# Ontology Studio · Cloud, sharing, health and evaluation

Preview release · October 2026. This extends the general-purpose release (PR #4, merged). Production release remains an owner decision.

## Access model (owner decisions, 11 October 2026)

- **Guest mode for everyone.** Every Studio feature works without an account; work stays in the visitor's browser.
- **Invitation only.** Cloud accounts are offered only to people RJL Solutions meets at workshops that use the Studio. There is no public sign-up: the server refuses sign-up requests and Netlify Identity must be set to *Invite only*.
- **No automatic account expiry.** The former 90-day account limit and daily account purge are removed. Legacy expiry timestamps are ignored/cleared on use, preserving existing projects. Previously ended accounts remain blocked until explicitly restored; removed projects and Identity logins are not recreated. Owners/admins can still delete cloud data and end access. Share-link expiry is independent.
- **Account reporting.** Studio administrators can view/download a roster that joins Identity invitations with cloud-account metadata: login dates, last cloud activity, current project/save dates and share counts. Guest/local-only activity and project content are excluded. The administrator-only Accounts and activity page (`#admin`) provides the report on demand, with CSV download; no report email or additional provider is used. See [the administration setup](account-reporting-release.md).
- **Real client data, limited to business meaning.** Users may store business terms, definitions, relationships, examples and document references. They must not store personal data about customers or employees, customer records, credentials or regulated data such as health or payment information. Before the first cloud save each user accepts the Studio cloud terms (version `2026-10-14`); the server refuses saves and shares until they do, and records the version and time.
- **United States storage.** Project data is held in Netlify Blobs in the `us-east-2` region (Ohio), pinned on every store call, encrypted at rest and in transit by Netlify. RJL Solutions operates the service and can technically access stored projects.
- **Deletion.** Users can delete one cloud copy (and its share links) or all of their cloud data at any time. Administrators can end an account immediately.
- **Session cookies.** In production the Secure, HttpOnly session cookies are scoped to `/ontology/studio/`, so they are not sent to the rest of rjlsol.com. Direct Netlify preview addresses use `/`.

## Return to your knowledge

Guest mode remains available. Projects stay on the browser origin where they were created until an invited user accepts the cloud terms and chooses **Cloud account → Save this project to cloud**. Signing in alone uploads nothing. Saving a chosen project includes its private accepted passages, preferences, snapshots and assessment history. Linked projects subsequently save changes while you are signed in. Guest projects are never uploaded automatically.

Cloud project reads and writes require a verified Netlify Identity account. Storage keys derive from the verified account ID on the server. Browser tokens use Secure, HttpOnly, SameSite=Lax cookies; account tokens are never returned in application JSON or stored in browser-local projects. Passwords pass to Netlify Identity over HTTPS. This code does not contain service credentials.

Each update uses its cloud revision. If another device changed it, saving stops and the local copy is retained. Open the cloud copy separately to compare, then duplicate the version you want to keep and save it as a new cloud project. Opening a cloud project with the same local ID also creates a separate local copy. A second browser tab changing the local workspace pauses local writes and cloud saves until you back up and reload. Signing out retains local projects; duplicating and restoring removes account links.

Preview storage and production storage are separate. Preview work does not migrate on deployment: download a backup and restore it deliberately in production. Browser work on localhost, Netlify and the RJL proxy also has separate local storage. Accounts use the site's Identity service across deploy contexts, while projects and shared snapshots are isolated by preview number/branch and production. Cloud saves support projects up to 4 MB; browser backup restoration supports 5 MB. An account supports 100 cloud projects and 100 share records in this initial release. Preview deployments use separate stores and are not covered by the daily purge; do not put real client data into previews.

## Share a frozen selection

Choose **Share snapshot**, select the current model or a saved model snapshot, and review the exact recipient preview. The term selection comes from **Use & export**. Draft proposals are excluded unless you deliberately include them. All hosted links exclude private imported definitions, organizational usage, raw documents, personas, reviewer names, evaluation answers and history.

The server filters the authoritative owned cloud project again. It creates a frozen read-only selection with a random 256-bit capability token and stores its hash. The link appears only when created. It grants reading to anyone who has it; it is not an invitation to edit, authenticated collaboration or an access-controlled recipient list. Links expire after 1, 7, 30 or 90 days. Owners can revoke them. Recipient downloads and printed copies cannot be revoked. Pages use no-referrer/noindex settings; search exclusion is a request, not an access control.

Review all selected public fields, including source URLs, examples and notes, before sharing. Do not add secrets to public source references or public term fields. Private-import exclusion is based on the source kind and is enforced on the server. Read-only sharing remains unavailable until the account service is enabled. The existing filtered file exports continue to work in guest mode.

## Keep meaning healthy

**Knowledge health** checks structural errors, ambiguous labels and aliases, organizational usage that differs from definitions, short definitions, missing passage locators, undated sources, source dates over 180 days old, review gaps, unconnected terms and missing scope. Inspect links take you to the relevant editor. Record **Source reviewed on** when you verify a source still applies. Age alone does not establish that evidence is obsolete, and these checks do not certify factual correctness.

## Evaluate any domain

**Evaluation questions** lets you define project-specific questions, expected answers/acceptance criteria and optional supporting terms. Enter the answer/evidence observed, a reviewer and an explicit Pass/Partial/Fail assessment. The Studio stores the question, criteria, answer, notes, model version and a frozen model with each assessment. It makes no AI call and infers no score.

Model or criteria changes flag earlier results for retesting; stale passes are excluded from the current-pass total. Missing supporting terms prevent a new assessment until the question is repaired. Download frozen assessments for review. Full project backups retain questions and assessment history. Reviewer names remain user-entered and are not authenticated governance approvals.

## Hosting setup and release checks

1. Install pinned dependencies from `pnpm-lock.yaml` using Node 24 and pnpm 10 or newer. The static UI has no frontend build step. Netlify bundles `netlify/functions/studio-api.mjs` with its Blobs and Identity dependencies.
2. Review the draft PR and its private Netlify deploy preview. No main merge is needed to inspect it.
3. Enable Netlify Identity for `rjl-ontology-studio` with the owner's approval. Set **Registration preferences** to **Invite only**. Keep email confirmation on. Do not enable Git Gateway or external login providers, change plans or turn on automatic confirmation.
4. Invite the owner's own address from the Identity tab, accept the invitation and set the password personally. Then edit that user in the Identity tab and add the role `admin`. Netlify dashboard sign-in is separate from an application account.
5. Default email links return to the project's configured site URL. Before production contains this callback code, use **Cloud account → Finish an account email link** in the preview and paste your own confirmation/recovery/invitation URL. The app extracts recognized tokens from known Studio hosts, never navigates to the pasted URL, and clears the field. Do not put account links in chat, screenshots or project backups.
6. Live acceptance with synthetic content only: invite a second test address; confirm the terms gate, save/reopen, that the second account cannot open the first account's project, a two-device revision conflict, a harmless shared snapshot as a recipient, expiry/revocation of the link, deleting a cloud copy, deleting all data, sign-out and recovery. As administrator, confirm the Accounts and activity list, report download, Restore access and Delete now. Mocked tests do not substitute for this.
7. Merge/deploy only after the owner approves the release and these live checks pass, and after the rjlsol.com privacy notice and Studio cloud terms (site PR) are reviewed and published. Validate through the RJL proxy that function requests, `Origin`, cookies (path `/ontology/studio/`) and responses pass correctly. Direct Netlify preview checks do not establish proxy compatibility.

Netlify Blobs is used for project storage; enabling Identity is still required independently. No database service or extra AI provider is configured. Check Netlify account usage/limits before a public launch. Initial records have an application quota, not metered billing enforcement; this is not an enterprise governance/retention solution. Cloud copies are hard-deleted on request, at account end and by the daily purge. There is no shared-project editing in this release.

Official implementation references: [Identity setup](https://docs.netlify.com/manage/security/secure-access-to-sites/identity/get-started/), [server authentication](https://docs.netlify.com/manage/security/secure-access-to-sites/identity/use-identity-in-functions/), [email callbacks](https://docs.netlify.com/manage/security/secure-access-to-sites/identity/identity-generated-emails/), and [Netlify Blobs](https://docs.netlify.com/build/data-and-storage/netlify-blobs/).

## Verification

Run `node --test tests/*.test.mjs`. Tests cover existing domain behavior plus invitation-only sign-up, the terms gate, continued access beyond the former expiry, explicit deletion and re-entry blocking, administrator list/report/restore/delete, report privacy, pagination and administrator-only page access, project and account deletion, Studio-scoped cookies, owner isolation, allowed origins, conditional writes, concurrent revision conflicts, private-field filtering, frozen shares, expiry/revocation, secure cookies, confirmation/recovery/invitation contracts, temporary identity failures, in-flight autosave edits, paused/conflicted tabs, health findings and frozen manual evaluations. Desktop/narrow browser checks cover guest mode and the new interface. Live two-account acceptance remains required. Identity and the owner’s admin role have been verified; refresh the owner’s Studio session and compare the live roster before release.