fors33/l3dgr repository overview

⁠L3dgr

Docker Desktop extension from Fors33. Checksums are not evidence. L3dgr binds operator-selected data so a second party can verify it without trusting the operator or Fors33. Cryptographic data integrity on operator-selected paths: scan, verify, and seal. Live ingest uses T3thr. Product docs: fors33.com/l3dgr/docs⁠.

⁠Table of Contents

• Features⁠
• Requirements⁠
• Quick start⁠
• Privacy and data lifecycle⁠
• Related tools⁠
• L3dgr Beta⁠
• Support⁠
• Compliance⁠
• License⁠

⁠Features

• Scan and verify operator-selected Docker-shared folders with deterministic hash comparison (no sampling).
• Seal licensed Dashboard workflows with manifests, .f33 sidecars, and receipts.
• File processor for local CSV, JSON, and Parquet normalization via T3thr.
• Live ingest and scheduled jobs when your license includes pipeline connectors.
• Local by default: operator-selected paths, Docker named volumes, optional telemetry off until enabled in Settings.

Scan, verify, and attest are strictly deterministic: full directory traversal, no sampling or heuristic integrity; every conclusion is traceable to hash comparison or explicit enumeration. Probabilistic approaches are not used.

⁠Requirements

• Docker Desktop on Windows, macOS, or Linux.
• Operator-selected folders shared with Docker Desktop so L3dgr can scan, verify, or process them.
• Lobby scan, verify, and file processing do not require sign-in. Dashboard Seal and live ingest require a licensed session.

⁠Quick start

Install the current release candidate from Docker Hub. Docker Marketplace listing remains on hold. Pin this tag; :latest is not published.

docker extension install fors33/l3dgr:0.83.0-rc.3

If L3dgr is already installed:

docker extension update -f fors33/l3dgr:0.83.0-rc.3

In the extension:

• Lobby covers scan, verify, and file processing without sign-in.
• Dashboard Seal and live ingest require a licensed session.

Uninstall:

docker extension uninstall fors33/l3dgr

Before uninstall, use Settings → Advanced → Backup Identity and store the zip offline and encrypted. Uninstalling or deleting Docker volumes removes local identity, settings, staging, and audit state.

⁠Privacy and data lifecycle

Dataset bytes, seals, and integrity artifacts stay on operator-selected paths and Docker named volumes (local-first data). Operator identity, license, and seat wrap use Fors33 account services except air-gapped entitlements. The extension runs inside the Docker Desktop extension VM and accesses host folders that the operator selects and Docker Desktop shares.

Local access and outputs:

• Reads shared host folders selected by the operator for scan, seal, verify, drift review, and file processing.
• Writes generated integrity artifacts to selected host paths or Docker-managed volumes, including .f33 sidecars, manifests, receipts, reports, audit events, staging JSONL, dead-letter JSONL, and optional CSV derivatives.
• File-processor jobs expose Download actions for accepted.jsonl, dead_letter.jsonl, and optional accepted.csv when artifacts are in the staging root. JSONL is the immutable source of truth; CSV is optional derivative output.
• Stores extension state in Docker named volumes under /var/lib/fors33, including preferences, operator identity material, license token, connection profiles, audit state, staging outputs, and cryptographic binding data.

Remote and account surfaces:

• OAuth sign-in and license sync contact Fors33 services for operator session and entitlement checks.
• Minimal technical telemetry is disabled by default. When enabled in Settings, it sends only event name, platform, timestamp, and success/error status.
• Telemetry does not include file paths, file contents, hashes, emails, OAuth tokens, license tokens, connector URLs, bucket names, environment variables, stack traces, or private keys.
• Remote S3/WORM storage and remote connectors are used only when configured by the operator. The operator controls the destination provider, bucket or endpoint, access rules, encryption, and retention policy. Independent time: Standard uses the host-synchronized VM clock and TSA is optional. Strict and Regulated require an operator RFC 3161 timestamp authority plus the in-image trust bundle, not the extension VM clock. Record durability for audit preparation is the operator's WORM destination (for example Object Lock) or reconstruction from the local append-only ledger. Use of this software does not certify SEC Rule 17a-4(f) or FDA 21 CFR Part 11.

Retention:

• Docker extension updates preserve named volumes.
• Uninstalling the extension or deleting its Docker volumes removes local identity, settings, staging, and audit state. Use Settings → Advanced → Backup Identity before destructive maintenance.
• Website-side retention for account, license, and telemetry records is governed by the Fors33 Terms of Service and Privacy Policy.

⁠Related tools

Fors33 Verifier and Fors33 Scanner are MIT-licensed open tools. They run locally on your infrastructure. They do not use the L3dgr Docker Desktop extension airlock, L3dgr account OAuth, or L3dgr optional technical telemetry. They support integrity checks and audit preparation only. They do not certify compliance with SEC Rule 17a-4(f) or any other regulatory framework.

• Scan and verify on disk: Fors33 Scanner and Fors33 Verifier (no Docker Desktop).
• Seal, receipts, and epoch on glass: L3dgr Dashboard Seal with a licensed operator session.
• Licensed CI seal: from this private tree, PYTHONPATH=backend python backend/l3dgr_headless.py seal --ci --path /path/to/dataset. Prefer env L3DGR_LICENSE_TOKEN (paid JWT). Set FORS33_ORG_VOLUME_ROOT to a writable job directory (GitHub Actions uses runner temp). Empty single-seat stores bootstrap an ephemeral owner seat there; multi-seat licenses still fail closed until a matching seat exists. Composite Action after checkout of this tree: uses: ./.github/actions/l3dgr-seal. Not the loopback Desktop helper. Not a separate installer. Not docker run fors33/l3dgr.
• Independent CI check: the Verifier and Scanner GitHub Actions on the packages below (no Seal license).
• Auditor Package: licensed ZIP of the signed report, canonical manifest, receipt, and verification keys so a second party can re-run without Docker Desktop. Original dataset bytes stay on the operator-selected path.

Docker Desktop is required for the L3dgr operator glass (Dashboard Seal, seats, live ingest). It is not required for independent scan and verify, or for the licensed CI seal CLI. Auditors do not need Docker Desktop. L3dgr has no separate headless installer. Do not docker run the fors33/l3dgr image; that image is the Desktop extension, not a server. Docker Marketplace listing remains on hold.

pip install fors33-verifier==0.11.0
pip install fors33-scanner==0.10.0
docker pull fors33/fors33-verifier:v0.11.0
docker pull fors33/fors33-scanner:v0.10.0

• Verifier: GitHub⁠ · PyPI⁠ · Action⁠
• Scanner: GitHub⁠ · PyPI⁠ · Action⁠
• Ten-minute recipe: fors33.com/l3dgr⁠

⁠L3dgr Beta

Fors33 is running a closed L3dgr Beta cohort (legal ID L3DGR-BETA-1.9). This wave is Pro only. It is not an open promo code and not unlimited free Pro.

• Apply: fors33.com/l3dgr/beta⁠
• Participant quick start: fors33.com/l3dgr/beta/guide⁠
• Cohort status: fors33.com/l3dgr/beta/status⁠
• Key delivery: fors33.com/l3dgr/setup⁠

Approved participants complete checkout with a Fors33-issued promotion code, then finish required journeys: one Dashboard seal and one pipeline (file processor, live ingest, or scheduled job). Complimentary Pro access covers the program window. Graduation terms (including year-one discount for completed requirements) are in the offer email and L3DGR-BETA-1.9.

⁠Support

• Docs: https://fors33.com/l3dgr/docs⁠
• Support: https://fors33.com/l3dgr/support⁠
• Account: https://fors33.com/account⁠
• L3dgr Beta: [email protected]⁠
• Extension changelog: CHANGELOG.md⁠

⁠Compliance

L3dgr supports cryptographic integrity checks, operator-attributed seals, and audit preparation. Use of this software does not establish, guarantee, or certify compliance with SEC Rule 17a-4(f), FDA 21 CFR Part 11, or any other regulatory framework. See LEGAL_DISCLAIMER.md⁠ and product docs at https://fors33.com/l3dgr/docs⁠

⁠License

MIT License. Copyright (c) 2026 Fors33, Inc. See LICENSE⁠.

Product documents (current IDs in the legal manifest⁠): L3DGR-EULA-2.5, L3DGR-PRIVACY-2.10. L3dgr Beta participants also accept L3DGR-BETA-1.9.

Legal and regulatory boundaries: LEGAL_DISCLAIMER.md⁠ and fors33.com/legal⁠.