3 · Workstation
NumericalOS privacy-workstation units the operator builds locally. Offline-first. numericalos.com is never a fallback coordinator.
Control plane · fallback 3+2+1 → 3+2 → 2+1
Apex algoblocker.com is public. HMAC device-lock is on disk and not published — it is not Access. Enroll only after an explicit device-lock deploy: device-lock/scripts/enroll.py.
Verifiable distributed privacy
Three independent layers. Units are operator-attested; we hash-check the receipt and degrade in public. NumericalOS supplies the hash rule and the workstation profile — we do not host images, and we do not claim a metal boot.
2 · VPN
Cloudflare WARP shared egress (consumer or Zero Trust --team). Closes IP, ASN, DNS-to-ISP. Origin JA3 stays the browser’s unless Gateway TLS inspection is on. Trust shifts to Cloudflare.
1 · Receipts
Line-oriented posture file. C is SHA-256 of the body excluding the C line — same as numos.canonical.content_hash. Nothing stored here by default.
Stack actions
Google → UniFi identity bridge WARP / Cloudflare One onboard Enroll VPN (layer 2) Build / verify receipt (layer 1) GET /api/enterprise/onboard GET /api/enterprise/postureEnterprise Identity Bridge
Provisional · paid customers
Dedicated Google OAuth/OIDC → signed SAML + least-privilege LDAPS federation for UniFi. Manually provisioned after explicit scope and infrastructure approval; commercial pricing is not set. Estimated isolated-tenant infrastructure is $22–$29/month.
Durward's Glen is design-only and deferred: no identity compute, DNS, TLS listener, secrets, or bridge users have been provisioned.
Open identity runbook GET /api/enterprise/identityNear-competitor parity (honest)
Have / partial / residual. Gateway* needs a Zero Trust token the operator owns.
| Capability | Mullvad | Proton | Brave | CF ZT | Algoblocker |
|---|---|---|---|---|---|
| Shared-egress VPN | yes | yes | no | WARP | WARP layer 2 |
| Kill switch | yes | yes | n/a | yes | DNR (not OS firewall) |
| JS fingerprint flatten | no | no | yes | no | MV3 extension |
| Tracker / fingerprinter cut | partial | partial | yes | Gateway* | DNR blocklist |
| Device posture receipt | no | no | no | opaque | numos-hash receipt |
| Offline-verifiable receipt | no | no | no | no | hash + local CLI |
| Multi-hop / mixnet / Tor | SOCKS | no | no | no | use Tor Browser |
| Metal-verified OS boot | no | no | no | no | NumericalOS unverified |
Residuals: WARP is unlinkability in a Cloudflare herd, not anonymity.
NumericalOS boot is unverified until
numericalos-verify-boot observes a specific artifact.
Firefox permanent install still needs an AMO-signed XPI. No receipt is accepted if it contains an IP or @.Launch recovery
Live auth plane is the Worker. Custom hosts auth.algoblocker.com and recover.algoblocker.com are not on DNS yet.
Enterprise Mail
Webmail is live on workers.dev. Hostname mail.algoblocker.com has no A/MX (NODATA). Apex algoblocker.com already has Cloudflare Routing MX/SPF.
News Drip
Bot-filtered, ASEC-scored RSS. Top decile only. CORS-open, no keys.
GET /api/enterprise/newsdrip