diff --git a/PLAN.md b/PLAN.md index 488cf6f..c4931d4 100644 --- a/PLAN.md +++ b/PLAN.md @@ -1,12 +1,12 @@ -# Ideascape MVP Plan +# Ideascape Security Validation Plan ## Product goal -Help creators validate promising ideas with public concept previews and privacy-preserving interest signals, then introduce transparent, milestone-based funding only after demand, security, governance, and legal assumptions have been tested. +Help operators expose credible threats, bound control authority, and publish reproducible proof before a system earns trust or a larger exercise. ## Current product mode -Ideascape is in **Exploration mode**. Published entries are concept previews, not active fundraisers or operating programs. The live product accepts no funds, connects no wallets, and deploys no smart contracts. Signaling interest involves no payment or commitment. +Ideascape is in **Security review mode**. Published entries are security briefs, not deployment approvals. Review signals remain private and reversible; only aggregates are public. A signal grants no production access, data authority, custody, payment, or commitment. ## Phase 1 — Foundation @@ -17,76 +17,59 @@ Ideascape is in **Exploration mode**. Published entries are concept previews, no - [x] Link the hosted Supabase project - [x] Add CI for checks and production builds -## Phase 2 — Identity, ideas, and validation +## Phase 2 — Identity, security briefs, and validation - [x] Add email and OAuth authentication - [x] Create public profiles -- [x] Model ideas, categories, media, and lifecycle states -- [x] Build private idea creation and editing -- [x] Build public discovery and idea-detail pages -- [x] Add shareable text search and category filters to public discovery +- [x] Model security briefs, domains, media, and lifecycle states +- [x] Build private security-brief creation and editing +- [x] Build public security discovery and detail pages +- [x] Add shareable text search and security-domain filters to public discovery - [x] Add row-level-security policies and policy tests -- [x] Add private, reversible member interest signals -- [x] Expose aggregate-only public interest counts +- [x] Add private, reversible account validation signals +- [x] Expose aggregate-only public validation counts - [x] Preserve safe internal return paths through authentication -- [x] Seed deterministic concept previews and local illustrations -- [x] Expand the catalog with bold, measurable infrastructure concepts and explicit operating boundaries -- [x] Refine broad launch previews into bounded tests with decision-grade evidence -- [x] Replace generic previews with issue-driven Colorado Springs civic campaigns -- [x] Give every demo a threat scenario, control boundary, and proof requirement consistent with the security claim policy +- [x] Seed deterministic security briefs and local illustrations +- [x] Expand the catalog with measurable infrastructure controls and explicit operating boundaries +- [x] Refine broad launch records into bounded tests with decision-grade evidence +- [x] Replace generic previews with issue-driven Colorado Springs security audits +- [x] Give every brief a threat scenario, control boundary, and proof requirement consistent with the security claim policy +- [x] Require threat, control-boundary, and proof fields in new private drafts - [x] Add persistent light and dark themes - [x] Restrict the rendered palette to black, white, neutral grays, and bright orange -## Phase 3 — Validation evidence and campaign design +## Phase 3 — Validation evidence and adversarial review -- [x] Distinguish practical participation intent—use, build, pilot, expertise, or updates—without exposing individual activity +- [x] Preserve the original private intent meanings—“I would use this,” “I would help build it,” “I could test a pilot,” “I have relevant expertise,” and “Keep me updated”—without exposing individual activity or treating intent as authorization - [x] Add the first focused Project Time Capsule pilot question with private, reversible responses -- [x] Publish Project Time Capsule pilot thresholds and a creator/operator-only aggregate readiness dashboard -- [x] Expand focused validation questions to concepts whose riskiest assumption is clearly defined +- [x] Publish Project Time Capsule exercise thresholds and an author/operator-only aggregate readiness dashboard +- [x] Expand focused validation questions to security briefs whose riskiest assumption is clearly defined - [x] Add a database-authorized, aggregate-only administrator operations dashboard without exposing respondent identities, draft content, or application details -- [ ] Add a private evidence dashboard for views, intent conversion, and concept momentum -- [ ] Define explicit validation thresholds for moving from a concept preview to a proposed campaign -- [ ] Add creator updates and public continue, revise, pause, or archive decisions +- [ ] Add a private evidence dashboard for views, review-intent conversion, and proof momentum +- [ ] Define explicit validation thresholds for moving from a security brief to a bounded exercise +- [ ] Add operator updates and public continue, revise, pause, or archive decisions - [ ] Defer general comments, social feeds, and broad reactions until moderation needs are defined -- [ ] Define campaign goals, deadlines, milestones, evidence requirements, fees, disputes, cancellation, and refunds -- [ ] Add creator and supporter dashboards without exposing private member activity -- [ ] Define moderation, identity, sanctions, tax, privacy, and consumer-protection requirements +- [ ] Add control-test reports and residual-risk decisions without exposing private reviewer activity +- [ ] Define moderation, identity, privacy, disclosure, and coordinated-vulnerability-reporting requirements -## Deferred — funding research outside the current pilot-readiness mission - -No payment, wallet, cryptocurrency, custody, smart-contract, or active fundraising work is planned for the current product phase. Revisit this section only after a separate consequential product decision. - -- [ ] Select a chain, asset, governance model, and upgrade policy only after documented evaluation -- [ ] Specify a minimal milestone-escrow state machine with release, dispute, cancellation, and refund paths -- [ ] Prototype contracts on testnet with invariant, fuzz, integration, and adversarial tests -- [ ] Require independent audits, published source, reproducible deployment, verified addresses, and version pinning -- [ ] Separate duties and require hardware-backed keys, least privilege, and multisig for privileged actions -- [ ] Add timelocked changes, capped pilots, emergency pause, recovery, monitoring, and incident runbooks -- [ ] Build human-readable signing that confirms chain, asset, amount, fees, and destination -- [ ] Never request or store wallet seed phrases or private keys -- [ ] Evaluate compliant fiat on-ramps or Stripe-backed rails separately from smart-contract custody -- [ ] Verify off-chain provider events idempotently in trusted infrastructure - -## Phase 5 — Trust and limited pilot +## Phase 5 — Security hardening and limited exercises - [ ] Add reporting, moderation, and public audit trails - [ ] Add accessibility and cross-browser end-to-end tests - [ ] Add observability, backups, rate limits, and abuse controls -- [ ] Complete legal review for custody, payments, refunds, privacy, sanctions, tax, and platform terms -- [ ] Run a capped, invite-only testnet pilot before accepting real value -- [ ] Run a separately approved limited-value pilot only after security and legal gates pass +- [ ] Complete legal and privacy review for authorized testing, disclosure, retention, accessibility, and platform terms +- [ ] Run capped, invite-only exercises with synthetic or explicitly authorized data +- [ ] Publish residual-risk decisions and rollback evidence before expanding any exercise ## Architecture and security rules 1. The browser receives only public configuration. Privileged credentials remain in trusted infrastructure. -2. Ideascape never requests, stores, proxies, logs, or transmits wallet seed phrases or private keys. -3. No single person, browser session, or operator key can release campaign funds or change contract rules. -4. Creator-submitted milestone evidence never triggers automatic release. A separate review quorum and dispute window are required. -5. Every signing flow repeats the verified chain, asset, amount, fees, destination, and intended action in human-readable form. -6. Smart contracts must be minimal, open source, independently audited, reproducibly deployed, verified on-chain, and exercised on testnet before holding value. -7. Privileged changes require multisig approval, least privilege, hardware-backed keys, public notice, and a timelock. -8. Emergency controls must block unsafe new actions while preserving documented release, withdrawal, or refund paths. -9. Smart contracts do not replace identity, moderation, real-world evidence review, dispute handling, or legal responsibility. -10. Every exposed Supabase table has explicit row-level-security policies, and database changes are reviewed migrations. -11. Stripe or other fiat-provider webhooks run only in trusted infrastructure and are verified and processed idempotently. -12. Funding language and flows remain unavailable until security, governance, legal, and pilot gates are satisfied. +2. Every security brief names a concrete threat scenario, a bounded control surface, and reproducible proof requirements. +3. Individual review intent, validation answers, and application details remain private; public routes expose aggregates only. +4. A validation signal grants no access, collection permission, deployment authority, or operational commitment. +5. Exercises use synthetic or explicitly authorized data and document exclusions, stop conditions, and rollback paths. +6. Privileged changes require least privilege, independent review, auditable approval, and documented recovery. +7. Emergency controls must block unsafe new actions while preserving evidence and a tested recovery path. +8. Security controls do not replace identity, moderation, real-world evidence review, disclosure handling, or legal responsibility. +9. Every exposed Supabase table has explicit row-level-security policies, and database changes are reviewed migrations. +10. Expansion requires a recorded residual-risk decision supported by independent evidence. diff --git a/README.md b/README.md index a89a81c..97e7986 100644 --- a/README.md +++ b/README.md @@ -1,11 +1,11 @@ # Ideascape -Ideascape is an exploration-mode concept-validation platform for learning which community ideas resonate before anyone opens funding or launches a program. +Ideascape is a security-validation lab for pressure-testing early systems before trust, access, or deployment authority expands. -**These are concept previews, not active fundraisers.** Visitors can browse ideas and see aggregate interest without signing in. Members can privately indicate whether they would use, build, test, advise, or follow a concept, with no payment or commitment. +**These are security briefs, not deployment approvals.** Visitors can inspect threat scenarios, control boundaries, and proof standards without signing in. Authenticated accounts can privately choose one unchanged review-intent label: “I would use this,” “I would help build it,” “I could test a pilot,” “I have relevant expertise,” or “Keep me updated.” These historical values describe interest, not a security role or authorization. - [Production](https://ideascape-gamma.vercel.app) -- [Browse concept previews](https://ideascape-gamma.vercel.app/ideas) +- [Review security briefs](https://ideascape-gamma.vercel.app/ideas) ## Project headquarters @@ -16,63 +16,63 @@ Ideascape is an exploration-mode concept-validation platform for learning which ## Current product -- Public, unauthenticated idea discovery at `/ideas` and detail pages at `/ideas/:slug` -- Twenty-seven deterministic demo concepts, seeded through versioned Supabase migrations -- A visible concept-specific security focus on every demo: threat scenario, control boundary, and proof required before expansion -- Three issue-driven Colorado Springs campaigns covering plate-reader surveillance, dangerous crossings, and inaccessible transit stops -- URL-persistent text search and category filtering, including a direct permission-first technology view at `/ideas?category=technology` -- Same-category recommendations on detail pages with accessible full-card links back into the catalog +- Public, unauthenticated security-brief discovery at `/ideas` and detail pages at `/ideas/:slug` +- Twenty-seven deterministic security briefs, seeded through versioned Supabase migrations +- A complete security case on every brief: threat scenario, control boundary, and proof required before expansion +- Three issue-driven Colorado Springs security audits covering plate-reader surveillance, dangerous crossings, and inaccessible transit stops +- URL-persistent text search and security-domain filtering, including a direct software-and-systems view at `/ideas?category=technology` +- Same-domain security-brief recommendations with accessible full-card links back into the catalog - Fully clickable discovery cards with concise accessible link names and visible keyboard focus -- Public aggregate interest counts without exposing individual member signals -- Authenticated, reversible participation intent—use, build, pilot, expertise, or updates—with duplicate prevention and eligibility checks -- Focused pilot-readiness questions for six bounded concepts, with private, reversible member answers -- Creator-only aggregate response evidence that never includes member identities +- Public aggregate validation counts without exposing individual operator signals +- Authenticated, reversible review intent using the unchanged labels “I would use this,” “I would help build it,” “I could test a pilot,” “I have relevant expertise,” and “Keep me updated,” with duplicate prevention and eligibility checks +- Focused exercise-readiness questions for six bounded security briefs, with private, reversible respondent answers +- Author-only aggregate response evidence that never includes respondent identities - A public Project Time Capsule pilot plan with precommitted continue, revise, and archive thresholds -- A creator/operator-only readiness dashboard for practical signals, pilot responses, private application totals, capacity, and a threshold-based decision preview -- A private `/admin` operations dashboard for allowlisted administrators, with live aggregate member, idea, interest, validation, pilot, and application counts plus published-concept activity +- An author/operator-only readiness dashboard for validation signals, exercise responses, private application totals, capacity, and a threshold-based decision preview +- A private `/admin` operations dashboard for allowlisted administrators, with live aggregate operator, brief, validation, exercise, and application counts plus published security-brief activity - Email/password, Google, and GitHub OAuth-capable authentication with safe post-auth return paths -- Public member profiles plus owner-only profile updates -- Private creator drafts and editing at `/ideas/new` and `/ideas/:id/edit` +- Public security-operator profiles plus owner-only profile updates +- Private security-brief drafts and editing at `/ideas/new` and `/ideas/:id/edit`, including required threat, boundary, and proof fields - Persistent, system-aware light and dark themes restricted to black, white, neutral grays, and `#ff5a1f` bright orange - Route-level code splitting for non-home pages - Supabase row-level security and pgTAP coverage for profiles, ideas, media, categories, and interest signals -There is intentionally no live fundraising, checkout, custody, or payment collection. Funding research is deferred and is not part of the current landing page, catalog, or pilot-readiness mission. +Review grants no production access, deployment authority, custody, or payment. A brief advances only through explicit permission and evidence gates. ## Demo catalog -Fresh databases contain these published concept previews: +Fresh databases contain these published security briefs: -1. [The Clean Air Library](https://ideascape-gamma.vercel.app/ideas/clean-air-library) -2. [Repair Commons on Wheels](https://ideascape-gamma.vercel.app/ideas/repair-commons) -3. [Neighbor Ride Credits](https://ideascape-gamma.vercel.app/ideas/neighbor-ride-credits) -4. [After-Dark Storefronts](https://ideascape-gamma.vercel.app/ideas/after-dark-storefronts) -5. [Shade Every Mountain Metro Stop](https://ideascape-gamma.vercel.app/ideas/shade-stop-network) -6. [Skill Swap Saturdays](https://ideascape-gamma.vercel.app/ideas/skill-swap-saturdays) -7. [Cross Academy Alive](https://ideascape-gamma.vercel.app/ideas/civic-accessibility-lab) -8. [Block-Ready Kits](https://ideascape-gamma.vercel.app/ideas/block-ready-kits) +1. [Smoke Readiness Control Drill](https://ideascape-gamma.vercel.app/ideas/clean-air-library) +2. [Authorized Repair Safety Clinic](https://ideascape-gamma.vercel.app/ideas/repair-commons) +3. [Essential Trip Privacy Relay](https://ideascape-gamma.vercel.app/ideas/neighbor-ride-credits) +4. [After-Dark Installation Safety Review](https://ideascape-gamma.vercel.app/ideas/after-dark-storefronts) +5. [Transit Stop Hazard Audit](https://ideascape-gamma.vercel.app/ideas/shade-stop-network) +6. [Repair Procedure Safety Drill](https://ideascape-gamma.vercel.app/ideas/skill-swap-saturdays) +7. [Crossing Safety Evidence Audit](https://ideascape-gamma.vercel.app/ideas/civic-accessibility-lab) +8. [Outage Kit Integrity Drill](https://ideascape-gamma.vercel.app/ideas/block-ready-kits) 9. [Device Liberation Lab](https://ideascape-gamma.vercel.app/ideas/device-liberation-lab) -10. [File Rescue Cooperative](https://ideascape-gamma.vercel.app/ideas/file-rescue-cooperative) +10. [File Recovery Integrity Clinic](https://ideascape-gamma.vercel.app/ideas/file-rescue-cooperative) 11. [Cloud Exit Toolkit](https://ideascape-gamma.vercel.app/ideas/cloud-exit-toolkit) 12. [Private AI Workbench](https://ideascape-gamma.vercel.app/ideas/private-ai-workbench) 13. [Home Lab Defense Clinic](https://ideascape-gamma.vercel.app/ideas/home-lab-defense-clinic) -14. [Community Compute Cooperative](https://ideascape-gamma.vercel.app/ideas/community-compute-cooperative) +14. [Secure Compute Isolation Lab](https://ideascape-gamma.vercel.app/ideas/community-compute-cooperative) 15. [Offline Mesh Field Kit](https://ideascape-gamma.vercel.app/ideas/offline-mesh-field-kit) 16. [Open Repair Atlas](https://ideascape-gamma.vercel.app/ideas/open-repair-atlas) 17. [Accessible Interface Retrofit Lab](https://ideascape-gamma.vercel.app/ideas/accessible-interface-retrofit-lab) 18. [Project Time Capsule](https://ideascape-gamma.vercel.app/ideas/project-time-capsule) -19. [Waste Heat Works](https://ideascape-gamma.vercel.app/ideas/waste-heat-works) -20. [Model Commons Lab](https://ideascape-gamma.vercel.app/ideas/model-commons-lab) -21. [Flock Off Colorado Springs](https://ideascape-gamma.vercel.app/ideas/glass-box-sensor-network) +19. [Compute Heat Fail-Safe Lab](https://ideascape-gamma.vercel.app/ideas/waste-heat-works) +20. [Model Evaluation Integrity Lab](https://ideascape-gamma.vercel.app/ideas/model-commons-lab) +21. [Plate Reader Privacy Audit](https://ideascape-gamma.vercel.app/ideas/glass-box-sensor-network) 22. [Oral History Provenance Lab](https://ideascape-gamma.vercel.app/ideas/oral-history-provenance-lab) -23. [Neighborhood Incident Relay](https://ideascape-gamma.vercel.app/ideas/neighborhood-incident-relay) +23. [Private Incident Triage Relay](https://ideascape-gamma.vercel.app/ideas/neighborhood-incident-relay) 24. [Phishing Drill Library](https://ideascape-gamma.vercel.app/ideas/phishing-drill-library) 25. [Water Sensor Integrity Watch](https://ideascape-gamma.vercel.app/ideas/water-sensor-integrity-watch) 26. [Clinic Device Privacy Check](https://ideascape-gamma.vercel.app/ideas/clinic-device-privacy-check) 27. [Software Supply Chain Clinic](https://ideascape-gamma.vercel.app/ideas/software-supply-chain-clinic) -Each concept uses a stable UUID and slug, polished multi-paragraph copy, and a locally hosted SVG illustration so local resets and production verification remain reproducible. Every demo uses the same permission-first discipline: it names a concrete threat scenario, an authorization, privacy, safety, provenance, or fail-safe control boundary, and measurable proof required before the concept earns a larger test. The earliest five broad previews define bounded first tests, required permissions, privacy limits, measurable continuation evidence, and explicit stop conditions instead of assuming that backing or an operating program already exists. Those five concepts and Project Time Capsule also ask one focused, private-answer validation question so practical demand, permissions, and pilot capability can be evaluated as aggregate evidence rather than public member activity. Three previously generic previews are now sharp Colorado Springs campaigns: challenge the plate-reader dragnet through public records and lawful organizing, force a dangerous Academy Boulevard crossing into the engineering record, and turn Mountain Metro's own accessibility findings into five concrete stop fixes. +Each brief uses a stable UUID and slug, locally hosted artwork, and a permission-first security case. Every record names a concrete threat scenario, an authorization, privacy, safety, provenance, or fail-safe control boundary, and measurable proof required before a larger exercise. Focused private-answer review questions turn operator intent into aggregate evidence without exposing identities. Colorado Springs briefs cover plate-reader privacy, crossing safety evidence, and transit-stop hazards through lawful, reproducible security review. ## Stack @@ -145,25 +145,25 @@ Ideascape validates requested return destinations as safe internal paths before ## Data and privacy model -The database models categories, creator-owned ideas, ordered media, explicit lifecycle states, and private per-member interest signals. +The database models security domains, author-owned briefs, ordered media, explicit lifecycle states, and private per-account validation signals. Legacy table and column names remain stable compatibility identifiers. -- Published ideas and their media are publicly readable. -- Draft ideas and draft media are visible only to their creator. -- Interest writes require authentication and are unique per member and idea. -- Members can privately set or change how they would participate, then remove their signal at any time. -- Members can read, add, update, or remove only their own interest row. -- Anonymous and authenticated visitors receive counts through aggregate-only database functions; individual signals and participation intent are never exposed publicly. -- Active validation questions and constrained answer choices are public, while each member's response row is private and reversible. -- Concept creators receive option totals through a creator-scoped aggregate function; raw respondent identities are never returned. -- Concept creators and trusted pilot operators receive aggregate readiness counts and a deterministic threshold preview; applicant and respondent identities are never returned by the dashboard function. -- Draft and cancelled ideas reject interest writes. -- Public profiles are readable by everyone, while authenticated members can update only their own profile fields. +- Published security briefs and their media are publicly readable. +- Draft security briefs and draft media are visible only to their author. +- Validation-signal writes require authentication and are unique per account and brief. +- Accounts can privately set or change review intent, then remove the signal at any time. +- Accounts can read, add, update, or remove only their own validation-signal row. +- Anonymous and authenticated visitors receive counts through aggregate-only database functions; individual signals and review intent are never exposed publicly. +- Active security-review questions and constrained answer choices are public, while each respondent row is private and reversible. +- Security brief authors receive option totals through an author-scoped aggregate function; raw respondent identities are never returned. +- Security brief authors and trusted exercise operators receive aggregate readiness counts and a deterministic threshold preview; applicant and respondent identities are never returned by the dashboard function. +- Draft and cancelled briefs reject validation-signal writes. +- Public operator profiles are readable by everyone, while authenticated accounts can update only their own profile fields. ## Landing-page product story -The landing page presents Ideascape as a public workshop for early ideas rather than a transaction product. It introduces all six catalog categories, explains the concept-validation flow, offers concrete ways to participate, and asks four proof questions before any idea expands: whose problem it is, what the smallest useful test is, what must stay protected, and what evidence would change the plan. +The landing page presents Ideascape as a security-validation lab. It introduces six security domains, explains the threat-to-evidence flow, offers concrete ways to challenge a brief, and asks four proof questions before any control advances: what can fail, what authority is excluded, how the control fails safely, and what evidence earns trust. -The current experience accepts no payments or fundraising. Interest is a reversible signal, not a purchase, vote, or permission grant. Deferred funding research remains isolated in `PLAN.md` and requires a separate consequential product decision before implementation. +The current experience accepts no payments and grants no operational authority. Validation intent is a reversible signal, not a vote, approval, or permission grant. ## Quality checks @@ -176,6 +176,7 @@ npm run test:e2e # Playwright suite npm run supabase:reset npx supabase test db supabase/tests/database --local npx supabase db lint --local --level warning +psql 'postgresql://postgres:postgres@127.0.0.1:54322/postgres' -v ON_ERROR_STOP=1 -f supabase/verification/security-positioning-upgrade.test.sql ``` Database work is complete only after a clean migration reset, the full pgTAP suite, and warning-level schema lint pass. @@ -194,10 +195,11 @@ src/ │ └── theme/ # Persistent light/dark theme support ├── lib/ # Environment, Supabase client, and shared utilities └── test/ # Test setup and shared helpers -public/images/ideas/ # Locally hosted concept illustrations +public/images/ideas/ # Locally hosted security-brief illustrations supabase/ ├── migrations/ # Ordered schema, policy, RPC, and demo-data changes -└── tests/database/ # pgTAP schema, RLS, aggregate, and seed contracts +├── tests/database/ # pgTAP schema, RLS, aggregate, and seed contracts +└── verification/ # Transactional migration-upgrade and private-data preservation checks ``` See [PLAN.md](./PLAN.md) for the broader product sequence and [docs/PROJECT_STATUS.md](./docs/PROJECT_STATUS.md) for the current operating view. diff --git a/docs/PROJECT_STATUS.md b/docs/PROJECT_STATUS.md index ebec6b0..4113dc8 100644 --- a/docs/PROJECT_STATUS.md +++ b/docs/PROJECT_STATUS.md @@ -5,7 +5,7 @@ This page is the public engineering headquarters for Ideascape. GitHub Issues ar ## Links - [Production](https://ideascape-gamma.vercel.app) -- [Concept previews](https://ideascape-gamma.vercel.app/ideas) +- [Security briefs](https://ideascape-gamma.vercel.app/ideas) - [Repository](https://github.com/Bots/ideascape) - [Open issues](https://github.com/Bots/ideascape/issues) - [Milestones](https://github.com/Bots/ideascape/milestones) @@ -15,15 +15,15 @@ This page is the public engineering headquarters for Ideascape. GitHub Issues ar ## Product mode -Ideascape is in **Exploration mode**. The twenty-seven published entries are concept previews, not active fundraisers or operating programs. Public aggregate interest helps test whether people want a place like this before funding is introduced. Members can privately distinguish whether they would use, build, test, advise, or follow a concept. Signaling interest involves no payment or commitment. +Ideascape is in **Security review mode**. Twenty-seven published briefs expose a threat scenario, control boundary, and proof standard before any system can advance. Public aggregate counts show review depth without exposing individual intent. Private signals retain their original labels and meanings: “I would use this,” “I would help build it,” “I could test a pilot,” “I have relevant expertise,” and “Keep me updated.” A signal describes interest, not a security role, and grants no production access, deployment authority, payment, or commitment. ## Current focus -1. Learn which concepts produce practical participation intent, not only passive curiosity, while testing each one inside a published security case. -2. Use focused private-answer questions across six bounded concepts to test practical demand, permissions, and pilot capability through aggregate evidence. -3. Use the Project Time Capsule readiness dashboard to compare aggregate evidence with the published continue, revise, and archive thresholds. -4. Use the private operations dashboard to watch aggregate membership, concepts, validation, pilot intake, and published-concept activity without opening respondent-level records. -5. Complete the first capped Project Time Capsule intake UI, then add operating guidance and measurable rebuild outcomes without introducing payments or custody. +1. Strengthen each security brief through scoped adversarial review rather than popularity. +2. Use focused private-answer questions across six bounded briefs to test authorization, control ownership, and exercise capability through aggregate evidence. +3. Compare Project Time Capsule evidence with precommitted continue, revise, and archive thresholds. +4. Use private operations aggregates to monitor security review depth without opening respondent-level records. +5. Complete the first capped Project Time Capsule exercise intake, then publish measurable rebuild and recovery outcomes without introducing payments or custody. ## Delivered @@ -33,23 +33,23 @@ Ideascape is in **Exploration mode**. The twenty-seven published entries are con - Supabase authentication with email, Google, and GitHub-capable OAuth flows - Safe internal return paths across email authentication, OAuth, and callback failures - Public profiles with owner-only updates -- Idea, category, media, lifecycle, and private interest-signal schema -- Private draft creation and editing -- Public idea discovery and detail routes with twenty-seven deterministic demo concepts, including nineteen permission-first or security-forward previews -- Visible catalog security focuses and detail-page security cases connecting all twenty-seven demos to a concrete threat scenario, control boundary, and proof requirement -- Three localized Colorado Springs campaigns with explicit demands, public-record evidence, permitted field tests, and anti-tampering boundaries -- Five early previews refined into bounded, permissioned tests with measurable continue, revise, and stop evidence -- Shareable, URL-persistent discovery search and category filters with useful zero-result recovery -- Same-category recommendations that connect detail pages to related concept previews and filtered discovery +- Security-brief, domain, media, lifecycle, and private validation-signal schema +- Private security-brief creation and editing with required threat, boundary, and proof fields +- Public discovery and detail routes with twenty-seven deterministic security briefs +- Visible catalog security focuses and detail-page security cases connecting all twenty-seven briefs to a concrete threat scenario, control boundary, and proof requirement +- Three localized Colorado Springs security audits with public-record evidence, permitted field tests, and anti-tampering boundaries +- Five early records refined into bounded, permissioned tests with measurable continue, revise, and stop evidence +- Shareable, URL-persistent discovery search and security-domain filters with useful zero-result recovery +- Same-domain recommendations that connect detail pages to related security briefs and filtered discovery - Fully clickable, keyboard-focusable discovery cards -- Local SVG concept illustrations with meaningful alternative text -- Reversible member participation intent—use, build, pilot, expertise, or updates—with aggregate-only public counts -- Focused pilot questions across six bounded concepts with private, reversible answers and creator-only aggregate evidence +- Local SVG security-brief illustrations with meaningful alternative text +- Reversible private validation intent with the unchanged labels “I would use this,” “I would help build it,” “I could test a pilot,” “I have relevant expertise,” and “Keep me updated,” with aggregate-only public counts +- Focused exercise questions across six bounded security briefs with private, reversible answers and author-only aggregate evidence - Public Project Time Capsule pilot plan with a fixed evidence window, capacity, safety boundaries, and precommitted decision thresholds -- Creator/operator-only aggregate readiness dashboard with practical-signal, participant, suitable-project, application, and remaining-capacity evidence -- Database-authorized `/admin` operations dashboard with live aggregate counts, published-concept activity, explicit unauthorized and error states, and no respondent, draft, or application-detail access +- Author/operator-only aggregate readiness dashboard with validation-signal, respondent, suitable-test, application, and remaining-capacity evidence +- Database-authorized `/admin` operations dashboard with live aggregate counts, published security-brief activity, explicit unauthorized and error states, and no respondent, draft, or application-detail access - Deterministic pending, continue, revise, or archive previews without exposing respondent or applicant identities -- Technology-forward landing showcase plus clear separation between the live validation flow and hypothetical future funding concepts +- Security-first landing showcase with six attack-surface domains and a ten-stage threat-to-evidence path - Row-level-security and pgTAP coverage for ownership, privacy, lifecycle, and seed behavior - Vercel SPA deep-link routing and production deployment @@ -57,7 +57,7 @@ Ideascape is in **Exploration mode**. The twenty-seven published entries are con | Environment | URL / reference | Purpose | | --- | --- | --- | -| Production | https://ideascape-gamma.vercel.app | Public concept-validation application | +| Production | https://ideascape-gamma.vercel.app | Public security-validation application | | Supabase | `icvscetnellunorarhvt` | Hosted authentication and Postgres | | Repository | `Bots/ideascape` | Source, issues, reviews, and CI | | Local app | Vite-assigned localhost URL | Frontend development | @@ -70,11 +70,11 @@ Ideascape is in **Exploration mode**. The twenty-seven published entries are con - Every behavior change starts with a focused failing test. - Database changes require reviewed migrations, explicit RLS, pgTAP tests, and schema lint. - Privileged credentials never run in browser code. -- Individual interest rows and participation intent remain private; public pages receive aggregate counts only. -- Individual validation answers remain private; concept creators receive option totals without member identities. -- Private pilot dashboards expose aggregate counts only to the concept creator or a trusted operator; ordinary members receive no dashboard row. +- Individual validation-signal rows and review intent remain private; public pages receive aggregate counts only. +- Individual validation answers remain private; security brief authors receive option totals without respondent identities. +- Private exercise dashboards expose aggregate counts only to the security brief author or a trusted operator; unauthorized accounts receive no dashboard row. - Administrator access is enforced by a private database allowlist or trusted operator claim; the admin dashboard receives aggregate RPC results rather than direct table access. -- No product copy may imply payment, commitment, active fundraising, or an operating program while Ideascape remains in exploration mode. +- No product copy may imply that a validation signal authorizes access, data collection, deployment, payment, or an operating program. - Commit verified milestones incrementally. ## Definition of done diff --git a/index.html b/index.html index fec5f01..40e30c4 100644 --- a/index.html +++ b/index.html @@ -5,7 +5,7 @@ - Ideascape — Test the possibility + Ideascape — Security validation fieldwork
diff --git a/src/App.test.tsx b/src/App.test.tsx index c4cc325..06ad69d 100644 --- a/src/App.test.tsx +++ b/src/App.test.tsx @@ -69,21 +69,21 @@ describe("App", () => { expect( screen.getByRole("heading", { - name: /great ideas deserve a place to grow/i, + name: /pressure-test security before it ships/i, }), ).toBeInTheDocument(); expect( - screen.getByText(/public workshop for early ideas/i), + screen.getByText(/security validation lab for early systems/i), ).toBeInTheDocument(); - expect(screen.getByText("Test the possibility")).toBeInTheDocument(); + expect(screen.getByText("Threats before trust")).toBeInTheDocument(); expect( - screen.getByText("Practical ideas, clearer next steps"), + screen.getByText("Threats mapped. Controls bounded."), ).toBeInTheDocument(); expect( - screen.getByText(/public interest and practical feedback/i), + screen.getByText(/state what is authorized, excluded/i), ).toBeInTheDocument(); expect( - screen.getByText(/assumptions, permissions, boundaries/i), + screen.getByText(/precommit tests, stop conditions/i), ).toBeInTheDocument(); expect(screen.getByRole("link", { name: /sign in/i })).toHaveAttribute( "href", @@ -95,35 +95,37 @@ describe("App", () => { ); expect( screen - .getAllByRole("link", { name: /start an idea/i }) + .getAllByRole("link", { name: /draft a security brief/i }) .some((link) => link.getAttribute("href") === "/ideas/new"), ).toBe(true); expect( - screen.getByRole("link", { name: /explore ideas/i }), - ).toHaveAttribute("href", "/ideas"); + screen + .getAllByRole("link", { name: /review security briefs/i }) + .every((link) => link.getAttribute("href") === "/ideas"), + ).toBe(true); const explorationNote = screen.getByRole("note", { - name: /exploration mode/i, + name: /security review mode/i, }); expect(explorationNote).toHaveTextContent( - /testing whether people want a place like this/i, + /security briefs, not deployment approvals/i, ); expect( screen - .getAllByRole("link", { name: /join the experiment/i }) + .getAllByRole("link", { name: /join the security review/i }) .every((link) => link.getAttribute("href") === "/sign-up"), ).toBe(true); - expect(screen.getByText("Concept previews")).toBeInTheDocument(); + expect(screen.getByText("Security briefs")).toBeInTheDocument(); expect( - screen.getByText("Concept previews").nextElementSibling, + screen.getByText("Security briefs").nextElementSibling, ).toHaveTextContent("27"); expect( screen.getByText( - /every preview names a threat scenario, control boundary, and proof required/i, + /every brief names a threat scenario, control boundary, and proof required/i, ), ).toBeInTheDocument(); }); - it("hides the join-the-experiment action from signed-in members", () => { + it("hides the join-security-review action from signed-in operators", () => { vi.mocked(useAuth).mockReturnValue({ user: { id: "55555555-5555-4555-8555-555555555555", @@ -135,60 +137,62 @@ describe("App", () => { renderApp(); expect( - screen.queryByRole("link", { name: /join the experiment/i }), + screen.queryByRole("link", { name: /join the security review/i }), ).not.toBeInTheDocument(); }); - it("spotlights a mix of practical community ideas", () => { + it("spotlights concrete security controls", () => { renderApp(); expect( - screen.getByRole("link", { name: /browse by category/i }), + screen.getByRole("link", { name: /browse security domains/i }), ).toHaveAttribute("href", "#idea-terrain-heading"); expect( screen.getByRole("img", { - name: /library room with portable air cleaners/i, + name: /verifies signed dependencies/i, }), ).toBeInTheDocument(); expect( screen.getByRole("img", { - name: /storefront becomes an evening gallery/i, + name: /contained phishing drill/i, }), ).toBeInTheDocument(); expect( - screen.getByText(/practical ideas, clearer next steps/i), + screen.getByText(/threats mapped. controls bounded/i), ).toBeInTheDocument(); expect( - screen.getByText(/cleaner air, safer streets, shared repair/i), + screen.getByText(/software, infrastructure, identity, human-risk/i), ).toBeInTheDocument(); }); - it("presents broad community use cases without crypto-first framing", () => { + it("presents six security domains without transaction framing", () => { renderApp(); const main = screen.getByRole("main"); expect( - within(main).getByRole("heading", { name: /ideas for everyday life/i }), + within(main).getByRole("heading", { + name: /security domains under review/i, + }), ).toBeInTheDocument(); expect( - within(main).getByRole("heading", { name: /ways to take part/i }), + within(main).getByRole("heading", { name: /ways to challenge a brief/i }), ).toBeInTheDocument(); expect( within(main).getByRole("heading", { name: /proof before scale/i }), ).toBeInTheDocument(); for (const category of [ - "Arts & Culture", - "Community", - "Education", - "Environment", - "Health", - "Technology", + "Provenance & Authenticity", + "Resilience & Response", + "Human Risk", + "Infrastructure Integrity", + "Privacy & Safety", + "Software & Systems", ]) { expect( within(main).getByRole("heading", { name: category }), ).toBeInTheDocument(); } - expect(main).toHaveTextContent(/no payments or fundraising/i); + expect(main).toHaveTextContent(/never grants production access/i); expect(main).not.toHaveTextContent( /smart.contract|crypto wallet|multisig|on.chain|seed phrase|funding rail/i, ); @@ -198,7 +202,7 @@ describe("App", () => { renderApp(); const howItWorks = screen.getByRole("region", { - name: /how ideascape works/i, + name: /the security validation path/i, }); const timelineItems = within(howItWorks).getAllByRole("article"); expect(timelineItems).toHaveLength(10); @@ -212,11 +216,11 @@ describe("App", () => { expect(item).toHaveClass("xl:[&:nth-child(5n)]:border-r-0"); } for (const nextStep of [ - "Shape the concept", + "Frame the system", "Map the threat scenario", "Set the control boundary", - "Test public interest", - "Turn signals into evidence", + "Publish the security brief", + "Collect validation signals", "Design a bounded pilot", "Challenge the security case", "Publish what happened", @@ -227,26 +231,26 @@ describe("App", () => { within(howItWorks).getByRole("heading", { name: nextStep }), ).toBeInTheDocument(); } - expect(howItWorks).toHaveTextContent(/no payment or commitment/i); + expect(howItWorks).toHaveTextContent(/deployment authority/i); expect( within(howItWorks).getByRole("link", { - name: /explore the live experiment/i, + name: /review the security catalog/i, }), ).toHaveAttribute("href", "/ideas"); }); - it("shows concrete participation paths without implying transactions", () => { + it("shows concrete security-review paths without implying authority", () => { renderApp(); const participation = screen.getByRole("region", { - name: /ways to take part/i, + name: /ways to challenge a brief/i, }); - expect(participation).toHaveTextContent(/current invitation/i); - expect(participation).toHaveTextContent(/no payments or fundraising/i); + expect(participation).toHaveTextContent(/current security review/i); + expect(participation).toHaveTextContent(/never grants production access/i); for (const path of [ - "Bring a question", - "Signal what matters", - "Add grounded context", + "Submit a system", + "Challenge a control", + "Contribute evidence", ]) { expect( within(participation).getByRole("heading", { name: path }), @@ -260,20 +264,22 @@ describe("App", () => { const proof = screen.getByRole("region", { name: /proof before scale/i, }); - expect(proof).toHaveTextContent(/interest is a starting signal/i); + expect(proof).toHaveTextContent( + /validation signal is not permission to deploy/i, + ); for (const question of [ - "Whose problem is this?", - "What is the smallest useful test?", - "What must stay protected?", - "What result changes the plan?", + "What can fail or be abused?", + "What authority is excluded?", + "How does the control fail safely?", + "What evidence earns trust?", ]) { expect( within(proof).getByRole("heading", { name: question }), ).toBeInTheDocument(); } - expect(proof).toHaveTextContent(/nothing graduates automatically/i); + expect(proof).toHaveTextContent(/nothing advances automatically/i); expect(proof).toHaveTextContent( - /never grants permission to use private data, property, accounts, or community identity/i, + /never grants permission to use private data, property, accounts, or production systems/i, ); }); diff --git a/src/App.tsx b/src/App.tsx index 327866d..babfc3b 100644 --- a/src/App.tsx +++ b/src/App.tsx @@ -69,21 +69,21 @@ const PilotPage = lazy(() => const principles = [ { icon: Lightbulb, - title: "Ideas worth testing", + title: "Threats made explicit", description: - "Turn an early thought into a clear concept that other people can understand, question, and improve.", + "Define the asset, actor, abuse path, and consequence before proposing a control.", }, { icon: Users, - title: "People-powered learning", + title: "Controls with boundaries", description: - "Use public interest and practical feedback to learn who cares, what is missing, and what deserves a first test.", + "State what is authorized, excluded, access-scoped, reversible, and owned.", }, { icon: ShieldCheck, - title: "Transparent by design", + title: "Proof over confidence", description: - "Keep assumptions, permissions, boundaries, evidence, and updates visible from the first draft through any future pilot.", + "Precommit tests, stop conditions, independent checks, and residual risk before trust is earned.", }, ]; @@ -91,44 +91,44 @@ const validationSteps = [ { icon: Lightbulb, number: "01", - title: "Shape the concept", + title: "Frame the system", description: - "Start with a private draft that explains who the idea helps, what it would change, and how a first experiment could be measured.", + "Start with a private security brief that names the system, assets, operators, dependencies, and authority model.", }, { icon: ShieldAlert, number: "02", title: "Map the threat scenario", description: - "Name who or what could be harmed, how the concept could fail or be abused, and which assumptions deserve the hardest questions.", + "Name who or what could be harmed, how the system could fail or be abused, and which assumptions deserve the hardest questions.", }, { icon: LockKeyhole, number: "03", title: "Set the control boundary", description: - "Define consent, access, data, safety, ownership, rollback, and stop conditions before asking anyone to trust a public preview.", + "Define consent, access, data, safety, ownership, rollback, and stop conditions before asking anyone to trust the control.", }, { icon: Users, number: "04", - title: "Test public interest", + title: "Publish the security brief", description: - "Publish a concept preview so people can explore it and signal interest. There is no payment or commitment at this stage.", + "Expose the threat scenario, control boundary, and proof standard for scoped review without granting access or deployment authority.", }, { icon: ShieldCheck, number: "05", - title: "Turn signals into evidence", + title: "Collect validation signals", description: - "Use aggregate demand—not private member activity—to decide whether to refine, pause, or prepare a small, permission-based pilot.", + "Use private reviewer intent and public aggregates to decide whether the security case deserves a bounded exercise.", }, { icon: Wrench, number: "06", title: "Design a bounded pilot", description: - "Define the participants, permissions, safeguards, measures, and stop conditions before testing the idea in the real world.", + "Define authorized participants, isolated assets, safeguards, measures, rollback, and stop conditions before any live exercise.", }, { icon: ShieldAlert, @@ -142,14 +142,14 @@ const validationSteps = [ number: "08", title: "Publish what happened", description: - "Share outcomes, limits, surprises, and participant feedback without exposing private member activity or sensitive data.", + "Share outcomes, limits, control failures, and residual risk without exposing reviewer activity or sensitive data.", }, { icon: RefreshCw, number: "09", title: "Choose, repeat, or stop", description: - "Use the evidence to refine one meaningful assumption, repeat within the same boundary, pause, or close the concept without automatic promotion.", + "Use the evidence to refine one control, repeat inside the same authority boundary, pause, or close the brief without automatic promotion.", }, { icon: Archive, @@ -163,44 +163,44 @@ const validationSteps = [ const ideaTerrains = [ { icon: Palette, - title: "Arts & Culture", + title: "Provenance & Authenticity", description: - "Creative uses for overlooked spaces, shared stories, and neighborhood events.", + "Source integrity, consent, authenticity, and controlled reuse.", href: "/ideas?category=arts-culture", }, { icon: Users, - title: "Community", + title: "Resilience & Response", description: - "Practical ways for neighbors to move, prepare, connect, and care for a place.", + "Private reporting, bounded authority, tested fallback, and incident recovery.", href: "/ideas?category=community", }, { icon: GraduationCap, - title: "Education", + title: "Human Risk", description: - "Hands-on learning, skill sharing, and tools that make knowledge easier to keep.", + "Adversarial training without credential capture, shame, or hidden surveillance.", href: "/ideas?category=education", }, { icon: Leaf, - title: "Environment", + title: "Infrastructure Integrity", description: - "Repair, reuse, cleaner infrastructure, and measurable local resilience.", + "Fail-safe controls for sensors, utilities, repair, and physical systems.", href: "/ideas?category=environment", }, { icon: HeartPulse, - title: "Health", + title: "Privacy & Safety", description: - "Accessible, preventive ideas shaped around consent and everyday wellbeing.", + "Privacy-preserving controls for health, accessibility, and environmental safety.", href: "/ideas?category=health", }, { icon: Cpu, - title: "Technology", + title: "Software & Systems", description: - "Useful systems that respect ownership, privacy, safety, and human control.", + "Supply chains, devices, recovery, compute, and model operations.", href: "/ideas?category=technology", }, ]; @@ -208,26 +208,26 @@ const ideaTerrains = [ const participationPaths = [ { icon: Lightbulb, - title: "Bring a question", + title: "Submit a system", description: - "Draft a problem worth understanding. You do not need a finished plan, a pitch deck, or an organization behind you.", - action: "Start an idea", + "Draft the assets, trust boundaries, abuse paths, and authority assumptions that need review.", + action: "Draft a security brief", href: "/ideas/new", }, { icon: HeartHandshake, - title: "Signal what matters", + title: "Challenge a control", description: - "Explore concept previews and save the ones you would follow, use, support, or help test.", - action: "Explore concepts", + "Review threat models, identify bypasses, and state whether you can test or operate the control.", + action: "Review security briefs", href: "/ideas", }, { icon: BookOpen, - title: "Add grounded context", + title: "Contribute evidence", description: - "Help creators spot prior work, affected groups, practical constraints, and better ways to measure progress.", - action: "Join the experiment", + "Add standards, incident patterns, reproducible test methods, and explicit stop conditions.", + action: "Join the security review", href: "/sign-up", }, ]; @@ -235,27 +235,27 @@ const participationPaths = [ const proofQuestions = [ { number: "01", - title: "Whose problem is this?", + title: "What can fail or be abused?", description: - "Name the people affected and involve them before treating assumptions as needs.", + "Name the asset, actor, entry point, trust violation, and credible consequence.", }, { number: "02", - title: "What is the smallest useful test?", + title: "What authority is excluded?", description: - "Define a reversible first step that can teach something without pretending to be a finished program.", + "Make production access, data collection, custody, payment, and deployment authority explicit.", }, { number: "03", - title: "What must stay protected?", + title: "How does the control fail safely?", description: - "Make consent, privacy, access, ownership, safety, and stop conditions explicit before testing.", + "Define isolation, least privilege, rollback, recovery, and the condition that stops the exercise.", }, { number: "04", - title: "What result changes the plan?", + title: "What evidence earns trust?", description: - "Publish the evidence that would justify refining, expanding, pausing, or retiring the concept.", + "Precommit reproducible checks and residual-risk criteria before a control can advance.", }, ]; @@ -279,21 +279,21 @@ function HomePage() {

- Test the possibility + Threats before trust

- Great ideas deserve a place to{" "} - grow. + Pressure-test security{" "} + before it ships.

- Ideascape is a public workshop for early ideas. Creators make - their thinking clear, neighbors signal what matters, and useful - feedback shapes the next small step. + Ideascape is a security validation lab for early systems. + Operators publish a concrete threat scenario, control boundary, + and proof standard before any pilot earns trust.

- Explore cleaner air, safer streets, shared repair, practical - learning, accessible tools, local culture, and technology that - keeps people in control. + Review software, infrastructure, identity, human-risk, privacy, + and provenance briefs built to expose failure paths—not collect + applause.

- Start an idea + Draft a security brief
@@ -332,7 +332,7 @@ function HomePage() {
- Concept previews + Security briefs
27 @@ -340,7 +340,7 @@ function HomePage() {
- Categories + Security domains
6 @@ -348,10 +348,10 @@ function HomePage() {
- Momentum + Method
- Local questions. Practical first tests. + Threat. Control. Proof.
@@ -366,24 +366,26 @@ function HomePage() {
Neighbors prepare a library room with portable air cleaners
- The Clean Air Library + + Software Supply Chain Clinic + - Health + Software & Systems
A storefront becomes an evening gallery while neighbors gather outside
@@ -392,7 +394,7 @@ function HomePage() { className="size-5 text-primary" aria-hidden="true" /> - Practical ideas, clearer next steps + Threats mapped. Controls bounded.
@@ -400,25 +402,24 @@ function HomePage() {
-

A wider field of view

+

Six attack surfaces

- Ideas for everyday life + Security domains under review

- Ideascape is not built around one industry or one kind of - creator. It is a place to make a local problem legible, - compare possible approaches, and find the people who care - enough to keep learning. + Ideascape covers digital and physical systems where weak + authority boundaries, unverifiable claims, or unsafe failure + modes can create real harm.

- 27 concepts across 6 categories + 27 security briefs across 6 domains

- Every preview names a threat scenario, control boundary, and + Every brief names a threat scenario, control boundary, and proof required before a larger test.

@@ -455,16 +456,16 @@ function HomePage() {
-

From idea to evidence

+

From threat to evidence

- How Ideascape works + The security validation path

- Start with a clear question, not a polished pitch. The live - product is focused on learning what people actually want. + Start with a credible threat, not a confidence claim. Every + control advances through explicit authority and proof gates.

- Explore the live experiment + Review the security catalog
@@ -514,29 +515,28 @@ function HomePage() {

- Ways to take part + Ways to challenge a brief

- The live product is for learning together: drafting - concepts, discovering shared interest, and improving the - quality of a possible first test. There are no payments or - fundraising. + Draft a threat model, challenge a control boundary, or add + reproducible evidence. Review never grants production + access, deployment authority, payment, or custody.

@@ -556,7 +556,7 @@ function HomePage() {

{href === "/sign-up" && user ? ( - You're participating + You're reviewing ) : (

- Interest is a starting signal, not permission to expand. - Every concept should become more specific about people, - evidence, boundaries, and stop conditions as it develops. + A validation signal is not permission to deploy. Every + security brief must tighten its evidence, authority + boundary, recovery path, and stop conditions as it advances.

- A concept can stop, change direction, or remain a useful - public record. Nothing graduates automatically, and - participation never grants permission to use private data, - property, accounts, or community identity. + A security brief can stop, change direction, or remain a + useful review record. Nothing advances automatically, and + validation never grants permission to use private data, + property, accounts, or production systems.

@@ -647,13 +647,13 @@ function HomePage() {

- Built for momentum + Security operating principles

- From possibility to progress + From threat model to trusted control

diff --git a/src/components/interest-mode-notice.tsx b/src/components/interest-mode-notice.tsx index 7e9a1a9..d9d40e1 100644 --- a/src/components/interest-mode-notice.tsx +++ b/src/components/interest-mode-notice.tsx @@ -14,7 +14,7 @@ export function InterestModeNotice({ }: InterestModeNoticeProps) { return ( @@ -43,7 +44,7 @@ export function InterestModeNotice({ })} to="/sign-up" > - Join the experiment + Join the security review
) : null} @@ -201,16 +201,17 @@ export function IdeaDetailPage() {