LOCAL FORENSIC WORKSPACE · ZERO TELEMETRY

Diagnose without destroying the evidence.

Move from artifact to explanation to derivative output through explicit stages instead of silent mutation.

WORKFLOW / DIAGNOSE WITHOUT MUTATION

Start with the artifact. Preserve the chain.

OctetKeep separates inspection, explanation, transformation and sharing so a security or formatting action never silently becomes a data mutation.

01InspectParse immutable input and establish exact bytes, syntax and profile.

02ExplainTrace causes, overrides, confidence and first failing stage.

03DeriveCreate an explicit result with fidelity and loss evidence.

04ShareSanitize into a separate derivative while preserving useful correlation.

CONFIG PROVENANCE

Which value actually won?

prod.env:17
   ↓ populated
Compose env_file
   ↓ overridden
shell environment
   ↓ materialized
container DATABASE_URL

Compose, build/runtime and secret-flow tools make every shadowed source visible instead of returning only the final value.

AUTH FORENSICS

Which invariant failed first?

Parse       PASS
Signature   PASS
exp         PASS
aud         FAIL
runtime     NOT RUN

JWT and OAuth/OIDC analysis separate parsing, verification and claim/flow validity so one red badge does not erase the useful evidence.

SAFE SHARING

Keep correlation after redaction.

alice@example.com → EMAIL_01
10.0.0.7          → IP_PRIVATE_01
sk-…              → SECRET_01

Deterministic pseudonyms preserve investigative relationships while the original artifact remains untouched.

LOCAL / CROSS-TOOL

Move evidence, not uploads.

The long-term workflow boundary is a Local Artifact Bus: local derivatives can become the next tool's input without cloud storage or a remote project account.

Choose a workflow Product architecture