sign-in confirms the session subject without granting every later operation.
01EXISTING SYSTEM→02SEMANTIC FIREWALL↔03COMPUTE→04CONTROLLED EXECUTOR
FIXED SYNTHETIC MAP±20 m
DEMO CENTERSYNTHETIC ONLY
01SUBJECTESTABLISHED
02DEVICEPENDING
03ENVIRONMENTPENDING
04TIMEPENDING
05WORKPENDING
06RESPONSIBILITYPENDING
CAUSAL RESPONSIBILITY CHECKIDENTITY VERIFIED / ACTION PENDING
LOGINFIXED CASE
EXISTING SIGN-INPRESERVED
SYNTHETIC SUBJECTDEMO-SUBJECT-01
CREDENTIALSNOT COLLECTED
ACTION ELIGIBILITYNOT YET CHECKED
SIGN-IN ≠ BLANKET AUTHORITYEXISTING SECURITY RETAINED
01 / 09
LOGINKEEP EXISTING SIGN-IN; CHECK ACTION ELIGIBILITY SEPARATELYIDENTITY VERIFIED / ACTION PENDING
MAPMAP OBSERVATION MUST RELATE TO DEVICE, ENVIRONMENT AND WORKSYNTHETIC RELATION MAP
PREPRE-CHECK EACH OF SIX ACTION RELATIONSHIPSPRE-CHECK / PASS
STOPENVIRONMENT EVIDENCE MISSING—COMPUTE STOPSEVIDENCE GAP / STOP
CANDBOUNDED COMPUTE PROPOSES A CANDIDATE ONLYCANDIDATE / NO EXECUTION AUTHORITY
REVIEWPOST-REVIEW BINDS THE SAME CANDIDATE TO THE ADMITTED SCOPESAME-CANDIDATE REVIEW / PASS
BLOCKPOST-REVIEW BLOCKS AN EXTRA OPERATIONOUT-OF-SCOPE CANDIDATE / BLOCK
EFFECTTHE ORIGINAL EXECUTOR CONSUMES A SINGLE-USE GRANTCONTROLLED EFFECT / SYNTHETIC
REPLAYREPLAY RETAINS SUBJECT, EVIDENCE, CANDIDATE AND EFFECT CHAINREPLAY READY / READ ONLY
SOURCEReconstructed as a fixed website film from the public semantic-firewall-causal-demo README and walkthrough; the public demo design and code remain unchanged.
BOUNDARYEvery subject, device, location, time, work item, candidate and result is synthetic. No credentials are collected and no model, private backend, live location, enterprise system, verifier or authorization service is connected. This is not a SaaS claim.
05 / PUBLIC BOUNDARY
I PUBLISH THE INTEGRATION LOGIC. I KEEP THE PRIVATE CORE PRIVATE.
I have encoded the integration sequence, relationship checks, stop conditions, same-candidate review and replay path in a public synthetic walkthrough.
This public website demonstration does not connect to real sign-in, GPS, device verification, a model, an enterprise system, an authorization service, a database or audit evidence. It makes the integration position and blocking logic visible. Any real enterprise integration must still be implemented and verified in a named environment.
I keep the private backend, rule core, full formulas, enterprise integration data and local product workspace out of the site and public repository.