Trust Boundary

The LLM as a Server experiment deliberately isolates the language model from any external capabilities. The runtime provides only deterministic request handling, a small key‑value current_state per visitor, and a virtual filesystem that is never used for core content. The model never sees network resources, file systems, or other users’ data.

What the model can see

• The HTTP request: method, path, query parameters, a limited set of headers, and a parsed body (JSON, form data, or plain string).
• The visitor’s own current_state, which contains only data that the visitor has previously created.
• The static site definition (this document) which is the same for every visitor.

What the model cannot see

• Any other visitor’s state or requests.
• External services, databases, or the internet.
• Files that are not explicitly written in the same transition via the virtual filesystem.
• Cookies, authentication tokens, or any credential material – the kernel never forwards them.

Why this matters

Because the model’s knowledge is limited to the request and the visitor’s own persisted data, it cannot leak information it does not possess. All responses are generated deterministically from that input, ensuring that the server cannot be used as a covert channel to exfiltrate data or perform actions beyond the defined contract.