pack-local-utility pattern

CustodyBoundary

Summarize who controls credentials, session, artifact, network destination, telemetry, and release proof.

pack/local-utility · candidate · @sanchika/patterns

Product job

Verify who controls each sensitive element, what crosses, what never crosses, and how the user retains control.

Summarize who controls credentials, session, artifact, network destination, telemetry, and release proof.

Anatomy and required fields

boundaryClaim

One-sentence custody statement.

boundaryOwner

Person or system controlling the boundary.

insideBoundary

Data, session, and artifact kept inside.

outsideBoundary

Named destinations or processors outside.

crossingEvent

The user-controlled event that crosses the boundary.

neverCrosses

Credentials, session, files, or telemetry that never cross.

userControl

How the user starts, denies, or stops the crossing.

custodyFacts

Named actor and location for each sensitive element.

networkDestination

Observed destination or no-network statement.

sourceProof

Public source and release inspection paths.

Required fields

boundaryClaim
boundaryOwner
insideBoundary
outsideBoundary
crossingEvent
neverCrosses
userControl
custodyFacts
networkDestination
sourceProof

Default and edge states

local-only

Artifact and workflow data remain user-controlled locally.

local only
destination
no handoff

workspace-scoped

A named workspace boundary owns the data.

workspace scoped
account
processor

public-metadata-only

Only named public metadata crosses.

public metadata
source
no private artifact

transfer-pending

A user-controlled transfer has not occurred yet.

transfer pending
destination
cancel action

no-transfer

No transfer occurs in the documented flow.

no transfer
inside boundary
evidence

Composed synthetic exemplar

State coverage

Default and consequential edges remain inspectable.

local onlyArtifact and workflow data remain user-controlled locally.local only · destination

workspace scopedA named workspace boundary owns the data.workspace scoped · account

public metadata onlyOnly named public metadata crosses.public metadata · source

transfer pendingA user-controlled transfer has not occurred yet.transfer pending · destination

no transferNo transfer occurs in the documented flow.no transfer · inside boundary

Trust, source, and consumer obligations

Trust boundaries

Credentials and portal session remain with the government portal and the user's browser.
Name any network request, permission, artifact destination, and telemetry behavior before the action.

Consumer owns

Prove portal behavior, permissions, network requests, downloads, telemetry, release evidence, and every custody statement.

Responsive behavior

Wrap facts into labelled rows, not unlabeled icons.
Place unknown or handoff status before the consequential action.

Forced colors and reduced motion

Retain numbered order, text labels, link underlines, focus, and custody boundaries with system colors.
Preserve custody order, permission scope, denial behavior, and local destination without animated connectors.

Compact API reference

Package: @sanchika/patterns
CSS: @sanchika/patterns/styles.css
Base class: sk-pattern-custody-boundary
Group: pack-local-utility