// lab
The Lab
arcane@prod:~$ ./lab --run
Real operations you can trigger — not screenshots, and not simulations. Every demo below runs my own code, live, against this platform's own infrastructure, and each card explains in one line what it proves and why it is safe to hand to a stranger.
The safety model behind all of them:
- isolated — destructive demos live in a disposable, NetworkPolicy-fenced
demonamespace; nothing in there can touch this site - capped — chaos and load carry hard limits on rate, duration and concurrency, enforced server-side
- no real data — the DB explorer speaks to a synthetic demo postgres, never the platform's actual database
- no execution surface — the sandbox shell is a fixed command grammar over an in-memory filesystem; a real exec surface would be reckless on a single-node host, so by construction there isn't one
The same live metrics these demos move are on /system, and the newest exhibit — a self-hosted local model — lives on the oracle page.
Chaos
Delete a pod in the disposable demo namespace and watch Kubernetes recreate it.
proves: Kubernetes self-healing — you delete a real pod and watch the cluster restore it · safe because: the blast radius is three disposable echo pods in an isolated demo namespace
Load test
Fire a bounded burst at an isolated demo target (never this site) and watch the latency histogram build live. Hard caps: ≤50 concurrent · ≤10s · server-clamped.
proves: behaviour under real load — live latency histogram from real requests · safe because: it only ever fires at an isolated demo target, with hard caps on rate and duration
Event stream
Live lab lifecycle events over SSE — every chaos kill and load test above appears here as it happens.
no lab events yet — trigger a chaos kill or a load test above
proves: the cluster's own event stream, live as it happens · safe because: strictly read-only
Rate limiter
The real per-IP token bucket that guards every /api/* route. Hammer it and watch it refuse past the burst — these are live responses, not a simulation.
- rps
- —
- burst
- —
- active IPs
- —
- 429s total
- —
fires 40 requests at once at the limiter (burst ~20); your other panels share this per-IP limit, so they may briefly rate-limit too. “429s total” is a global cumulative counter.
proves: the platform's per-IP rate limits, by letting you trip them · safe because: you only ever throttle yourself
DB explorer
Run a curated query against a disposable demo postgres (namespace demo — synthetic dataset, not the platform's real database) and read the actual EXPLAIN (ANALYZE) plan. The SQL shown is exactly what runs — there is no free-form input, by design.
loading queries…
proves: real query planning — postgres EXPLAIN (ANALYZE) output you steer · safe because: a disposable demo database with synthetic data and allowlisted queries only
API playground
Try the platform’s real read-only endpoints — a fixed allow-list of GET paths (no free-text URLs), returning the live response, status, timing and headers. These four return full snapshots; the demo-token surface below adds an honest auth-header flow and real cursor pagination.
pick an endpoint to try it
Demo token + pagination
A demonstration of an auth-header flow and real cursor pagination over a synthetic demo dataset (clearly not real platform data). Mint an ephemeral demo token — it’s not real auth, just a short-lived key — then page through the events. Fetching without a token returns a real 401.
proves: the platform's public read APIs, explorable with a scoped demo token · safe because: read-only endpoints, demo-token scoped, rate-limited
Sandbox shell
A safe, read-only terminal — a fixed command grammar over an in-memory filesystem, with zero arbitrary execution. Try help, ls, cat about.txt, tree.
proves: an operations shell over real platform data · safe because: a fixed command grammar — there is no exec path to escape through, by construction
App-layer WAF
A signature monitor over the core API’s (/api/*) real request stream. It runs in monitor mode — it flags, it does not block. This is best-effort pattern matching (trivially bypassable by encoding or a request body), not a security boundary or whole-site protection. No fabricated attacks; fire a sample below to preview the engine’s verdict.
- inspected
- —
- flagged
- —
- blocked
- —
- rate 429s
- —
The dashboard counters reflect only real core traffic; the probe above is a preview and never touches them. On a quiet site “flagged” is usually low — that is honest.
proves: an application-layer WAF engine watching this very site's traffic · safe because: monitor-mode only, and it stores no IP addresses by construction
GPU shader field
A live arcane field — a fragment shader run per-pixel via raw WebGL (no library). Paused by default, and it respects reduced-motion.
compiling a shader on your GPU…
proves: hand-written WebGL — no libraries, shaders from scratch · safe because: it's pixels