Public documentation only. Private workbench links and deployment identifiers are not included.

SL2 | Tianxin website technical guide | 0.2.3
Currently free of charge

This Tianxin website
project_id=[private project ID omitted]
Site origin: [private origin omitted]
Entry: /sl2/ (Vinext may canonicalize to /sl2; fixed document base=/sl2/).
The page processes text and validates JSON through same-origin POST /sl2/mcp. GET /sl2/session returns only an authenticated boolean with cache-control: no-store.
Data path: visitor browser → SL2 handler in the Tianxin cloud service → the same browser. No cross-Site call to the original plugin. The manifest retains Tianxin's project_id, d1:null and r2:null; no mcp capability or new plugin registration is added.

Identity and Origin
Absent Origin follows the normal server-to-server checks. A present Origin must exactly equal the request URL's origin, otherwise 403 precedes body processing. This website does not permit https://chatgpt.com or the original SL2 Site as cross-origin browser callers. The route removes all access-control-* response headers; no CORS permission is provided. GET /sl2/mcp is 405, without SSE.
sl2_compare_texts and sl2_validate_handoff return 401 without a nonblank Sites oai-authenticated-user-id. Neither a service bearer nor clientRequestId supplies visitor identity. Injection and spoofed-header removal by Sites require real platform testing; synthetic headers and local sign-in do not prove that boundary.
Sign-in uses top-level /signin-with-chatgpt?return_to=%2Fsl2 (or %2Fsl2%2F when pathname retains the slash), with pathname only, never text or query. No fetch sign-in or separate OAuth. Signing in or leaving clears page memory; a notice precedes input, and existing input triggers a cancellable navigation confirmation. A 401 never redirects automatically.

Interface and results
The website accepts source, draft, purpose and up to 20 quotation pairs. Plain Chinese explanations have English directly below; supplied text is not translated. Each quotation separately displays sourceLiteral and draftLiteral counts, not-found/not-provided states and each side's UTF-16 line/column positions. All positions returned by the backend are shown (up to 200 per side); further matches have an explicit shown/total count. Literal matches do not establish semantic support.
Compare results are labeled as submitted text. JSON validation is labeled as an imported record and exposes its full source/draft for review without replacing other input fields. Revision, snapshot, RPC id and clientRequestId bind responses. Edits, late/reversed/timed-out or mismatched responses cannot enable stale exports.
Text/results remain in page memory, without localStorage, analytics, additional AI, search or an SL2 database. Processing/validation sends only the submitted material to this Site's cloud service; platform policies still apply. Material is rendered with textContent. Blob/objectURL creates local JSON/TXT downloads; denied clipboard access selects complete JSON for system copying. No public material-bearing file or URL is created.

Protocol and limits
The website uses protocol 2026-07-28, mcp-protocol-version/mcp-method/mcp-name headers, and params._meta containing io.modelcontextprotocol/protocolVersion and io.modelcontextprotocol/clientCapabilities. Backend legacy support remains; no new plugin identity is created.
100,000 UTF-16 units per text; 3,000 per quotation/purpose; 20 quotation pairs; 2 MiB for the complete UTF-8 JSON request. Validation also limits the JSON string to 1,800,000 UTF-16 units, and its enclosing request must still fit 2 MiB.
Valid processing output can exceed validation limits because of JSON escaping or location data. The interface then explicitly allows a complete download but warns that this service cannot revalidate that package. It never truncates, repairs or silently rewrites it. The import field preserves pasted text and rejects oversized requests before sending.
S2_LOCAL_HANDOFF_V1 is unchanged. SHA-256 checks internal consistency, not signatures or author authenticity. A fully rewritten and rehashed package can remain consistent; retain a trusted original separately.

Original ChatGPT plugin (separate Site; unchanged here)
Original SL2 project_id=[private project ID omitted]; origin=[private origin omitted]. Its root POST /mcp differs from Tianxin's /sl2/mcp. The original engineering baseline permits exact ChatGPT and original-Site Origins; that is not Tianxin's policy.
The original plugin tools are sl2_get_info, sl2_compare_texts, sl2_validate_handoff and sl2_open_workbench. ui://sl2/workbench/v0.2.3.html and the 0.2.2/0.2.1 aliases belong to the original host UI. The reused backend retains these names/resources; the Tianxin website does not depend on the widget and does not register another plugin. Original core source and widget are byte-preserved; generated ESM removes only the unused CommonJS export branch, without algorithm changes.

Evidence boundary
Local builds, routes, actual downloaded file contents and browser viewports are testable. Real sign-in, strangers, physical phones/tablets and public deployment require separate confirmation. Existing passing regressions do not rule out new counterexamples. Saving a version is not publication.
Contact: wingyanshen@gmail.com