Since #42 a signed-out visitor's front door is the shelf of public apps, and each tile links to the app's studio page. That page renders, for anyone who can read the repository: This week — changes shipped, runs, $86.75 spent and $5.42 per shipped change — On its own — autonomous, $66.20 of $120 today, slots in use — the crew's names and roles, the decision ledger's counts, and every recent run with who was on it (src/web/pages/studio.ts:985-1060). Only the buttons are gated (writer, line 742); the numbers are not. A public app should show a stranger what it is, not what its owner spends.
Done looks like
[ ] A viewer who cannot write to the repository sees the app: what it does, whether it is live, its address, the look, Open the app, and the changes that have shipped — with no money anywhere on the page, no ceiling, no slots, no decision ledger, and no crew roster.
[ ] What is happening now, for such a viewer, is the app's own story — a change being built, a preview coming up — without run costs, run ids or steering; a writer's page is exactly what it is today.
[ ] The same rule holds on every surface that carries these numbers for one app: the live fragments (/app/state and whatever #55 adds), the transcript page (#51), the board, and the API if it answers them — one check, not five.
[ ] The rule is one predicate with a name, used everywhere, so the next card cannot forget it; the page never computes a number it is not going to show.
[ ] test/studio.test.ts: an anonymous request for a public app's studio page contains no $, no crew usernames and no ledger; a reader with read-only access gets the same; a writer's page still has all of it. The first two fail on today's code.
[ ] docs/STUDIO.md says plainly which facts are the owner's and which are the public's.
Files I expect to change
src/web/pages/studio.ts, src/web/pages/board.ts if it renders the same numbers, docs/STUDIO.md, test/studio.test.ts.
Risks
The fragments are the hole. A card removed from the page but still served by a fragment endpoint leaks it to a fetch; test the fragment, not only the page.
Over-gating. A public app's shipped changes, its look and its preview links are the point of a public app; hiding those makes the shelf pointless.
A private app is unaffected — it already answers only to people who can read it; this is about the public ones.
Who
Scout — one predicate, applied everywhere, with the adversarial test that proves it; worth Sentinel's eyes on the pull.
Since #42 a signed-out visitor's front door is the shelf of public apps, and each tile links to the app's studio page. That page renders, for anyone who can read the repository: This week — changes shipped, runs,
$86.75spent and$5.42 per shipped change— On its own — autonomous,$66.20 of $120today, slots in use — the crew's names and roles, the decision ledger's counts, and every recent run with who was on it (src/web/pages/studio.ts:985-1060). Only the buttons are gated (writer, line 742); the numbers are not. A public app should show a stranger what it is, not what its owner spends.Done looks like
/app/stateand whatever #55 adds), the transcript page (#51), the board, and the API if it answers them — one check, not five.test/studio.test.ts: an anonymous request for a public app's studio page contains no$, no crew usernames and no ledger; a reader with read-only access gets the same; a writer's page still has all of it. The first two fail on today's code.docs/STUDIO.mdsays plainly which facts are the owner's and which are the public's.Files I expect to change
src/web/pages/studio.ts,src/web/pages/board.tsif it renders the same numbers,docs/STUDIO.md,test/studio.test.ts.Risks
Who
Scout — one predicate, applied everywhere, with the adversarial test that proves it; worth Sentinel's eyes on the pull.