Release 0.3.40

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH
One access policy from content; onboarding into Kanidm as a form
2026-09-23 11:44:45 +02:00 · 2026-09-23 11:44:39 +02:00 · 2026-09-23 06:08:51 +02:00 · 2026-09-23 06:06:48 +02:00 · 2026-09-23 06:00:17 +02:00 · 2026-09-22 22:05:31 +02:00
25 changed files with 3150 additions and 1060 deletions
@@ -56,10 +56,51 @@ jobs:
      - name: Build
        run: SITE_NAME=${{ vars.PORTAL_SITE_NAME }} cargo leptos build --release

-      # cargo-leptos only builds the leptos bin-target ("portal") - the
-      # question-lint utility binary needs its own plain cargo build.
-      - name: Build question-lint
-        run: cargo build --release --bin question_lint --features ssr
+      # The lint (uhhm/iris) is versioned as portal: this step re-pins
+      # iris to the tag being released, builds and tests it against it,
+      # and pushes the matching iris tag, which iris's own CI publishes.
+      # A portal change to something the lint reads fails the release
+      # right here. Needs IRIS_PUSH_USER (a variable) and IRIS_PUSH_TOKEN
+      # (a secret) that may push to uhhm/iris; the workflow's own token
+      # is scoped to this repo. A re-run of a tag whose iris tag already
+      # exists just builds that.
+      - name: Release iris to match
+        env:
+          # The shared cargo home is read-only for the runner, and a git
+          # dependency has to be cloned into one (same as uhhm/iris's CI).
+          CARGO_HOME: /var/local/cargo-target/iris-cargo-home
+          RUSTC_WRAPPER: /usr/bin/sccache
+          IRIS_PUSH_USER: ${{ vars.IRIS_PUSH_USER }}
+          IRIS_PUSH_TOKEN: ${{ secrets.IRIS_PUSH_TOKEN }}
+        run: |
+          set -euo pipefail
+          tag="${{ github.ref_name }}"
+          ver="${tag#v}"
+          host="${{ github.server_url }}"
+          rm -rf iris-src
+          git clone -q "$host/uhhm/iris.git" iris-src
+          cd iris-src
+          if git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
+            echo "iris $tag already exists, building it"
+            git checkout -q "$tag"
+          else
+            sed -i -E "s|^(portal = \{ git = \"[^\"]+\", tag = \")[^\"]+(\")|\1$tag\2|" Cargo.toml
+            sed -i -E "0,/^version = \"[^\"]+\"/s//version = \"$ver\"/" Cargo.toml
+            cargo update -q -p portal
+            awk -v h="## $ver ($(date -u +%F)) - portal $tag" -v l="- Matches portal $tag (released by portal's publish job)." \
+              'done==0 && /^## /{print h; print ""; print l; print ""; done=1} {print}' CHANGELOG.md > CHANGELOG.new
+            mv CHANGELOG.new CHANGELOG.md
+          fi
+          cargo build --release
+          cargo test
+          if ! git rev-parse -q --verify "refs/tags/$tag" >/dev/null; then
+            git config user.name "portal release"
+            git config user.email "portal@uhhm.no"
+            git commit -qam "Match portal $tag"
+            git tag "$tag"
+            git push -q "https://${IRIS_PUSH_USER}:${IRIS_PUSH_TOKEN}@${host#https://}/uhhm/iris.git" main "$tag"
+            echo "pushed iris $tag"
+          fi

      - name: Package
        run: |
@@ -67,7 +108,7 @@ jobs:
          tag="${{ github.ref_name }}"
          stage=$(mktemp -d)
          cp "$CARGO_TARGET_DIR/release/portal" "$stage/portal"
-          cp "$CARGO_TARGET_DIR/release/question_lint" "$stage/question_lint"
+          cp "$CARGO_TARGET_DIR/release/iris" "$stage/iris"
          # hash-files = true: leptos resolves hash.txt next to the running
          # binary, so it ships beside portal in the release dir.
          cp "$CARGO_TARGET_DIR/release/hash.txt" "$stage/hash.txt"
@@ -75,7 +116,7 @@ jobs:
          # not affected by CARGO_TARGET_DIR - only the plain `cargo build`
          # outputs (release/, front/) move with that override.
          cp -r target/site "$stage/site"
-          tar -C "$stage" -czf "portal-$tag.tar.gz" portal question_lint hash.txt site
+          tar -C "$stage" -czf "portal-$tag.tar.gz" portal iris hash.txt site
          rm -rf "$stage"

      # The run's own ephemeral token has write access to this repo -
@@ -88,9 +129,9 @@ jobs:
          tag="${{ github.ref_name }}"
          api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
          auth="Authorization: token ${{ secrets.GITHUB_TOKEN }}"
-          subject=$(git log -1 --format=%s)
-          body=$(printf '{"tag_name":"%s","name":"%s"}' \
-            "$tag" "$tag: $(echo "$subject" | sed 's/"/\\"/g')")
+          # The release notes are this version's section of CHANGELOG.md.
+          notes=$(awk -v v="${tag#v}" '/^## /{p = ($2 == v)} p' CHANGELOG.md | tail -n +2)
+          body=$(jq -n --arg tag "$tag" --arg notes "$notes" '{tag_name: $tag, name: $tag, body: $notes}')
          id=$(curl -sf -X POST -H "$auth" -H 'Content-Type: application/json' \
            -d "$body" "$api/releases" | jq .id) \
            || id=$(curl -sf -H "$auth" "$api/releases/tags/$tag" | jq .id)
@@ -22,5 +22,22 @@ jobs:
    steps:
      - uses: actions/checkout@v4

+      # A throwaway JetStream for tests/jetstream.rs. Best effort: if the
+      # runner cannot use docker the variable stays unset and that one
+      # test reports itself skipped rather than failing the build.
+      - name: Start a throwaway JetStream
+        run: |
+          docker rm -f portal-test-nats >/dev/null 2>&1 || true
+          if docker run -d --rm --name portal-test-nats -p 127.0.0.1:14223:4222 nats:2.14.6-alpine -js >/dev/null 2>&1; then
+            sleep 2
+            echo "PORTAL_TEST_NATS_URL=nats://127.0.0.1:14223" >> "$GITHUB_ENV"
+          else
+            echo "::warning::no docker on this runner - the JetStream integration test will be skipped"
+          fi
+
      - name: Test
        run: cargo test --features ssr
+
+      - name: Stop the throwaway JetStream
+        if: always()
+        run: docker rm -f portal-test-nats >/dev/null 2>&1 || true
@@ -0,0 +1,292 @@
+# Changelog
+
+One line per change, grouped by the release that shipped it. Newest
+first. A release is a Cargo.toml bump plus a `v<version>` tag; the
+content repos pin the tag they run (see the end of this file).
+
+## 0.3.38 (2026-09-22)
+
+- publish: the iris build step gets a writable cargo home; the v0.3.37 tag never published
+
+## 0.3.37 (2026-09-22)
+
+- The lint moves to its own repo, uhhm/iris: `question_lint` becomes `iris check`, `needs_replay` becomes `iris replay`; the tarball ships `iris` (pinned in publish.yml) instead of `question_lint`; the needs module and local loaders leave portal
+
+## 0.3.36 (2026-09-22)
+
+- Question nav: a followup is offered only once earned - the verified chain answered the alternative leading there, or a link that records nothing leads on from an earned page. Standing on a page no longer unlocks the pages behind its forms; the chain index now records which alternative was answered
+- One bounded HTTP client for every server-side fetch: 20 s budget, size caps per kind of fetch (`src/http.rs`)
+- Uploads are refused past 20 MB while streaming, and the route body limit that had capped them at axum's 2 MB default is raised to match
+- `tests/jetstream.rs`: the store, the event log and the projection tested against a real JetStream (CI starts a throwaway one)
+- `content` split into `gitea`, `validate`, `markdown`, `handlers`; every path still `content::x`
+- This changelog, and the table of what each site runs
+- Business needs as a checkable spec: needs.yaml + question_lint pass
+- needs: `success` states and a resolved simulation model
+- needs: `stages` - every stage the business named must be a state
+- needs_replay: make simulated cases real aggregates, report buckets by state
+- needs: also_moved_by - a need carried by more than one group's desk
+
+## 0.3.35 (2026-09-12)
+
+- Item cards: no paragraph margin under the description
+
+## 0.3.34 (2026-09-11)
+
+- Question nav: offer followups by reach, not by carrying any chain
+
+## 0.3.33 (2026-09-02)
+
+- Head preloads: latin font, wordmark, content-host preconnect
+
+## 0.3.32 (2026-09-01)
+
+- Per-site favicon via site.yaml
+
+## 0.3.31 (2026-09-01)
+
+- Markdown links allow tel:
+
+## 0.3.30 (2026-09-01)
+
+- Single alt-image shows natural height
+
+## 0.3.29 (2026-09-01)
+
+- Markdown image layout hints + AVIF assets
+
+## 0.3.28 (2026-09-01)
+
+- Hero description renders inline markdown
+
+## 0.3.27 (2026-09-01)
+
+- wordmark_invert: explicit, not inferred from .svg
+
+## 0.3.26 (2026-09-01)
+
+- Select fields: inline static options
+
+## 0.3.25 (2026-09-01)
+
+- Content-shipped stylesheet override (site.yaml stylesheet)
+
+## 0.3.24 (2026-09-01)
+
+- Gateway submit-as-link loses the underline
+
+## 0.3.23 (2026-09-01)
+
+- Chrome speaks the site's language: site.yaml lang + i18n table
+
+## 0.3.22 (2026-09-01)
+
+- site.yaml wordmark_height; raster logos keep their colors
+
+## 0.3.21 (2026-09-01)
+
+- Hero paragraph centers its measure box
+
+## 0.3.20 (2026-09-01)
+
+- Sign-in becomes optional: KANIDM_URL unset disables auth cleanly
+
+## 0.3.19 (2026-09-01)
+
+- Markdown images in descriptions, gated and framed
+
+## 0.3.18 (2026-09-01)
+
+- Item cards render inline markdown descriptions
+- Convergence: ink converges onto the decoded key (WebGL glow)
+- Gesture results overlay the canvas - the page never jumps
+
+## 0.3.16 (2026-08-30)
+
+- Announce sweeper: refresh open records from content
+
+## 0.3.15 (2026-08-30)
+
+- Hidden fields: carrier value without a label row
+
+## 0.3.14 (2026-08-30)
+
+- Feature cards: icon column, one text edge
+
+## 0.3.13 (2026-08-30)
+
+- Voice field: nothing leaves the browser until Keep it here
+
+## 0.3.12 (2026-08-30)
+
+- Voice preview stays hidden until there is something to play
+
+## 0.3.11 (2026-08-30)
+
+- README: gesture and voice fields
+- Validate templated actions against the page pattern
+
+## 0.3.10 (2026-08-30)
+
+- type: voice, Requirement.value, playable resource cards
+
+## 0.3.9 (2026-08-30)
+
+- Templated actions; places are pickable in the gesture input
+
+## 0.3.8 (2026-08-30)
+
+- Descriptions are inline markdown; Feature.link withdrawn
+
+## 0.3.7 (2026-08-30)
+
+- Feature.link: a card's name may point elsewhere
+
+## 0.3.6 (2026-08-30)
+
+- Announced pages: event windows, header announcements, summary tasks
+
+## 0.3.5 (2026-08-30)
+
+- Gesture widget: stop drawing the decoded ghost path
+- Gesture widget: ghost path back, for v2 keys only
+
+## 0.3.4 (2026-08-25)
+
+- Alternative.disabled: announced but not yet takeable
+
+## 0.3.3 (2026-08-25)
+
+- Empty list says so before it can parse as zero answers
+
+## 0.3.2 (2026-08-25)
+
+- README: hashed pkg assets in the release flow
+- Resource empty text: content-declared, and null counts as empty
+
+## 0.3.1 (2026-08-25)
+
+- Content-hashed pkg assets (hash-files) so stale bundles can't pair with new wasm
+
+## 0.3.0 (2026-08-25)
+
+- Hero becomes a content-owned module; site asset proxy; gesture growth fix
+
+## 0.2.4 (2026-08-25)
+
+- Gates keep the question nav
+
+## 0.2.3 (2026-08-25)
+
+- Attended-bucket lint rule; app-lifetime resources fix first-nav corruption
+
+## 0.2.2 (2026-08-24)
+
+- One app-level Title fed by a shared site resource
+
+## 0.2.1 (2026-08-24)
+
+- Docs: routing bullet + design doc marked implemented
+- Revalidating cache on app assets; site title survives SPA navigation
+
+## 0.2.0 (2026-08-24)
+
+- Initial commit: content-driven onboarding portal
+- Load content from Gitea directly, drop the local clone; add deploy workflow
+- Share sccache between manual dev builds and CI
+- Give CI its own SCCACHE_SERVER_PORT
+- Erase view types at every list/component boundary, not just leaves
+- Redirect cargo-leptos's tool cache out of act-runner-bare's StateDirectory
+- Fix Ship release: site-root is project-relative, not CARGO_TARGET_DIR
+- Drop sudo from the deploy workflow - NoNewPrivileges blocks it outright
+- Caddy snippet: use multi-line log block
+- Fix static asset 404s and build-time SITE_NAME
+- Hot-reload content on a NATS trigger instead of requiring a restart
+- Add prosekit rich-text field, Gitea repo embeds, automation KV read endpoint; fix apex/www session-cookie mismatch on /auth/callback
+- Fix prosekit-editor.js: remove bare CSS imports that aborted the whole module
+- Redirect back to the originating page after sign-in, not always /
+- Fix hero-canvas navigation race; style the prosekit editor and add a toolbar
+- yes.js: guard against the canvas not being in the DOM yet
+- Fix get_resource/transition_answer: scope feature lookup to its own alternative
+- Add self-service transitions, authorized by item possession not group membership
+- Event-sourced applicant/subscriber/project aggregates, generalized resources
+- deploy.yml: write GITEA_API_TOKEN for the new GiteaStarred/OrgRepos resource sources
+- Cargo.toml: disambiguate bin-target for cargo-leptos
+- Add manually-triggered backfill workflow, no terminal/sudo needed
+- Trigger redeploy to pick up PORTAL_GITEA_API_TOKEN secret
+- Render generic resource lists as cards, not raw JSON dump
+- Fix recursion-limit build failure in the new item-card renderer
+- Resource-backed multi/single-select requirement
+- Add Organization aggregate (client-as-status), wired but inert
+- Fix favicon (real icon, not an unrelated orange circle) + stack encouragements with the submit button
+- Fix bucket-404 on empty resources, redesign review actions as select-then-confirm, CSS polish
+- Inline encouragements with the submit button, vertically centered
+- Use the real institutional logo for the header wordmark, not plain text
+- Use the actual UHHM-letters wordmark, not the institutional mark
+- Responsive base font size via svmin, not fixed 17px
+- Add plain-unit fallbacks for svmin/svh in case of unsupported engines
+- Size the YES canvas from its container, not window.innerHeight
+- Debounce the YES canvas resize handler and skip no-op resizes
+- Revert canvas sizing to window.innerWidth/innerHeight, gate resize on width change
+- Stop blocking native scroll on the YES canvas's touch handlers
+- Quicksand: font-display optional, not swap, to stop the text-jump on scroll
+- Use lvh/lvmin, not svh/svmin - svh was the wrong end of the viewport
+- Update style/main.css
+- Update style/main.css
+- YES canvas: size off its own container rect, not window.innerHeight
+- yes.js: freeze .hero-yes's height via inline style, don't trust svh alone
+- add responsive container width
+- deploy.yml: build and publish question_lint alongside the app binary
+- Make aggregate state graphs content-driven, not compiled Rust
+- One shared, content-labeled Confirm button per alternative instead of one per row
+- get_resource/get_requirement_options: #[server(default)] on params
+- Add optional Alternative.image and Feature.color/icon for richer layouts
+- Drop the feature list's left-padding
+- Drop question-report entirely, obfuscate the mailto link instead
+- Transition.from: state graphs deeper than one decision
+- Alternative.images: array of urls, rendered as a Swiper card deck
+- Reseed lost event history from the KV projection on transition
+- Lighten the comment load
+- Validate action targets; format timestamps client-side; clippy cleanup
+- Question nav + gateway alternatives
+- Responsible note under the title; followup pages out of the nav until a chain exists
+- README: what the engine provides
+- Feature icons: masked span painted by currentColor, not <img>
+- Responsible note: one line, same hue and size as the hero description
+- Responsible note as <small>: meta information, dimmer than the description
+- Responsible note back to the footer, above the question nav
+- Bound inputs: a field that loads its value from a sibling-parameterized resource
+- add some more width to our alternatives
+- Accent to a dusty press-cyan, a muted echo of the canvas's cyan ink
+- Editor type in rem: prosekit's px typography ignored the responsive root
+- Ban px from stylesheets: every length rem/em off the responsive root
+- No translucent input chrome: solid ink-dim placeholders and embed meta
+- Editor type scales for real: drop prosekit typography.css, fix selectors
+- Stable server fn endpoints: open tabs survive deploys
+- Drop stray local tool temp file, ignore .claude/
+- Noise-driven YES, sticky hero with frosted cards, full light theme
+- increase translucency of laternative cards
+- Showcase jq test tracks Gitea repo shape and website-first links
+- Gesture input type, redoal-relay client, gitea_releases, content-driven branding
+- Echo thumbnails fade in via timeout, not rAF
+- Trigger deploy: redoal OAuth2 credentials now configured
+- Deploy becomes publish: portal ships as a versioned release artifact
+- Semver releases cut with cargo-release; publish on v* tags only
+- Docs: release/rollout flow after the instance-ownership refactor
+- README: frame portal as a generic multi-site question engine
+- Design doc: filesystem routes, sections, dynamic segments
+- Filesystem routes, sections, dynamic segments; instant YES hero
+
+
+## What each site runs
+
+Read from the hosts on 2026-09-23; a rollout is a pin bump in the
+site's content repo (`PORTAL_RELEASE` in its `deploy.yml`), or a manual
+tarball deploy on kasse.
+
+| Site | Host | Instance | Version |
+|---|---|---|---|
+| uhhm.no | ergo | `app@uhhm-portal` | v0.3.36 |
+| redoal.com | ergo | `app@redoal-portal` | v0.3.36 |
+| westra.klingenbergbygg.no | kasse | `app@westra-portal` | v0.3.36 |
+| portal.klingenbergbygg.no | kasse | `app@klingenberg-portal` | v0.3.36 |
+| vel.klingenbergbygg.no | kasse | `app@tomtervel-portal` | v0.3.36 |
@@ -44,6 +44,15 @@ version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"

+[[package]]
+name = "ar_archive_writer"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73cd58deff2140a0a8eae87e417bd01db68a33e148aa93d1e8cd837e55e312b6"
+dependencies = [
+ "object",
+]
+
 [[package]]
 name = "arc-swap"
 version = "1.9.2"
@@ -53,6 +62,21 @@ dependencies = [
 "rustversion",
 ]

+[[package]]
+name = "arrayvec"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b62fc65de8e4e7f52534fb52b0f3ed04746ae267519eef2a83941e8085068b"
+
+[[package]]
+name = "ascii-canvas"
+version = "4.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef1e3e699d84ab1b0911a1010c5c106aa34ae89aeac103be5ce0c3859db1e891"
+dependencies = [
+ "term",
+]
+
 [[package]]
 name = "async-lock"
 version = "3.4.2"
@@ -661,6 +685,16 @@ dependencies = [
 "hybrid-array",
 ]

+[[package]]
+name = "borsh"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "553c5d846a6ba5150c65e3b1b8ec073bcf1abc20f9b7220de384a4443ea4e20a"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+]
+
 [[package]]
 name = "bs58"
 version = "0.5.1"
@@ -724,6 +758,70 @@ dependencies = [
 "shlex",
 ]

+[[package]]
+name = "cedar-policy"
+version = "4.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e4f5e46c425491b7133eecb3030d82d27301b84bfa08533c59a6902cca7eb80"
+dependencies = [
+ "cedar-policy-core",
+ "cedar-policy-formatter",
+ "itertools 0.15.0",
+ "linked-hash-map",
+ "linked_hash_set",
+ "miette",
+ "ref-cast",
+ "semver",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "smol_str",
+ "thiserror 2.0.19",
+]
+
+[[package]]
+name = "cedar-policy-core"
+version = "4.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a30d11033d59b262bbb380d8bb5dc5c3dd2dd2281675c558ef4fd8a161ce669"
+dependencies = [
+ "chrono",
+ "educe",
+ "either",
+ "itertools 0.15.0",
+ "lalrpop",
+ "lalrpop-util",
+ "linked-hash-map",
+ "linked_hash_set",
+ "miette",
+ "nonempty",
+ "ref-cast",
+ "regex",
+ "rustc-literal-escaper",
+ "serde",
+ "serde_json",
+ "serde_with",
+ "smol_str",
+ "stacker",
+ "thiserror 2.0.19",
+ "unicode-security",
+]
+
+[[package]]
+name = "cedar-policy-formatter"
+version = "4.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a2c8dc671e62597c85caa11694365b76050abcd9f2177f0520ccac0580f9a41"
+dependencies = [
+ "cedar-policy-core",
+ "itertools 0.15.0",
+ "logos",
+ "miette",
+ "pretty",
+ "regex",
+ "smol_str",
+]
+
 [[package]]
 name = "cfg-if"
 version = "1.0.4"
@@ -1229,6 +1327,18 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "educe"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e451fac8dd8dece16234604bf1efce6e90fddd8ab6ad4d66eec0eca5160959dd"
+dependencies = [
+ "enum-ordinalize",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "either"
 version = "1.17.0"
@@ -1266,6 +1376,15 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "ena"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eabffdaee24bd1bf95c5ef7cec31260444317e72ea56c4c91750e8b7ee58d5f1"
+dependencies = [
+ "log",
+]
+
 [[package]]
 name = "encoding_rs"
 version = "0.8.35"
@@ -1275,6 +1394,26 @@ dependencies = [
 "cfg-if",
 ]

+[[package]]
+name = "enum-ordinalize"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89dd01549b09589510cf0647475075d12071456586d70f5c75c98ae2a5537677"
+dependencies = [
+ "enum-ordinalize-derive",
+]
+
+[[package]]
+name = "enum-ordinalize-derive"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a65863d15a4ce2888bd2f0f543cc963d3879c3a022c8ee43f6141d479a3ac815"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -1345,6 +1484,12 @@ version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"

+[[package]]
+name = "fixedbitset"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d674e81391d1e1ab681a28d99df07927c6d4aa5b027d7da16ba32d1d21ecd99"
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
@@ -2066,6 +2211,15 @@ dependencies = [
 "either",
 ]

+[[package]]
+name = "itertools"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b4baf93f58d4425749ca49a51c50ebab072c5df6994d08fed93541c331481dc"
+dependencies = [
+ "either",
+]
+
 [[package]]
 name = "itoa"
 version = "1.0.18"
@@ -2193,6 +2347,15 @@ dependencies = [
 "wasm-bindgen",
 ]

+[[package]]
+name = "keccak"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
+dependencies = [
+ "cpufeatures 0.2.17",
+]
+
 [[package]]
 name = "konst"
 version = "0.2.20"
@@ -2208,6 +2371,38 @@ version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4933f3f57a8e9d9da04db23fb153356ecaf00cbd14aee46279c33dc80925c37"

+[[package]]
+name = "lalrpop"
+version = "0.22.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba4ebbd48ce411c1d10fb35185f5a51a7bfa3d8b24b4e330d30c9e3a34129501"
+dependencies = [
+ "ascii-canvas",
+ "bit-set",
+ "ena",
+ "itertools 0.14.0",
+ "lalrpop-util",
+ "petgraph",
+ "pico-args",
+ "regex",
+ "regex-syntax",
+ "sha3",
+ "string_cache",
+ "term",
+ "unicode-xid",
+ "walkdir",
+]
+
+[[package]]
+name = "lalrpop-util"
+version = "0.22.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5baa5e9ff84f1aefd264e6869907646538a52147a755d494517a8007fb48733"
+dependencies = [
+ "regex-automata",
+ "rustversion",
+]
+
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -2451,6 +2646,24 @@ version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"

+[[package]]
+name = "linked-hash-map"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "linked_hash_set"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "984fb35d06508d1e69fc91050cceba9c0b748f983e6739fa2c7a9237154c52c8"
+dependencies = [
+ "linked-hash-map",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
@@ -2479,6 +2692,38 @@ version = "0.4.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"

+[[package]]
+name = "logos"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb2c55a318a87600ea870ff8c2012148b44bf18b74fad48d0f835c38c7d07c5f"
+dependencies = [
+ "logos-derive",
+]
+
+[[package]]
+name = "logos-codegen"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58b3ffaa284e1350d017a57d04ada118c4583cf260c8fb01e0fe28a2e9cf8970"
+dependencies = [
+ "fnv",
+ "proc-macro2",
+ "quote",
+ "regex-automata",
+ "regex-syntax",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "logos-derive"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52d3a9855747c17eaf4383823f135220716ab49bea5fbea7dd42cc9a92f8aa31"
+dependencies = [
+ "logos-codegen",
+]
+
 [[package]]
 name = "lru"
 version = "0.16.4"
@@ -2548,6 +2793,29 @@ version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"

+[[package]]
+name = "miette"
+version = "7.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f98efec8807c63c752b5bd61f862c165c115b0a35685bdcfd9238c7aeb592b7"
+dependencies = [
+ "cfg-if",
+ "miette-derive",
+ "serde",
+ "unicode-width 0.1.14",
+]
+
+[[package]]
+name = "miette-derive"
+version = "7.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db5b29714e950dbb20d5e6f74f9dcec4edbcc1067bb7f8ed198c097b8c1a818b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "mime"
 version = "0.3.17"
@@ -2592,6 +2860,12 @@ dependencies = [
 "version_check",
 ]

+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
 [[package]]
 name = "next_tuple"
 version = "0.1.0"
@@ -2613,6 +2887,15 @@ dependencies = [
 "signatory",
 ]

+[[package]]
+name = "nonempty"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9737e026353e5cd0736f98eddae28665118eb6f6600902a7f50db585621fecb6"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "nu-ansi-term"
 version = "0.50.3"
@@ -2712,6 +2995,15 @@ dependencies = [
 "url",
 ]

+[[package]]
+name = "object"
+version = "0.39.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e5a6c098c7a3b6547378093f5cc30bc54fd361ce711e05293a5cc589562739b"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "oco_ref"
 version = "0.2.1"
@@ -2872,6 +3164,31 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"

+[[package]]
+name = "petgraph"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3672b37090dbd86368a4145bc067582552b29c27377cad4e0a306c97f9bd7772"
+dependencies = [
+ "fixedbitset",
+ "indexmap 2.14.0",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pico-args"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5be167a7af36ee22fe3115051bc51f6e6c7054c9348e28deb4f49bd6f705a315"
+
 [[package]]
 name = "pin-project"
 version = "1.1.13"
@@ -2948,7 +3265,7 @@ dependencies = [

 [[package]]
 name = "portal"
-version = "0.3.26"
+version = "0.3.40"
 dependencies = [
 "anyhow",
 "arc-swap",
@@ -2956,6 +3273,7 @@ dependencies = [
 "aws-sdk-s3",
 "axum",
 "base64 0.22.1",
+ "cedar-policy",
 "chrono",
 "console_error_panic_hook",
 "dotenvy",
@@ -3012,6 +3330,23 @@ dependencies = [
 "zerocopy",
 ]

+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "pretty"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d22152487193190344590e4f30e219cf3fe140d9e7a3fdb683d82aa2c5f4156"
+dependencies = [
+ "arrayvec",
+ "typed-arena",
+ "unicode-width 0.2.2",
+]
+
 [[package]]
 name = "prettyplease"
 version = "0.2.37"
@@ -3105,6 +3440,16 @@ dependencies = [
 "unarray",
 ]

+[[package]]
+name = "psm"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4dcd034599e63b970727f70d79e02d62390a4a84f7c6b827c27c46d5ac3fa622"
+dependencies = [
+ "ar_archive_writer",
+ "cc",
+]
+
 [[package]]
 name = "pulldown-cmark"
 version = "0.13.4"
@@ -3549,6 +3894,12 @@ version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"

+[[package]]
+name = "rustc-literal-escaper"
+version = "0.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfe6f213fb658c8fb95baabd5420393438cf5a98d707f5dd701d9197c705f71e"
+
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
@@ -3874,6 +4225,7 @@ version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
+ "indexmap 2.14.0",
 "itoa",
 "memchr",
 "serde",
@@ -4107,6 +4459,16 @@ dependencies = [
 "digest 0.11.3",
 ]

+[[package]]
+name = "sha3"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
+dependencies = [
+ "digest 0.10.7",
+ "keccak",
+]
+
 [[package]]
 name = "sharded-slab"
 version = "0.1.7"
@@ -4154,6 +4516,12 @@ dependencies = [
 "rand_core 0.6.4",
 ]

+[[package]]
+name = "siphasher"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ee5873ec9cce0195efcb7a4e9507a04cd49aec9c83d0389df45b1ef7ba2e649"
+
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -4175,6 +4543,16 @@ version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"

+[[package]]
+name = "smol_str"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4aaa7368fcf4852a4c2dd92df0cace6a71f2091ca0a23391ce7f3a31833f1523"
+dependencies = [
+ "borsh",
+ "serde_core",
+]
+
 [[package]]
 name = "socket2"
 version = "0.5.10"
@@ -4223,6 +4601,31 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"

+[[package]]
+name = "stacker"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707f49d46706bacf8a2b00d51dace3f9de527c13eec3778f570c411f89e69967"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "libc",
+ "psm",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "string_cache"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf776ba3fa74f83bf4b63c3dcbbf82173db2632ed8452cb2d891d33f459de70f"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared",
+ "precomputed-hash",
+]
+
 [[package]]
 name = "strsim"
 version = "0.11.1"
@@ -4334,6 +4737,15 @@ dependencies = [
 "windows-sys 0.61.2",
 ]

+[[package]]
+name = "term"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8c27177b12a6399ffc08b98f76f7c9a1f4fe9fc967c784c5a071fa8d93cf7e1"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "thiserror"
 version = "1.0.69"
@@ -4838,12 +5250,49 @@ version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"

+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-script"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "383ad40bb927465ec0ce7720e033cb4ca06912855fc35db31b5755d0de75b1ee"
+
+[[package]]
+name = "unicode-security"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e4ddba1535dd35ed8b61c52166b7155d7f4e4b8847cec6f48e71dc66d8b5e50"
+dependencies = [
+ "unicode-normalization",
+ "unicode-script",
+]
+
 [[package]]
 name = "unicode-segmentation"
 version = "1.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"

+[[package]]
+name = "unicode-width"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
+
+[[package]]
+name = "unicode-width"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+
 [[package]]
 name = "unicode-xid"
 version = "0.2.6"
@@ -1,6 +1,6 @@
 [package]
 name = "portal"
-version = "0.3.27"
+version = "0.3.40"
 edition = "2021"

 [lib]
@@ -38,6 +38,7 @@ uuid = { version = "1", features = ["v4", "serde"], optional = true }
 dotenvy = { version = "0.15", optional = true }
 anyhow = { version = "1", optional = true }
 futures = { version = "0.3", optional = true }
+cedar-policy = { version = "4", optional = true }
 tracing = { version = "0.1", optional = true }
 tracing-subscriber = { version = "0.3", features = ["env-filter"], optional = true }
 # jq-filter evaluation for ResourceSource's optional `jq` field
@@ -96,6 +97,7 @@ ssr = [
    "dep:dotenvy",
    "dep:anyhow",
    "dep:futures",
+    "dep:cedar-policy",
    "dep:tracing",
    "dep:tracing-subscriber",
    "dep:jaq-core",
@@ -106,9 +108,8 @@ ssr = [
 [dev-dependencies]
 proptest = "1"

-[[bin]]
-name = "question_lint"
-path = "src/bin/question_lint.rs"
+[[test]]
+name = "jetstream"
 required-features = ["ssr"]

 [profile.wasm-release]
@@ -30,7 +30,7 @@ stream.

 ## What the engine provides

- **Content-driven pages** (`src/content.rs`, `src/app.rs`): YAML
+- **Content-driven pages** (`src/content/`, `src/app.rs`): YAML
  loaded from Gitea at boot and hot-swapped on a NATS reload signal;
  a bad push keeps the last-good content serving. The `questions/`
  tree IS the router — file paths become URLs, `_section.yaml`
@@ -70,7 +70,32 @@ stream.
 - **Answer chains** (`src/chain.rs`): each submission hashes its
  parent(s), so a visitor's path through the questions is a verifiable
  lineage; `?chain=` links carry it, and self-service transitions
-  (unsubscribe) authorize by holding one.
+  (unsubscribe) authorize by holding one. The question nav reads it
+  too: a `followup` page is offered only once the visitor has earned
+  it - the chain verifiably answered the alternative that leads there,
+  or it hangs off an earned page by a link that records nothing. A
+  page behind an answer they have not given is never offered.
+- **One access policy** (`src/access.rs`): who may do what to what is
+  compiled from content on every load into a Cedar policy set - `qualifies`
+  on a page, `requires_group`/`public` on a resource, a desk's transitions,
+  a `self_transition` by link and email, an `invite` - and every server
+  entry point asks that one policy. Decisions carry the rule ids that
+  granted them; refusals and every mutation are published on
+  `portal.access.decided`, and other apps ask the same question over
+  request-reply on `portal.access.<site>.may`. Identity stays Kanidm's.
+- **Onboarding as a form** (`src/people.rs`): an alternative with
+  `invite: {group}` on a gated page creates the person in Kanidm, records
+  their email, adds them to the group and mints a one-time link to set
+  their own credentials, through a service account in
+  `idm_people_on_boarding` (`KANIDM_API_TOKEN`). The result lands in the
+  `portal_invites` bucket for the inviter's desk and on
+  `portal.people.invited` for whatever sends the mail.
+- **Business needs as a checkable spec** (in
+  [uhhm/iris](https://project.uhhm.no/uhhm/iris)): a content repo may
+  ship a `needs.yaml` saying who wants what, which bucket the answer
+  must land in, and which group has to carry it to a finished state.
+  `iris check` proves the site meets it. The runtime never reads the
+  file; portal only provides the content types iris reads.
 - **Live resources** (`src/resource.rs`): content can pull a KV
  bucket, Gitea starred/org repos/releases, or any public JSON URL
  (SSRF fail-closed), reshaped by a content-declared `jq` filter.
@@ -87,17 +112,20 @@ stream.
 ## Binaries

 - `portal` — the server (Leptos SSR + hydrate, Axum underneath).
- `question_lint` — headless content validation, shipped inside every
-  release artifact so each content repo's CI lints with the exact
-  portal version its instance runs; also works offline:
-  `question_lint --path <dir>`.
+- `iris` — the lint, from [uhhm/iris](https://project.uhhm.no/uhhm/iris),
+  which depends on this crate as a library pinned to a release tag and
+  carries the same version: the publish job here re-pins, tests and tags
+  iris for every portal release.
+  Every release tarball ships that `iris` binary
+  too, so each content repo's CI can
+  lint with the exact portal version its instance runs:
+  `iris check --path <dir>`.

 ## Development

 ```sh
 cargo leptos build            # full app (server + wasm)
-cargo test --features ssr     # engine tests
-cargo build --features ssr --bin question_lint
+cargo test --features ssr     # engine tests; tests/jetstream.rs needs PORTAL_TEST_NATS_URL
 ```

 Runtime configuration is env vars (see `src/main.rs`, and each
@@ -121,13 +149,18 @@ cargo release patch        # or minor / major

 That bumps `Cargo.toml`, tags `v<version>`, and pushes; CI
 (`.gitea/workflows/publish.yml`) reacts to the tag, builds once, and
-attaches `portal-v<version>.tar.gz` (`portal` + `question_lint` +
+attaches `portal-v<version>.tar.gz` (`portal` + `iris` +
 `hash.txt` + `site/`) to the Gitea release. Pkg files are
 content-hashed (`hash-files = true`; instances run with
 `LEPTOS_HASH_FILES=true`), so a freshly served page can never pair a
 stale cached bundle with new wasm. Plain pushes to `main` only run the
 tests (`test.yml`) — nothing reaches production from this repo.

+Before cutting, move the `Unreleased` lines in `CHANGELOG.md` under a
+heading for the new version. That section becomes the Gitea release
+notes, and the table at the end of the file records which version each
+site runs; update it when a pin moves.
+
 **Roll it out** (in a content repo): edit one line in that repo's
 `.gitea/workflows/deploy.yml` —

@@ -0,0 +1,574 @@
+//! The one place a request is allowed or refused.
+//!
+//! Content already says who may do what: `qualifies` on a page,
+//! `requires_group`/`public` on a resource, the transitions a desk
+//! offers, a `self_transition` a submitter may fire with their own
+//! link, an `invite` a group may extend. Until now those were five
+//! checks in five files. Here they are compiled, on every content
+//! load, into one Cedar policy set, and every server entry point asks
+//! the same question: may this principal take this action on this
+//! resource? The answer carries the ids of the rules that granted it,
+//! and every decision that matters is published on NATS.
+//!
+//! The policy text is derived, never hand-written: content is the
+//! source, this module is the compiler, iris prints the result as a
+//! matrix and validates it against the schema.
+#![cfg(feature = "ssr")]
+
+use std::collections::{HashMap, HashSet};
+use std::str::FromStr;
+
+use cedar_policy::{
+    Authorizer, Context, Entities, Entity, EntityId, EntityTypeName, EntityUid, PolicySet, Request,
+    RestrictedExpression, Schema, ValidationMode, Validator,
+};
+use serde::{Deserialize, Serialize};
+
+use crate::aggregates::AggregateSchema;
+use crate::content::{path_matches, Question};
+
+/// What every entity and action may look like. The generated policies
+/// are validated against this, so a content shape the compiler does
+/// not know how to express fails loudly instead of granting nothing.
+pub const SCHEMA: &str = r#"
+entity Group;
+entity User in [Group];
+entity Submitter { email: String };
+entity Service;
+entity Page;
+entity Bucket;
+entity Feature;
+action open, submit appliesTo { principal: [User], resource: [Page] };
+action read appliesTo { principal: [User], resource: [Feature] };
+action transition appliesTo { principal: [User], resource: [Bucket], context: { from: String, to: String } };
+action self_transition appliesTo { principal: [Submitter], resource: [Bucket], context: { from: String, to: String, stored_email: String } };
+action automation_read appliesTo { principal: [Service], resource: [Bucket] };
+action invite appliesTo { principal: [User], resource: [Group] };
+"#;
+
+/// Who is asking.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum Principal {
+    /// A signed-in person, or nobody (`groups` empty, `sub` "anonymous").
+    User { sub: String, groups: Vec<String> },
+    /// Whoever holds one record's own link and knows the email on it.
+    Submitter { record: String, email: String },
+    /// A machine with a shared token.
+    Service { name: String },
+}
+
+impl Principal {
+    pub fn anonymous() -> Self {
+        Principal::User { sub: "anonymous".into(), groups: Vec::new() }
+    }
+
+    pub fn from_user(user: Option<&crate::auth::User>) -> Self {
+        match user {
+            Some(u) => Principal::User { sub: u.sub.clone(), groups: u.groups.clone() },
+            None => Principal::anonymous(),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Action {
+    Open,
+    Submit,
+    Read,
+    Transition,
+    SelfTransition,
+    AutomationRead,
+    Invite,
+}
+
+impl Action {
+    fn name(self) -> &'static str {
+        match self {
+            Action::Open => "open",
+            Action::Submit => "submit",
+            Action::Read => "read",
+            Action::Transition => "transition",
+            Action::SelfTransition => "self_transition",
+            Action::AutomationRead => "automation_read",
+            Action::Invite => "invite",
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(tag = "kind", rename_all = "snake_case")]
+pub enum Resource {
+    Page { id: String },
+    Bucket { name: String },
+    /// One resource block on one alternative of one page. `feature` is
+    /// the feature name, or `feature|requirement` (`|bind` appended)
+    /// for a requirement's own resource.
+    Feature { page: String, alternative: String, feature: String },
+    Group { name: String },
+}
+
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+pub struct Decision {
+    pub allow: bool,
+    /// The ids of the rules that granted it (empty on a refusal).
+    pub reasons: Vec<String>,
+}
+
+/// One row of the matrix iris prints: who may do what to what.
+#[derive(Clone, Debug, Serialize)]
+pub struct Rule {
+    pub id: String,
+    pub who: String,
+    pub action: String,
+    pub resource: String,
+    pub when: String,
+}
+
+pub struct Policy {
+    policies: PolicySet,
+    schema: Schema,
+    pub rules: Vec<Rule>,
+    pub text: String,
+    /// The dynamic pages' pattern ids, so a concrete `/shape/abc`
+    /// resolves to the policy written for `/shape/[key]`.
+    patterns: Vec<String>,
+}
+
+fn quote(s: &str) -> String {
+    format!("\"{}\"", s.replace('\\', "\\\\").replace('"', "\\\""))
+}
+
+impl Policy {
+    /// Compiles content into policy. Infallible on valid content: every
+    /// rule below is a shape the schema declares; the validation in
+    /// `validate` is what iris runs to prove that stays true.
+    pub fn from_content(
+        questions: &HashMap<String, Question>,
+        aggregates: &HashMap<String, AggregateSchema>,
+    ) -> Self {
+        let mut text = String::new();
+        let mut rules = Vec::new();
+        let mut ids: HashMap<String, usize> = HashMap::new();
+        // Each rule is parsed on its own under its own id, so a
+        // decision's reasons name rules, not `policy17`.
+        let mut sources: Vec<(String, String)> = Vec::new();
+        let mut emit = |id_base: String, who: String, action: &str, resource: String, when: String, policy: String, text: &mut String, rules: &mut Vec<Rule>| {
+            let n = ids.entry(id_base.clone()).or_insert(0);
+            *n += 1;
+            let id = if *n == 1 { id_base } else { format!("{id_base}#{n}") };
+            text.push_str(&format!("@id({})\n{policy}\n\n", quote(&id)));
+            rules.push(Rule { id: id.clone(), who, action: action.to_string(), resource, when });
+            sources.push((id, policy));
+        };
+
+        let mut pages: Vec<&Question> = questions.values().collect();
+        pages.sort_by(|a, b| a.id.cmp(&b.id));
+        for q in &pages {
+            let page = quote(&q.id);
+            let (who, principal) = match &q.qualifies {
+                None => ("anyone".to_string(), "principal".to_string()),
+                Some(g) => (format!("group {g}"), format!("principal in Group::{}", quote(g))),
+            };
+            emit(
+                format!("open:{}", q.id), who, "open, submit", format!("page {}", q.id), String::new(),
+                format!("permit({principal}, action in [Action::\"open\", Action::\"submit\"], resource == Page::{page});"),
+                &mut text, &mut rules,
+            );
+            for alt in &q.alternatives {
+                // A feature's own resource, and the resources its
+                // requirements read (select options, bound fields):
+                // each is a Feature entity of its own.
+                let mut specs: Vec<(String, &crate::content::ResourceSpec)> = Vec::new();
+                for feature in &alt.features {
+                    if let Some(spec) = &feature.resource {
+                        specs.push((format!("{}|{}|{}", q.id, alt.name, feature.name), spec));
+                    }
+                    for req in &feature.requirements {
+                        if let Some(spec) = &req.resource {
+                            specs.push((format!("{}|{}|{}|{}", q.id, alt.name, feature.name, req.name), spec));
+                        }
+                        if let Some(bind) = &req.bind {
+                            specs.push((format!("{}|{}|{}|{}|bind", q.id, alt.name, feature.name, req.name), &bind.resource));
+                        }
+                    }
+                }
+                for (fid, spec) in specs {
+                    let (who, principal) = match (&spec.requires_group, spec.public) {
+                        (Some(g), _) => (format!("group {g}"), format!("principal in Group::{}", quote(g))),
+                        (None, true) => ("anyone".to_string(), "principal".to_string()),
+                        // Neither: unreachable by design (fail closed).
+                        (None, false) => continue,
+                    };
+                    emit(
+                        format!("read:{fid}"), who.clone(), "read", format!("feature {fid}"), String::new(),
+                        format!("permit({principal}, action == Action::\"read\", resource == Feature::{});", quote(&fid)),
+                        &mut text, &mut rules,
+                    );
+                    if let (Some(bucket), Some(g)) = (spec.bucket(), &spec.requires_group) {
+                        for t in &spec.transitions {
+                            emit(
+                                format!("move:{bucket}:{}>{}", t.from, t.to), format!("group {g}"), "transition",
+                                format!("bucket {bucket}"), format!("{} -> {}", t.from, t.to),
+                                format!(
+                                    "permit(principal in Group::{}, action == Action::\"transition\", resource == Bucket::{}) when {{ context.from == {} && context.to == {} }};",
+                                    quote(g), quote(bucket), quote(&t.from), quote(&t.to)
+                                ),
+                                &mut text, &mut rules,
+                            );
+                        }
+                    }
+                }
+                if let Some(st) = &alt.self_transition {
+                    let from = crate::answers::OPEN_STATE;
+                    emit(
+                        format!("self:{}:{from}>{}", st.bucket, st.to), "the submitter, by their link and email".to_string(), "self_transition",
+                        format!("bucket {}", st.bucket), format!("{from} -> {}", st.to),
+                        format!(
+                            "permit(principal is Submitter, action == Action::\"self_transition\", resource == Bucket::{}) when {{ context.from == {} && context.to == {} && principal.email == context.stored_email }};",
+                            quote(&st.bucket), quote(from), quote(&st.to)
+                        ),
+                        &mut text, &mut rules,
+                    );
+                }
+                if let (Some(invite), Some(g)) = (&alt.invite, &q.qualifies) {
+                    emit(
+                        format!("invite:{}", invite.group), format!("group {g}"), "invite", format!("group {}", invite.group), String::new(),
+                        format!("permit(principal in Group::{}, action == Action::\"invite\", resource == Group::{});", quote(g), quote(&invite.group)),
+                        &mut text, &mut rules,
+                    );
+                }
+            }
+        }
+        // The one machine principal: the automation read endpoint, which
+        // authenticates by shared token and may read any bucket.
+        let mut buckets: Vec<&String> = aggregates.keys().collect();
+        buckets.sort();
+        emit(
+            "automation".to_string(), "service automation".to_string(), "automation_read", "any bucket".to_string(), String::new(),
+            "permit(principal == Service::\"automation\", action == Action::\"automation_read\", resource);".to_string(),
+            &mut text, &mut rules,
+        );
+        let _ = buckets;
+
+        let mut policies = PolicySet::new();
+        for (id, source) in &sources {
+            let policy = cedar_policy::Policy::parse(Some(cedar_policy::PolicyId::new(id)), source)
+                .expect("generated policy text always parses");
+            policies.add(policy).expect("rule ids are unique");
+        }
+        let schema = Schema::from_cedarschema_str(SCHEMA).map(|(s, _)| s).expect("the schema is a constant");
+        let patterns = questions.values().filter(|q| q.is_dynamic()).map(|q| q.id.clone()).collect();
+        Policy { policies, schema, rules, text, patterns }
+    }
+
+    /// Every generated rule type-checks against the schema. A rule the
+    /// schema cannot express is a compiler bug, and this is where it
+    /// shows.
+    pub fn validate(&self) -> Result<(), String> {
+        let result = Validator::new(self.schema.clone()).validate(&self.policies, ValidationMode::Strict);
+        if result.validation_passed() {
+            Ok(())
+        } else {
+            Err(result.validation_errors().map(|e| e.to_string()).collect::<Vec<_>>().join("; "))
+        }
+    }
+
+    fn page_entity(&self, id: &str) -> String {
+        if self.patterns.iter().any(|p| p == id) {
+            return id.to_string();
+        }
+        self.patterns
+            .iter()
+            .find(|p| path_matches(p, id).is_some())
+            .cloned()
+            .unwrap_or_else(|| id.to_string())
+    }
+
+    /// The decision. `context` holds what the action needs: `from`/`to`
+    /// for a transition, plus `stored_email` for a self transition.
+    pub fn decide(
+        &self,
+        principal: &Principal,
+        action: Action,
+        resource: &Resource,
+        context: serde_json::Value,
+    ) -> Decision {
+        let uid = |ty: &str, id: &str| {
+            EntityUid::from_type_name_and_id(EntityTypeName::from_str(ty).expect("static type"), EntityId::new(id))
+        };
+        let mut entities: Vec<Entity> = Vec::new();
+        let principal_uid = match principal {
+            Principal::User { sub, groups } => {
+                let parents: HashSet<EntityUid> = groups.iter().map(|g| uid("Group", g)).collect();
+                for g in &parents {
+                    entities.push(Entity::new_no_attrs(g.clone(), HashSet::new()));
+                }
+                let me = uid("User", sub);
+                entities.push(Entity::new_no_attrs(me.clone(), parents));
+                me
+            }
+            Principal::Submitter { record, email } => {
+                let me = uid("Submitter", record);
+                let attrs = HashMap::from([("email".to_string(), RestrictedExpression::new_string(email.clone()))]);
+                entities.push(Entity::new(me.clone(), attrs, HashSet::new()).expect("a string attribute always evaluates"));
+                me
+            }
+            Principal::Service { name } => {
+                let me = uid("Service", name);
+                entities.push(Entity::new_no_attrs(me.clone(), HashSet::new()));
+                me
+            }
+        };
+        let resource_uid = match resource {
+            Resource::Page { id } => uid("Page", &self.page_entity(id)),
+            Resource::Bucket { name } => uid("Bucket", name),
+            Resource::Feature { page, alternative, feature } => {
+                uid("Feature", &format!("{}|{alternative}|{feature}", self.page_entity(page)))
+            }
+            Resource::Group { name } => uid("Group", name),
+        };
+        entities.push(Entity::new_no_attrs(resource_uid.clone(), HashSet::new()));
+        let action_uid = uid("Action", action.name());
+
+        let Ok(entities) = Entities::from_entities(entities, None) else {
+            return Decision::default();
+        };
+        // An absent context is an empty one, not a malformed one.
+        let context = if context.is_object() { context } else { serde_json::json!({}) };
+        let Ok(context) = Context::from_json_value(context, None) else {
+            return Decision::default();
+        };
+        let Ok(request) = Request::new(principal_uid, action_uid, resource_uid, context, None) else {
+            return Decision::default();
+        };
+        let response = Authorizer::new().is_authorized(&request, &self.policies, &entities);
+        Decision {
+            allow: response.decision() == cedar_policy::Decision::Allow,
+            reasons: response.diagnostics().reason().map(|id| id.to_string()).collect(),
+        }
+    }
+
+    pub fn allows(&self, principal: &Principal, action: Action, resource: &Resource) -> bool {
+        self.decide(principal, action, resource, serde_json::json!({})).allow
+    }
+}
+
+/// What gets published on `portal.access.decided`: the question and
+/// the answer. Page opens and reads are published only when refused;
+/// every mutation is published either way.
+#[derive(Clone, Debug, Serialize)]
+pub struct Decided<'a> {
+    pub principal: &'a Principal,
+    pub action: Action,
+    pub resource: &'a Resource,
+    pub context: &'a serde_json::Value,
+    pub allow: bool,
+    pub reasons: &'a [String],
+    pub at_ms: i64,
+}
+
+pub const DECIDED_SUBJECT: &str = "portal.access.decided";
+
+pub fn worth_publishing(action: Action, allow: bool) -> bool {
+    !allow || !matches!(action, Action::Open | Action::Read)
+}
+
+/// Decides and, when it matters, publishes. Fire and forget: a NATS
+/// hiccup never changes an answer.
+pub fn decide_and_publish(
+    nats: &async_nats::Client,
+    policy: &Policy,
+    principal: &Principal,
+    action: Action,
+    resource: &Resource,
+    context: serde_json::Value,
+) -> Decision {
+    let decision = policy.decide(principal, action, resource, context.clone());
+    if worth_publishing(action, decision.allow) {
+        let event = Decided {
+            principal,
+            action,
+            resource,
+            context: &context,
+            allow: decision.allow,
+            reasons: &decision.reasons,
+            at_ms: chrono::Utc::now().timestamp_millis(),
+        };
+        if let Ok(bytes) = serde_json::to_vec(&event) {
+            let nats = nats.clone();
+            tokio::spawn(async move {
+                let _ = nats.publish(DECIDED_SUBJECT, bytes.into()).await;
+            });
+        }
+    }
+    decision
+}
+
+/// The request-reply face for other apps: a JSON question in, a
+/// decision out. Same policy, same answer as the site gives itself.
+#[derive(Debug, Deserialize)]
+pub struct Query {
+    pub principal: Principal,
+    pub action: Action,
+    pub resource: Resource,
+    #[serde(default)]
+    pub context: serde_json::Value,
+}
+
+pub fn subject_for(site: &str) -> String {
+    format!("portal.access.{site}.may")
+}
+
+pub fn policy_subject_for(site: &str) -> String {
+    format!("portal.access.{site}.policy")
+}
+
+/// Answers `portal.access.<site>.may` for as long as the process runs,
+/// with the policy as it is at the moment of each question (it is
+/// swapped on content reload). A malformed question gets a refusal
+/// with the parse error as its reason, never silence.
+pub async fn serve(
+    nats: async_nats::Client,
+    site: String,
+    access: std::sync::Arc<arc_swap::ArcSwap<Policy>>,
+) {
+    use futures::StreamExt;
+    let subject = subject_for(&site);
+    let mut sub = match nats.subscribe(subject.clone()).await {
+        Ok(sub) => sub,
+        Err(e) => {
+            tracing::error!(error = %e, %subject, "cannot serve access decisions");
+            return;
+        }
+    };
+    tracing::info!(%subject, "answering access questions");
+    while let Some(msg) = sub.next().await {
+        let Some(reply) = msg.reply else { continue };
+        let decision = match serde_json::from_slice::<Query>(&msg.payload) {
+            Ok(q) => decide_and_publish(&nats, &access.load(), &q.principal, q.action, &q.resource, q.context),
+            Err(e) => Decision { allow: false, reasons: vec![format!("malformed question: {e}")] },
+        };
+        let bytes = serde_json::to_vec(&decision).unwrap_or_else(|_| b"{\"allow\":false,\"reasons\":[]}".to_vec());
+        let _ = nats.publish(reply, bytes.into()).await;
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::aggregates::parse_aggregates_yaml;
+    use crate::content::build_questions;
+    use serde_json::json;
+
+    fn site() -> Policy {
+        let files = vec![
+            ("index.yaml".to_string(), "name: Home\nalternatives:\n  - name: Apply\n    action: /applied\n    record_as: applicants\n  - name: Unsubscribe\n    self_transition: { bucket: subscribers, to: unsubscribed, label: Go }\n".to_string()),
+            ("applied.yaml".to_string(), "name: Applied\nfollowup: true\n".to_string()),
+            ("shape/[key].yaml".to_string(), "name: Shape\n".to_string()),
+            ("review/_section.yaml".to_string(), "qualifies: owners\n".to_string()),
+            ("review/index.yaml".to_string(), "name: Review\nalternatives:\n  - name: Applicants\n    features:\n      - name: \"\"\n        resource:\n          source: { kind: kv, bucket: applicants }\n          requires_group: owners\n          transitions:\n            - { to: invited, label: Invite }\n            - { from: invited, to: active, label: Onboard }\n      - name: Releases\n        resource:\n          public: true\n          source: { kind: gitea_releases, owner: o, repo: r }\n  - name: Invite a colleague\n    invite: { group: owners }\n    features:\n      - name: \"\"\n        requirements:\n          - { name: name }\n          - { name: email, type: email }\n".to_string()),
+        ];
+        let questions = build_questions(&files).unwrap();
+        let aggregates = parse_aggregates_yaml("aggregates:\n  - bucket: applicants\n    initial: open\n    states:\n      open: { event: a }\n      invited: { event: b }\n      active: { event: c }\n    transitions:\n      open: [invited]\n      invited: [active]\n").unwrap();
+        Policy::from_content(&questions, &aggregates)
+    }
+
+    fn user(groups: &[&str]) -> Principal {
+        Principal::User { sub: "u".into(), groups: groups.iter().map(|g| g.to_string()).collect() }
+    }
+
+    #[test]
+    fn the_generated_policy_validates_against_the_schema() {
+        let p = site();
+        assert_eq!(p.validate(), Ok(()), "{}", p.text);
+        assert!(p.rules.iter().any(|r| r.id == "move:applicants:open>invited"));
+    }
+
+    #[test]
+    fn pages_open_to_anyone_unless_qualified() {
+        let p = site();
+        let page = |id: &str| Resource::Page { id: id.into() };
+        assert!(p.allows(&Principal::anonymous(), Action::Open, &page("/")));
+        assert!(!p.allows(&Principal::anonymous(), Action::Open, &page("/review")));
+        assert!(!p.allows(&user(&["staff"]), Action::Submit, &page("/review")));
+        let d = p.decide(&user(&["owners"]), Action::Submit, &page("/review"), json!({}));
+        assert!(d.allow);
+        assert_eq!(d.reasons, vec!["open:/review"]);
+        // A concrete dynamic path resolves to its pattern's rule.
+        assert!(p.allows(&Principal::anonymous(), Action::Open, &page("/shape/abc")));
+        assert!(!p.allows(&Principal::anonymous(), Action::Open, &page("/nowhere")));
+    }
+
+    #[test]
+    fn reads_follow_requires_group_or_public() {
+        let p = site();
+        let desk = Resource::Feature { page: "/review".into(), alternative: "Applicants".into(), feature: "".into() };
+        let releases = Resource::Feature { page: "/review".into(), alternative: "Applicants".into(), feature: "Releases".into() };
+        assert!(p.allows(&user(&["owners"]), Action::Read, &desk));
+        assert!(!p.allows(&user(&["staff"]), Action::Read, &desk));
+        assert!(p.allows(&Principal::anonymous(), Action::Read, &releases));
+    }
+
+    #[test]
+    fn transitions_are_exactly_the_desks_buttons() {
+        let p = site();
+        let bucket = Resource::Bucket { name: "applicants".into() };
+        let ctx = |from: &str, to: &str| json!({ "from": from, "to": to });
+        assert!(p.decide(&user(&["owners"]), Action::Transition, &bucket, ctx("open", "invited")).allow);
+        assert!(p.decide(&user(&["owners"]), Action::Transition, &bucket, ctx("invited", "active")).allow);
+        // Right target, wrong starting state: no rule.
+        assert!(!p.decide(&user(&["owners"]), Action::Transition, &bucket, ctx("open", "active")).allow);
+        assert!(!p.decide(&user(&["staff"]), Action::Transition, &bucket, ctx("open", "invited")).allow);
+    }
+
+    #[test]
+    fn a_submitter_moves_their_own_record_only_with_the_matching_email() {
+        let p = site();
+        let bucket = Resource::Bucket { name: "subscribers".into() };
+        let me = Principal::Submitter { record: "r1".into(), email: "a@b.c".into() };
+        let ctx = |stored: &str| json!({ "from": "open", "to": "unsubscribed", "stored_email": stored });
+        assert!(p.decide(&me, Action::SelfTransition, &bucket, ctx("a@b.c")).allow);
+        assert!(!p.decide(&me, Action::SelfTransition, &bucket, ctx("x@y.z")).allow);
+        assert!(!p.decide(&me, Action::SelfTransition, &bucket, json!({ "from": "open", "to": "somewhere", "stored_email": "a@b.c" })).allow);
+        // A signed-in owner has no such rule: the link is the credential.
+        assert!(!p.decide(&user(&["owners"]), Action::SelfTransition, &bucket, ctx("a@b.c")).allow);
+    }
+
+    #[test]
+    fn invites_and_automation() {
+        let p = site();
+        let owners = Resource::Group { name: "owners".into() };
+        assert!(p.allows(&user(&["owners"]), Action::Invite, &owners));
+        assert!(!p.allows(&user(&["staff"]), Action::Invite, &owners));
+        let bucket = Resource::Bucket { name: "applicants".into() };
+        assert!(p.allows(&Principal::Service { name: "automation".into() }, Action::AutomationRead, &bucket));
+        assert!(!p.allows(&Principal::Service { name: "someone".into() }, Action::AutomationRead, &bucket));
+        assert!(!p.allows(&user(&["owners"]), Action::AutomationRead, &bucket));
+    }
+
+    #[test]
+    fn a_question_over_nats_is_the_same_question() {
+        let p = site();
+        let q: Query = serde_json::from_str(
+            r#"{"principal":{"kind":"user","sub":"n8n-as-owner","groups":["owners"]},"action":"transition","resource":{"kind":"bucket","name":"applicants"},"context":{"from":"open","to":"invited"}}"#,
+        )
+        .unwrap();
+        assert!(p.decide(&q.principal, q.action, &q.resource, q.context).allow);
+        let q: Query = serde_json::from_str(
+            r#"{"principal":{"kind":"service","name":"automation"},"action":"automation_read","resource":{"kind":"bucket","name":"applicants"}}"#,
+        )
+        .unwrap();
+        assert!(p.decide(&q.principal, q.action, &q.resource, q.context).allow);
+        assert_eq!(subject_for("uhhm"), "portal.access.uhhm.may");
+    }
+
+    #[test]
+    fn only_refusals_and_mutations_are_worth_publishing() {
+        assert!(!worth_publishing(Action::Open, true));
+        assert!(worth_publishing(Action::Open, false));
+        assert!(worth_publishing(Action::Transition, true));
+        assert!(!worth_publishing(Action::Read, true));
+    }
+}
@@ -195,14 +195,6 @@ async fn apply_transition(
        .resource
        .as_ref()
        .ok_or_else(|| ServerFnError::new("feature has no resource"))?;
-    let group = resource
-        .requires_group
-        .as_deref()
-        .ok_or_else(|| ServerFnError::new("resource has no transitions available"))?;
-    if !user.groups.iter().any(|g| g == group) {
-        return Err(ServerFnError::new("not authorized"));
-    }
-
    let bucket = resource
        .bucket()
        .ok_or_else(|| ServerFnError::new("resource is not kv-backed, has no transitions"))?;
@@ -232,6 +224,19 @@ async fn apply_transition(
            ))
        })?
        .clone();
+    // The policy holds exactly the buttons this desk offers to this
+    // group, keyed on (from, to); it is the one check.
+    let decision = crate::access::decide_and_publish(
+        &state.nats,
+        &state.access.load(),
+        &crate::access::Principal::from_user(Some(user)),
+        crate::access::Action::Transition,
+        &crate::access::Resource::Bucket { name: bucket.to_string() },
+        serde_json::json!({ "from": answer.state, "to": item.to }),
+    );
+    if !decision.allow {
+        return Err(ServerFnError::new("not authorized"));
+    }

    let decided_ms = chrono::Utc::now().timestamp_millis();
    let decision_payload_for_event =
@@ -329,12 +334,21 @@ pub async fn self_transition_answer(
    let mut answer: Answer =
        serde_json::from_slice(&bytes).map_err(|e| ServerFnError::new(e.to_string()))?;

-    let stored_email = answer.responses.get("email").and_then(|v| v.as_str());
-    if stored_email != Some(email.as_str()) {
-        return Err(ServerFnError::new("not found"));
-    }
-    if answer.state != OPEN_STATE {
-        return Err(ServerFnError::new("already processed"));
+    // The link is the credential and the email its second factor; the
+    // policy compares them and knows the one move a submitter may make.
+    // Refusal reads "not found" so the endpoint cannot be used to probe
+    // which records or emails exist.
+    let stored_email = answer.responses.get("email").and_then(|v| v.as_str()).unwrap_or_default();
+    let decision = crate::access::decide_and_publish(
+        &state.nats,
+        &state.access.load(),
+        &crate::access::Principal::Submitter { record: item_id.clone(), email: email.clone() },
+        crate::access::Action::SelfTransition,
+        &crate::access::Resource::Bucket { name: self_transition.bucket.clone() },
+        serde_json::json!({ "from": answer.state, "to": self_transition.to, "stored_email": stored_email }),
+    );
+    if !decision.allow {
+        return Err(ServerFnError::new(if answer.state == OPEN_STATE { "not found" } else { "already processed" }));
    }

    let decided_ms = chrono::Utc::now().timestamp_millis();
@@ -1,5 +1,5 @@
 use leptos::prelude::*;
-use leptos_meta::{provide_meta_context, HashedStylesheet, Html, MetaTags, Stylesheet, Title};
+use leptos_meta::{provide_meta_context, HashedStylesheet, Html, Link, MetaTags, Stylesheet, Title};
 use leptos_router::{
    components::{Route, Router, Routes},
    hooks::{use_location, use_navigate, use_query_map},
@@ -40,6 +40,20 @@ pub fn shell(options: LeptosOptions) -> impl IntoView {
                // once loaded via <link>/<img> on Safari/iOS.
                <link rel="icon" media="(prefers-color-scheme: light)" href="/favicon-light.svg" type="image/svg+xml"/>
                <link rel="icon" media="(prefers-color-scheme: dark)" href="/favicon-dark.svg" type="image/svg+xml"/>
+                // Fonts hide behind the stylesheet: the browser must
+                // fetch and parse CSS before it discovers them. The
+                // latin subset is on every page's critical path, so
+                // announce it up front; latin-ext and vietnamese stay
+                // unicode-range-gated and load only when script needs
+                // them - preloading those would tax everyone for a few.
+                // (Font preloads require crossorigin even same-origin.)
+                <link
+                    rel="preload"
+                    href="/fonts/quicksand-semibold-latin.woff2"
+                    r#as="font"
+                    type="font/woff2"
+                    crossorigin="anonymous"
+                />
                // Server-side, so it can read hash.txt and link the
                // content-hashed stylesheet (hash-files = true).
                <HashedStylesheet id="leptos" options=options.clone()/>
@@ -89,10 +103,34 @@ pub fn App() -> impl IntoView {
            .and_then(|s| s.stylesheet)
            .map(|p| format!("/site/{p}"))
    });
+    // The wordmark paints in the hero on first view; announcing it in
+    // the head starts the fetch during hydration instead of after. On
+    // redoal.com it lives on the content host, so a preconnect opens
+    // that TLS session while the preload is still queued.
+    let wordmark_href = Memo::new(move |_| {
+        site.get().and_then(|r| r.ok()).and_then(|s| s.wordmark)
+    });
+    let wordmark_origin = Memo::new(move |_| {
+        wordmark_href.get().and_then(|w| {
+            let rest = w.strip_prefix("https://")?;
+            Some(format!("https://{}", rest.split('/').next()?))
+        })
+    });
+    // A content-shipped favicon overrides the built-in one; injected
+    // into the head after the static defaults, so it wins.
+    let favicon = Memo::new(move |_| {
+        site.get()
+            .and_then(|r| r.ok())
+            .and_then(|s| s.favicon)
+            .map(|p| format!("/site/{p}"))
+    });

    view! {
        <Html attr:lang=move || lang.get()/>
+        {move || wordmark_origin.get().map(|href| view! { <Link rel="preconnect" href=href crossorigin="anonymous"/> })}
+        {move || wordmark_href.get().map(|href| view! { <Link rel="preload" as_="image" href=href/> })}
        {move || custom_css.get().map(|href| view! { <Stylesheet id="site-custom" href=href/> })}
+        {move || favicon.get().map(|href| view! { <Link rel="icon" href=href/> })}
        <Suspense fallback=|| ()>
            {move || {
                site.get()
@@ -175,7 +213,10 @@ fn PortalShell() -> impl IntoView {
        |(path, chain)| get_question(path, chain),
    );
    let user = Resource::new(|| (), |_| current_user());
-    let nav = Resource::new(move || chain.get().is_some(), list_qualifying_questions);
+    let nav = Resource::new(
+        move || (path.get(), chain.get()),
+        |(path, chain)| list_qualifying_questions(path, chain),
+    );
    let announcements = Resource::new(|| (), |_| list_announcements());
    provide_context(QuestionRes(question));
    provide_context(UserRes(user));
@@ -251,7 +292,6 @@ fn QuestionView(
    site: SiteConfig,
 ) -> impl IntoView {
    let question_id = question.id.clone();
-    let has_chain = parent_hash.is_some();

    // The provenance counterpart to the qualifies gate below: a
    // requires_chain page whose visitor holds no verifiable lineage to
@@ -280,7 +320,7 @@ fn QuestionView(
                </section>
            </div>
            // A gate is never a dead end: the same nav as every page.
-            <QuestionNav current_id=question_id has_chain=has_chain/>
+            <QuestionNav current_id=question_id/>
        }
        .into_any();
    }
@@ -317,7 +357,7 @@ fn QuestionView(
                    }}
                </section>
            </div>
-            <QuestionNav current_id=question_id has_chain=has_chain/>
+            <QuestionNav current_id=question_id/>
        }
        .into_any();
    }
@@ -380,7 +420,7 @@ fn QuestionView(
            .map(|r| {
                view! { <ResponsibleNote responsible=r/> }
            })}
-        <QuestionNav current_id=question_id has_chain=has_chain/>
+        <QuestionNav current_id=question_id/>
    }
    .into_any()
 }
@@ -389,8 +429,7 @@ fn QuestionView(
 /// small nav - how a concern reaches the people it speaks to without
 /// claiming front-page space (an owner also sees the gated desks here).
 #[component]
-fn QuestionNav(current_id: String, has_chain: bool) -> impl IntoView {
-    let _ = has_chain; // keyed into the shared resource by PortalShell
+fn QuestionNav(current_id: String) -> impl IntoView {
    let NavRes(nav) = expect_context();
    view! {
        <Suspense fallback=|| ()>
@@ -687,7 +726,7 @@ fn Hero(title: String, description: String, landing: bool, site: SiteConfig, cur
                    <img src=wordmark alt=site_title style=wordmark_style/>
                </a>
                <h1>{title}</h1>
-                <p>{description}</p>
+                <p inner_html=render_inline_markdown(&description)></p>
            </div>
        </header>
    }
@@ -1991,16 +2030,22 @@ pub async fn get_site() -> Result<SiteConfig, ServerFnError> {
    Ok(state.site.load().as_ref().clone())
 }

-/// Every question the current visitor qualifies for, as (id, name) -
-/// the site nav's data. Context-dependent: an owner session sees the
-/// gated pages too, and `followup` pages only appear once the visitor
-/// carries an answer chain.
+/// Every question the visitor may be offered from `current`, as (id,
+/// name) - the question nav's data. Front-door pages the visitor
+/// qualifies for are always in (an owner session sees the gated desks
+/// too). A `followup` page or an ended event is in only when the
+/// visitor has earned it: their verified `?chain=` answered the
+/// alternative that leads there, or it is reachable from an earned
+/// page over links that record nothing (see `content::earned_followups`).
+/// Nothing is offered that sits behind an answer they have not given;
+/// an unverifiable hash unlocks nothing.
 #[server(endpoint = "list_qualifying_questions")]
 pub async fn list_qualifying_questions(
-    has_chain: bool,
+    current: String,
+    chain: Option<String>,
 ) -> Result<Vec<(String, String)>, ServerFnError> {
    use crate::auth::{User, SESSION_USER_KEY};
-    use crate::content::is_qualified;
+    use crate::content::{earned_followups, unlocked_by, Question};
    use crate::server::AppState;

    let state = expect_context::<AppState>();
@@ -2011,14 +2056,29 @@ pub async fn list_qualifying_questions(
        .map_err(|e| ServerFnError::new(e.to_string()))?;

    let now_ms = chrono::Utc::now().timestamp_millis();
-    let mut out: Vec<(String, String)> = state
-        .questions
-        .load()
+    let questions = state.questions.load();
+    // What the chain verifiably answered - the same lookup a
+    // `requires_chain` gate does, so a forged or foreign hash resolves
+    // to nothing - and therefore where it sent the visitor.
+    let seeds: Vec<String> = match &chain {
+        Some(hash) => match crate::chain::lookup_node(&state.jetstream, hash).await {
+            Some(node) => unlocked_by(&questions, &node.question_id, node.alternative.as_deref()),
+            None => Vec::new(),
+        },
+        None => Vec::new(),
+    };
+    // An ended event page is a followup from then on.
+    let is_outcome = |q: &Question| q.is_followup() || q.event_ended_at(now_ms);
+    let earned = earned_followups(&questions, &current, &seeds, &is_outcome);
+    let access = state.access.load();
+    let principal = crate::access::Principal::from_user(user.as_ref());
+    let may_open = |q: &Question| {
+        access.allows(&principal, crate::access::Action::Open, &crate::access::Resource::Page { id: q.id.clone() })
+    };
+    let mut out: Vec<(String, String)> = questions
        .values()
-        .filter(|q| is_qualified(user.as_ref(), q))
-        // An ended event page is a followup from then on - only a
-        // visitor carrying a chain (they answered it) still sees it.
-        .filter(|q| !(q.is_followup() || q.event_ended_at(now_ms)) || has_chain)
+        .filter(|q| may_open(q))
+        .filter(|q| !is_outcome(q) || earned.contains(&q.id))
        // A live event is announced in the header instead.
        .filter(|q| !q.event_live_at(now_ms))
        // A dynamic page has no URL of its own to link to.
@@ -2034,7 +2094,6 @@ pub async fn list_qualifying_questions(
 #[server(endpoint = "list_announcements")]
 pub async fn list_announcements() -> Result<Vec<Announcement>, ServerFnError> {
    use crate::auth::{User, SESSION_USER_KEY};
-    use crate::content::is_qualified;
    use crate::server::AppState;

    let state = expect_context::<AppState>();
@@ -2045,11 +2104,16 @@ pub async fn list_announcements() -> Result<Vec<Announcement>, ServerFnError> {
        .map_err(|e| ServerFnError::new(e.to_string()))?;
    let now_ms = chrono::Utc::now().timestamp_millis();

+    let access = state.access.load();
+    let principal = crate::access::Principal::from_user(user.as_ref());
    let mut live: Vec<(i64, Announcement)> = state
        .questions
        .load()
        .values()
-        .filter(|q| is_qualified(user.as_ref(), q) && q.event_live_at(now_ms))
+        .filter(|q| {
+            access.allows(&principal, crate::access::Action::Open, &crate::access::Resource::Page { id: q.id.clone() })
+                && q.event_live_at(now_ms)
+        })
        .filter_map(|q| {
            let event = q.event.as_ref()?;
            let starts = chrono::DateTime::parse_from_rfc3339(&event.starts).ok()?;
@@ -2106,7 +2170,6 @@ pub async fn submit_answer(
    use crate::answers::store_answer;
    use crate::auth::{User, SESSION_USER_KEY};
    use crate::chain::hash_node;
-    use crate::content::is_qualified;
    use crate::events::{emit_answer_submitted, AnswerSubmitted};
    use crate::server::AppState;

@@ -2122,7 +2185,16 @@ pub async fn submit_answer(
        .get::<User>(SESSION_USER_KEY)
        .await
        .map_err(|e| ServerFnError::new(e.to_string()))?;
-    if !is_qualified(user.as_ref(), &question) {
+    let principal = crate::access::Principal::from_user(user.as_ref());
+    let submit = crate::access::decide_and_publish(
+        &state.nats,
+        &state.access.load(),
+        &principal,
+        crate::access::Action::Submit,
+        &crate::access::Resource::Page { id: question_id.clone() },
+        serde_json::json!({ "alternative": alternative }),
+    );
+    if !submit.allow {
        return Err(ServerFnError::new("not authorized for this question"));
    }

@@ -2134,10 +2206,46 @@ pub async fn submit_answer(
    if alt.disabled {
        return Err(ServerFnError::new("this alternative isn't open yet"));
    }
-    let record_as = alt.record_as.clone();
+    let mut record_as = alt.record_as.clone();

-    let responses: serde_json::Value = serde_json::from_str(&responses_json)
+    let mut responses: serde_json::Value = serde_json::from_str(&responses_json)
        .map_err(|e| ServerFnError::new(format!("invalid responses: {e}")))?;
+
+    // An invite: the policy says whether this group may extend one,
+    // Kanidm does the onboarding, and what came back (the account, the
+    // one-time link) is recorded with the answer for the inviter's desk
+    // and announced for whatever sends the mail.
+    if let Some(invite) = &alt.invite {
+        let may = crate::access::decide_and_publish(
+            &state.nats,
+            &state.access.load(),
+            &principal,
+            crate::access::Action::Invite,
+            &crate::access::Resource::Group { name: invite.group.clone() },
+            serde_json::json!({}),
+        );
+        if !may.allow {
+            return Err(ServerFnError::new("not authorized to invite into this group"));
+        }
+        let kanidm = crate::people::Kanidm::from_env()
+            .ok_or_else(|| ServerFnError::new("invites are not configured on this instance (KANIDM_API_TOKEN)"))?;
+        let field = |name: &str| responses.get(name).and_then(|v| v.as_str()).map(str::trim).filter(|s| !s.is_empty()).map(String::from);
+        let (name, email) = match (field("name"), field("email")) {
+            (Some(n), Some(e)) => (n, e),
+            _ => return Err(ServerFnError::new("an invite needs a name and an email")),
+        };
+        let invited = kanidm
+            .invite(&name, &email, &invite.group)
+            .await
+            .map_err(|e| ServerFnError::new(format!("invite failed: {e}")))?;
+        if let Some(map) = responses.as_object_mut() {
+            map.insert("invited".to_string(), serde_json::to_value(&invited).unwrap_or_default());
+        }
+        record_as.get_or_insert_with(|| crate::people::INVITES_BUCKET.to_string());
+        if let Ok(bytes) = serde_json::to_vec(&invited) {
+            let _ = state.nats.publish(crate::people::INVITED_SUBJECT, bytes.into()).await;
+        }
+    }
    // `/shape/{curve.key}`: the next page may be chosen by the answer.
    let next = match alt.action.as_deref() {
        Some(action) => Some(
@@ -2168,7 +2276,7 @@ pub async fn submit_answer(
    // Index the node so requires_chain pages can verify lineage.
    // Best-effort: the NATS event above is the durable record.
    if let Err(e) =
-        crate::chain::record_node(&state.jetstream, &chain_hash, &question_id, timestamp_ms).await
+        crate::chain::record_node(&state.jetstream, &chain_hash, &question_id, &alternative, timestamp_ms).await
    {
        tracing::error!("failed to index chain node: {e}");
    }
@@ -1,158 +0,0 @@
-//! Headless schema-check binary - loads content and `aggregates.yaml`
-//! (from a Gitea repo URL or a local directory) and validates them
-//! exactly the way `content::watch_for_reload`/`main.rs`'s boot path
-//! do, with no NATS, OIDC, web server, or JetStream connection
-//! involved. Built once by portal's own deploy workflow and run
-//! directly by `questions`' own CI (same bare-metal runner/host,
-//! published to a stable path - no artifact download needed), rather
-//! than compiled there - keeps that repo's CI coupling to "run a
-//! static binary," not "build a Rust workspace."
-#![cfg(feature = "ssr")]
-
-use portal::{aggregates, content};
-
-#[tokio::main]
-async fn main() -> anyhow::Result<()> {
-    let mut args = std::env::args().skip(1);
-    let mut repo: Option<String> = None;
-    let mut branch = "main".to_string();
-    let mut subdir = "questions".to_string();
-    let mut path: Option<String> = None;
-
-    while let Some(arg) = args.next() {
-        match arg.as_str() {
-            "--repo" => repo = args.next(),
-            "--branch" => branch = args.next().unwrap_or(branch),
-            "--subdir" => subdir = args.next().unwrap_or(subdir),
-            "--path" => path = args.next(),
-            other => {
-                eprintln!("unknown argument: {other}");
-                std::process::exit(2);
-            }
-        }
-    }
-
-    let (questions, aggregates_map, site) = if let Some(dir) = path {
-        (load_from_dir(&dir)?, load_aggregates_from_dir(&dir)?, load_site_from_dir(&dir)?)
-    } else if let Some(repo_url) = repo {
-        let questions = content::load_questions_from_gitea(&repo_url, &branch, &subdir).await?;
-        let aggregates_map = content::load_aggregates_from_gitea(&repo_url, &branch).await?;
-        // load_site_from_gitea already validates; a missing file is
-        // the default config, same as at portal boot.
-        let site = content::load_site_from_gitea(&repo_url, &branch).await?;
-        (questions, aggregates_map, site)
-    } else {
-        eprintln!(
-            "usage: question-lint --repo <gitea-url> [--branch main] [--subdir questions] | --path <local-dir>"
-        );
-        std::process::exit(2);
-    };
-
-    if let Err(e) = site.validate() {
-        eprintln!("FAIL: {e}");
-        std::process::exit(1);
-    }
-    let aggregates_map = content::with_builtin_aggregates(aggregates_map);
-    match content::validate_questions(&questions, &aggregates_map) {
-        Ok(()) => {
-            // The runtime's own event desk: a repo announcing pages
-            // (Question.event) should read portal_events somewhere, or
-            // "post what happened" tasks pile up unseen. Warn, don't
-            // fail - the runtime creates the records either way.
-            if questions.values().any(|q| q.event.is_some())
-                && !content::bucket_is_read(&questions, content::EVENTS_BUCKET)
-            {
-                eprintln!(
-                    "WARN: pages carry `event:` but no kv resource reads bucket {:?} - add a desk so summaries get posted",
-                    content::EVENTS_BUCKET
-                );
-            }
-            println!(
-                "OK: {} question(s), {} aggregate(s) valid",
-                questions.len(),
-                aggregates_map.len()
-            );
-            Ok(())
-        }
-        Err(e) => {
-            eprintln!("FAIL: {e}");
-            std::process::exit(1);
-        }
-    }
-}
-
-/// The offline counterpart to `content::load_site_from_gitea` -
-/// `site.yaml` lives at the repo root like `aggregates.yaml`, and is
-/// just as optional locally: missing means default branding.
-fn load_site_from_dir(dir: &str) -> anyhow::Result<content::SiteConfig> {
-    let site_path = std::path::Path::new(dir)
-        .parent()
-        .unwrap_or_else(|| std::path::Path::new("."))
-        .join("site.yaml");
-    if !site_path.exists() {
-        return Ok(content::SiteConfig::default());
-    }
-    let raw = std::fs::read_to_string(&site_path)
-        .map_err(|e| anyhow::anyhow!("reading {}: {e}", site_path.display()))?;
-    serde_yaml::from_str(&raw).map_err(|e| anyhow::anyhow!("parsing {}: {e}", site_path.display()))
-}
-
-/// The offline counterpart to `content::load_aggregates_from_gitea` -
-/// `aggregates.yaml` lives at the repo root, one level up from the
-/// pages directory `--path` names, so `dir`'s parent is where it's
-/// looked for. Missing entirely is not an error here (unlike
-/// `--repo` mode, where `aggregates.yaml` is required) - a local
-/// checkout being linted may not have one, and every declared
-/// transition still gets checked against whatever *is* found; an
-/// empty map just means nothing is checked.
-fn load_aggregates_from_dir(
-    dir: &str,
-) -> anyhow::Result<std::collections::HashMap<String, aggregates::AggregateSchema>> {
-    let aggregates_path = std::path::Path::new(dir)
-        .parent()
-        .unwrap_or_else(|| std::path::Path::new("."))
-        .join("aggregates.yaml");
-    if !aggregates_path.exists() {
-        return Ok(std::collections::HashMap::new());
-    }
-    let raw = std::fs::read_to_string(&aggregates_path)
-        .map_err(|e| anyhow::anyhow!("reading {}: {e}", aggregates_path.display()))?;
-    aggregates::parse_aggregates_yaml(&raw)
-}
-
-/// The offline counterpart to `content::load_questions_from_gitea` -
-/// the same recursive tree walk and `content::build_questions`
-/// pipeline (derived ids, relative refs, sections, followup
-/// inference), just reading a local checkout instead of Gitea's API,
-/// for linting a branch that hasn't been pushed yet.
-fn load_from_dir(
-    dir: &str,
-) -> anyhow::Result<std::collections::HashMap<String, content::Question>> {
-    let base = std::path::Path::new(dir);
-    let mut files = Vec::new();
-    collect_yaml(base, base, &mut files)?;
-    content::build_questions(&files)
-}
-
-fn collect_yaml(
-    base: &std::path::Path,
-    dir: &std::path::Path,
-    out: &mut Vec<(String, String)>,
-) -> anyhow::Result<()> {
-    for entry in std::fs::read_dir(dir)? {
-        let path = entry?.path();
-        if path.is_dir() {
-            collect_yaml(base, &path, out)?;
-        } else if path.extension().and_then(|e| e.to_str()) == Some("yaml") {
-            let rel = path
-                .strip_prefix(base)
-                .expect("walked paths sit under their base")
-                .to_string_lossy()
-                .replace('\\', "/");
-            let raw = std::fs::read_to_string(&path)
-                .map_err(|e| anyhow::anyhow!("reading {}: {e}", path.display()))?;
-            out.push((rel, raw));
-        }
-    }
-    Ok(())
-}
@@ -20,6 +20,11 @@ pub const CHAIN_BUCKET: &str = "portal_chains";
 #[derive(serde::Serialize, serde::Deserialize)]
 pub struct ChainNode {
    pub question_id: String,
+    /// Which alternative was answered - what decides where the visitor
+    /// was sent next, and so which followup the chain has earned. Nodes
+    /// indexed before this field existed carry `None`.
+    #[serde(default)]
+    pub alternative: Option<String>,
    pub timestamp_ms: i64,
 }

@@ -30,6 +35,7 @@ pub async fn record_node(
    js: &async_nats::jetstream::Context,
    chain_hash: &str,
    question_id: &str,
+    alternative: &str,
    timestamp_ms: i64,
 ) -> anyhow::Result<()> {
    let store = match js.get_key_value(CHAIN_BUCKET).await {
@@ -44,6 +50,7 @@ pub async fn record_node(
    };
    let node = ChainNode {
        question_id: question_id.to_string(),
+        alternative: Some(alternative.to_string()),
        timestamp_ms,
    };
    store.put(chain_hash, serde_json::to_vec(&node)?.into()).await?;
@@ -0,0 +1,243 @@
+//! Loading a content repo from Gitea, and the NATS-signalled reload
+//! that hot-swaps it (last-good content is kept on any failure). Every
+//! fetch goes through `crate::http`: bounded in time and size.
+
+use super::*;
+
+/// Fetches and parses `site.yaml` from the content repo root. A fetch
+/// failure (typically 404 - the file is optional) yields the default
+/// config; a file that exists but doesn't parse or validate is a real
+/// error, surfaced at boot rather than papered over.
+#[cfg(feature = "ssr")]
+pub async fn load_site_from_gitea(repo_url: &str, branch: &str) -> anyhow::Result<SiteConfig> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    let api_base = gitea_api_base(repo_url)?;
+    let raw = match fetch_gitea_file(&api_base, &owner, &repo, branch, "site.yaml").await {
+        Ok(raw) => raw,
+        Err(e) => {
+            tracing::info!("no site.yaml in content repo ({e}), using default branding");
+            return Ok(SiteConfig::default());
+        }
+    };
+    let site: SiteConfig =
+        serde_yaml::from_str(&raw).map_err(|e| anyhow::anyhow!("parsing site.yaml: {e}"))?;
+    site.validate()?;
+    Ok(site)
+}
+
+/// Extracts `scheme://host` from a repo's normal browser URL - the
+/// Gitea API base every helper in this module builds requests against.
+#[cfg(feature = "ssr")]
+/// `{gitea}/api/v1/repos/{owner}/{repo}/raw` - the base
+/// `site_asset_handler` proxies content-shipped files from.
+#[cfg(feature = "ssr")]
+pub fn gitea_raw_base(repo_url: &str) -> anyhow::Result<String> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    Ok(format!("{}/api/v1/repos/{owner}/{repo}/raw", gitea_api_base(repo_url)?))
+}
+
+#[cfg(feature = "ssr")]
+pub fn gitea_api_base(repo_url: &str) -> anyhow::Result<String> {
+    let parsed = url::Url::parse(repo_url)
+        .map_err(|e| anyhow::anyhow!("parsing repo url {repo_url}: {e}"))?;
+    Ok(format!(
+        "{}://{}",
+        parsed.scheme(),
+        parsed
+            .host_str()
+            .ok_or_else(|| anyhow::anyhow!("no host in repo url {repo_url}"))?
+    ))
+}
+
+/// Splits a repo's normal browser URL into `(owner, repo)` - shared by
+/// every loader in this module that needs to build a Gitea contents API
+/// URL (`load_questions_from_gitea`, `load_aggregates_from_gitea`).
+#[cfg(feature = "ssr")]
+pub(crate) fn parse_owner_repo(repo_url: &str) -> anyhow::Result<(String, String)> {
+    let parsed = url::Url::parse(repo_url)
+        .map_err(|e| anyhow::anyhow!("parsing content repo url {repo_url}: {e}"))?;
+    let mut segments = parsed
+        .path_segments()
+        .ok_or_else(|| anyhow::anyhow!("no path in content repo url {repo_url}"))?;
+    let owner = segments
+        .next()
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| anyhow::anyhow!("missing owner in content repo url {repo_url}"))?
+        .to_string();
+    let repo = segments
+        .next()
+        .filter(|s| !s.is_empty())
+        .ok_or_else(|| anyhow::anyhow!("missing repo name in content repo url {repo_url}"))?
+        .to_string();
+    Ok((owner, repo))
+}
+
+/// Fetches one file from a Gitea repo's contents API and returns its raw
+/// text - the single-file counterpart to `load_questions_from_gitea`'s
+/// directory-listing loop, used by `load_aggregates_from_gitea` for the
+/// one `aggregates.yaml` file at the repo root.
+#[cfg(feature = "ssr")]
+pub(crate) async fn fetch_gitea_file(
+    api_base: &str,
+    owner: &str,
+    repo: &str,
+    branch: &str,
+    path: &str,
+) -> anyhow::Result<String> {
+    let meta_url = format!("{api_base}/api/v1/repos/{owner}/{repo}/contents/{path}?ref={branch}");
+    let meta_text = crate::http::get_text(&meta_url, crate::http::GITEA_CAP)
+        .await
+        .map_err(|e| anyhow::anyhow!("fetching {meta_url}: {e}"))?;
+    let meta: serde_json::Value = serde_json::from_str(&meta_text)
+        .map_err(|e| anyhow::anyhow!("parsing contents response from {meta_url}: {e}"))?;
+    let download_url = meta
+        .get("download_url")
+        .and_then(|v| v.as_str())
+        .ok_or_else(|| anyhow::anyhow!("no download_url for {path}"))?;
+    crate::http::get_text(download_url, crate::http::GITEA_CAP)
+        .await
+        .map_err(|e| anyhow::anyhow!("fetching {path}: {e}"))
+}
+
+/// Fetches and parses `aggregates.yaml` from the repo root (sibling to
+/// the pages `subdir`, so the "every yaml under subdir is a page"
+/// convention needs no exclusion). A malformed file fails here, before
+/// ever reaching `AppState`.
+#[cfg(feature = "ssr")]
+pub async fn load_aggregates_from_gitea(
+    repo_url: &str,
+    branch: &str,
+) -> anyhow::Result<std::collections::HashMap<String, crate::aggregates::AggregateSchema>> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    let api_base = gitea_api_base(repo_url)?;
+    let raw = fetch_gitea_file(&api_base, &owner, &repo, branch, "aggregates.yaml").await?;
+    crate::aggregates::parse_aggregates_yaml(&raw)
+}
+
+#[cfg(feature = "ssr")]
+pub async fn load_questions_from_gitea(
+    repo_url: &str,
+    branch: &str,
+    subdir: &str,
+) -> anyhow::Result<std::collections::HashMap<String, Question>> {
+    let (owner, repo) = parse_owner_repo(repo_url)?;
+    let api_base = gitea_api_base(repo_url)?;
+
+    // One recursive git-trees call for the whole repo instead of a
+    // contents listing per directory - the tree IS the router now, so
+    // nested files matter.
+    let tree_url =
+        format!("{api_base}/api/v1/repos/{owner}/{repo}/git/trees/{branch}?recursive=true");
+    let listing = crate::http::get_text(&tree_url, crate::http::GITEA_CAP)
+        .await
+        .map_err(|e| anyhow::anyhow!("listing {tree_url}: {e}"))?;
+    let tree: serde_json::Value = serde_json::from_str(&listing)
+        .map_err(|e| anyhow::anyhow!("parsing tree from {tree_url}: {e}"))?;
+    if tree.get("truncated").and_then(|v| v.as_bool()) == Some(true) {
+        anyhow::bail!("git tree listing for {owner}/{repo} was truncated - repo too large");
+    }
+    let prefix = format!("{subdir}/");
+
+    let mut files = Vec::new();
+    for entry in tree
+        .get("tree")
+        .and_then(|v| v.as_array())
+        .map(|v| v.as_slice())
+        .unwrap_or_default()
+    {
+        let path = entry.get("path").and_then(|v| v.as_str()).unwrap_or("");
+        if entry.get("type").and_then(|v| v.as_str()) != Some("blob")
+            || !path.starts_with(&prefix)
+            || !path.ends_with(".yaml")
+        {
+            continue;
+        }
+        // Brackets (dynamic pages like `[record].yaml`) must be
+        // percent-encoded in the raw URL's path.
+        let encoded = path.replace('[', "%5B").replace(']', "%5D");
+        let raw_url = format!("{api_base}/api/v1/repos/{owner}/{repo}/raw/{encoded}?ref={branch}");
+        let raw = crate::http::get_text(&raw_url, crate::http::GITEA_CAP)
+            .await
+            .map_err(|e| anyhow::anyhow!("fetching {path}: {e}"))?;
+        files.push((path[prefix.len()..].to_string(), raw));
+    }
+    build_questions(&files)
+}
+
+/// Published by the content repo's own CI (after it lints a push) to
+/// tell every running instance to pick up the change - a plain fire
+/// and forget NATS publish, no payload, matching `events.rs`'s
+/// `ANSWERS_SUBJECT` pattern.
+#[cfg(feature = "ssr")]
+pub const CONTENT_RELOAD_SUBJECT: &str = "portal.content.reload";
+
+/// Runs for the life of the process: re-fetches `repo_url`/`branch` and
+/// atomically swaps both `questions` and `aggregates` on every
+/// `CONTENT_RELOAD_SUBJECT` message - the two only ever swap together,
+/// after both have loaded and validated successfully, so a reader never
+/// sees pages that reference a half-updated state graph. A fetch/parse
+/// failure logs and keeps serving the last-good content rather than
+/// clearing it - a bad push to the content repo (which should already
+/// have been caught by its own lint step) doesn't take the site down.
+#[cfg(feature = "ssr")]
+pub async fn watch_for_reload(
+    nats: async_nats::Client,
+    repo_url: String,
+    branch: String,
+    subdir: String,
+    questions: std::sync::Arc<arc_swap::ArcSwap<std::collections::HashMap<String, Question>>>,
+    aggregates: std::sync::Arc<
+        arc_swap::ArcSwap<std::collections::HashMap<String, crate::aggregates::AggregateSchema>>,
+    >,
+    site: std::sync::Arc<arc_swap::ArcSwap<SiteConfig>>,
+    access: std::sync::Arc<arc_swap::ArcSwap<crate::access::Policy>>,
+) {
+    let mut sub = match nats.subscribe(CONTENT_RELOAD_SUBJECT).await {
+        Ok(sub) => sub,
+        Err(e) => {
+            tracing::error!(error = %e, "failed to subscribe to content reload subject");
+            return;
+        }
+    };
+    use futures::StreamExt;
+    while sub.next().await.is_some() {
+        let loaded_aggregates = match load_aggregates_from_gitea(&repo_url, &branch).await {
+            Ok(loaded) => with_builtin_aggregates(loaded),
+            Err(e) => {
+                tracing::error!(error = %e, "aggregates.yaml reload failed, keeping last-good content");
+                continue;
+            }
+        };
+        // Branding swaps with the same all-or-nothing rule: a
+        // present-but-broken site.yaml keeps last-good everything
+        // (load_site distinguishes "absent" - a normal default - from
+        // "present but invalid").
+        let loaded_site = match load_site_from_gitea(&repo_url, &branch).await {
+            Ok(loaded) => loaded,
+            Err(e) => {
+                tracing::error!(error = %e, "site.yaml reload failed, keeping last-good content");
+                continue;
+            }
+        };
+        match load_questions_from_gitea(&repo_url, &branch, &subdir).await {
+            Ok(loaded) => {
+                if let Err(e) = validate_questions(&loaded, &loaded_aggregates) {
+                    tracing::error!(error = %e, "content reload failed validation, keeping last-good content");
+                    continue;
+                }
+                let count = loaded.len();
+                // The policy is compiled from the content it gates, so
+                // it swaps in the same breath.
+                access.store(std::sync::Arc::new(crate::access::Policy::from_content(&loaded, &loaded_aggregates)));
+                questions.store(std::sync::Arc::new(loaded));
+                aggregates.store(std::sync::Arc::new(loaded_aggregates));
+                site.store(std::sync::Arc::new(loaded_site));
+                tracing::info!(count, "reloaded content");
+            }
+            Err(e) => {
+                tracing::error!(error = %e, "content reload failed, keeping last-good content");
+            }
+        }
+    }
+}
+
@@ -0,0 +1,206 @@
+//! The Axum routes that expose content and buckets outside the Leptos
+//! app: content-shipped assets proxied same-origin, repo info for the
+//! showcase, and the automation read API over KV buckets.
+
+use super::*;
+
+/// A repo-relative asset path portal is willing to proxy from the
+/// content repo: plain segments only - no traversal, no leading slash,
+/// no scheme - so `/site/<path>` can only ever reach the content repo.
+pub fn is_safe_site_path(path: &str) -> bool {
+    !path.is_empty()
+        && !path.starts_with('/')
+        && path.split('/').all(|seg| {
+            !seg.is_empty()
+                && seg != ".."
+                && seg
+                    .chars()
+                    .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')
+        })
+}
+
+/// A public Gitea repo's basic info - what `resolve_gitea_repo` returns
+/// for the prosekit editor's repo-embed node to render as a static
+/// card, baked in once at embed time rather than re-fetched by every
+/// reader (an emailed newsletter can't run JS to do that anyway).
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct GiteaRepoInfo {
+    pub owner: String,
+    pub repo: String,
+    pub description: String,
+    pub url: String,
+}
+
+#[derive(Deserialize)]
+#[cfg(feature = "ssr")]
+pub struct GiteaRepoQuery {
+    pub owner: String,
+    pub repo: String,
+}
+
+/// `GET /site/{*path}` - serves a file from the content repo's default
+/// branch same-origin, so content-shipped assets (the hero module,
+/// its stylesheet) are importable by the page: Gitea's raw endpoint
+/// sends no CORS headers, and an ES module import across origins is
+/// refused without them. Path is validated to plain segments
+/// (`is_safe_site_path`), the response revalidates like /pkg
+/// (Cache-Control: no-cache) so a content push shows up on reload.
+#[cfg(feature = "ssr")]
+pub async fn site_asset_handler(
+    axum::extract::State(state): axum::extract::State<crate::server::AppState>,
+    axum::extract::Path(path): axum::extract::Path<String>,
+) -> axum::response::Response {
+    use axum::http::{header, StatusCode};
+    use axum::response::IntoResponse;
+
+    if !is_safe_site_path(&path) {
+        return (StatusCode::BAD_REQUEST, "invalid asset path").into_response();
+    }
+    let url = format!("{}/{path}?ref={}", state.content_raw_base, state.content_branch);
+    let resp = match crate::http::client().get(&url).send().await.and_then(|r| r.error_for_status()) {
+        Ok(r) => r,
+        Err(e) => {
+            tracing::warn!("site asset {path}: {e}");
+            return (StatusCode::NOT_FOUND, "no such site asset").into_response();
+        }
+    };
+    let bytes = match crate::http::bytes(resp, crate::http::ASSET_CAP).await {
+        Ok(b) => axum::body::Bytes::from(b),
+        Err(e) => return (StatusCode::BAD_GATEWAY, e.to_string()).into_response(),
+    };
+    let mime = match path.rsplit('.').next() {
+        Some("js") | Some("mjs") => "text/javascript; charset=utf-8",
+        Some("css") => "text/css; charset=utf-8",
+        Some("svg") => "image/svg+xml",
+        Some("json") => "application/json",
+        Some("png") => "image/png",
+        Some("webp") => "image/webp",
+        Some("avif") => "image/avif",
+        Some("ico") => "image/x-icon",
+        Some("woff2") => "font/woff2",
+        _ => "application/octet-stream",
+    };
+    (
+        [(header::CONTENT_TYPE, mime), (header::CACHE_CONTROL, "no-cache")],
+        bytes,
+    )
+        .into_response()
+}
+
+/// Looks up `owner/repo` on the same Gitea instance content is loaded
+/// from (`AppState.gitea_base`) - a raw Axum handler (mounted at
+/// `/gitea-repo` in `main.rs`), not a Leptos server fn, since the
+/// caller here is the prosekit editor's own paste-to-embed rule (see
+/// `prosekit-editor.js`) doing a plain `fetch`, the same reason
+/// `/upload` (`src/upload.rs`) is a raw handler rather than a `#[server]`
+/// fn. Keeping this server-resolved (rather than having the browser
+/// call Gitea's API directly) is consistent with every other backing
+/// store in this app, and sidesteps needing a CORS allowance on Gitea's
+/// side just for this. No auth, same as content loading - resolves
+/// only what's already public.
+#[cfg(feature = "ssr")]
+pub async fn gitea_repo_handler(
+    axum::extract::State(state): axum::extract::State<crate::server::AppState>,
+    axum::extract::Query(query): axum::extract::Query<GiteaRepoQuery>,
+) -> Result<axum::Json<GiteaRepoInfo>, (axum::http::StatusCode, String)> {
+    let is_safe_segment = |s: &str| {
+        !s.is_empty()
+            && s.chars()
+                .all(|c| c.is_ascii_alphanumeric() || c == '-' || c == '_' || c == '.')
+    };
+    if !is_safe_segment(&query.owner) || !is_safe_segment(&query.repo) {
+        return Err((axum::http::StatusCode::BAD_REQUEST, "invalid owner/repo".to_string()));
+    }
+    let GiteaRepoQuery { owner, repo } = query;
+
+    let api_url = format!("{}/api/v1/repos/{owner}/{repo}", state.gitea_base);
+    let body = crate::http::get_text(&api_url, crate::http::GITEA_CAP)
+        .await
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, format!("fetching {api_url}: {e}")))?;
+    let json: serde_json::Value = serde_json::from_str(&body).map_err(|e| {
+        (
+            axum::http::StatusCode::BAD_GATEWAY,
+            format!("parsing repo info from {api_url}: {e}"),
+        )
+    })?;
+
+    Ok(axum::Json(GiteaRepoInfo {
+        owner: owner.clone(),
+        repo: repo.clone(),
+        description: json
+            .get("description")
+            .and_then(|v| v.as_str())
+            .unwrap_or("")
+            .to_string(),
+        url: json
+            .get("html_url")
+            .and_then(|v| v.as_str())
+            .map(|s| s.to_string())
+            .unwrap_or_else(|| format!("{}/{owner}/{repo}", state.gitea_base)),
+    }))
+}
+
+/// Lists every entry in a NATS KV bucket as JSON - a raw Axum handler
+/// (mounted at `/automation/kv/{bucket}` in `main.rs`), for backing
+/// automations (e.g. an n8n workflow reading `portal_subscribers` to
+/// send a newsletter) that aren't a signed-in browser session and so
+/// can't go through `resource::get_resource`'s Kanidm-group check.
+/// Gated by a single shared bearer token (`AUTOMATION_READ_TOKEN`) -
+/// deliberately not per-caller/per-bucket scoped, since every current
+/// caller is a trusted internal automation, not a third party. Read
+/// only, matching `get_resource`'s own "reads can be public/shared,
+/// mutations always need real identity" split - nothing here writes.
+#[cfg(feature = "ssr")]
+pub async fn automation_kv_handler(
+    axum::extract::State(state): axum::extract::State<crate::server::AppState>,
+    axum::extract::Path(bucket): axum::extract::Path<String>,
+    headers: axum::http::HeaderMap,
+) -> Result<axum::Json<serde_json::Value>, (axum::http::StatusCode, String)> {
+    let expected = std::env::var("AUTOMATION_READ_TOKEN").unwrap_or_default();
+    let presented = headers
+        .get(axum::http::header::AUTHORIZATION)
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.strip_prefix("Bearer "))
+        .unwrap_or("");
+    if expected.is_empty() || presented != expected {
+        return Err((axum::http::StatusCode::UNAUTHORIZED, "unauthorized".to_string()));
+    }
+    // The token authenticates the automation service; what it may read
+    // is the policy's to say, like every other principal.
+    let decision = crate::access::decide_and_publish(
+        &state.nats,
+        &state.access.load(),
+        &crate::access::Principal::Service { name: "automation".to_string() },
+        crate::access::Action::AutomationRead,
+        &crate::access::Resource::Bucket { name: bucket.clone() },
+        serde_json::json!({}),
+    );
+    if !decision.allow {
+        return Err((axum::http::StatusCode::FORBIDDEN, "not authorized".to_string()));
+    }
+
+    let store = state
+        .jetstream
+        .get_key_value(&bucket)
+        .await
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, format!("bucket unavailable: {e}")))?;
+
+    use futures::TryStreamExt;
+    let keys: Vec<String> = store
+        .keys()
+        .await
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, e.to_string()))?
+        .try_collect()
+        .await
+        .map_err(|e| (axum::http::StatusCode::BAD_GATEWAY, e.to_string()))?;
+    let mut items = Vec::new();
+    for key in keys {
+        if let Ok(Some(bytes)) = store.get(&key).await {
+            if let Ok(value) = serde_json::from_slice::<serde_json::Value>(&bytes) {
+                items.push(value);
+            }
+        }
+    }
+    Ok(axum::Json(serde_json::Value::Array(items)))
+}
+
@@ -0,0 +1,120 @@
+//! Inline markdown for descriptions: links on a short allow-list of
+//! schemes, images gated and framed, with layout hints read from the
+//! image title. Never raw HTML.
+
+/// Descriptions are inline markdown: `[text](https://…)` links,
+/// `*emphasis*`, `**strong**`, `` `code` ``. Block structure is
+/// flattened (a description is one paragraph) and raw HTML in the
+/// source is dropped, so content can link out without being able to
+/// inject markup. Link targets are limited to https, mailto and
+/// site-relative paths; anything else renders as plain text.
+pub fn render_inline_markdown(text: &str) -> String {
+    use pulldown_cmark::{html, Event, Options, Parser, Tag, TagEnd};
+    let parser = Parser::new_ext(text, Options::empty());
+    let mut in_link = 0usize;
+    let mut in_dropped_image = 0usize;
+    let filtered = parser.filter_map(|event| match event {
+        Event::Html(_) | Event::InlineHtml(_) => None,
+        Event::Start(Tag::Paragraph) | Event::End(TagEnd::Paragraph) => None,
+        Event::SoftBreak => Some(Event::Text(" ".into())),
+        Event::Start(Tag::Link { dest_url, .. })
+            if !(dest_url.starts_with("https://")
+                || dest_url.starts_with("mailto:")
+                || dest_url.starts_with("tel:")
+                || dest_url.starts_with('/')) =>
+        {
+            in_link += 1;
+            None
+        }
+        Event::End(TagEnd::Link) if in_link > 0 => {
+            in_link -= 1;
+            None
+        }
+        // Images take the same gate as links: https or same-origin
+        // only - no data:, no plain http. Unlike a dropped link (whose
+        // label is real text worth keeping), a dropped image's alt
+        // text is a caption for something that isn't there - swallow it.
+        Event::Start(Tag::Image { dest_url, .. })
+            if !(dest_url.starts_with("https://") || dest_url.starts_with('/')) =>
+        {
+            in_dropped_image += 1;
+            None
+        }
+        Event::End(TagEnd::Image) if in_dropped_image > 0 => {
+            in_dropped_image -= 1;
+            None
+        }
+        Event::Text(_) if in_dropped_image > 0 => None,
+        other => Some(other),
+    });
+    let mut out = String::new();
+    html::push_html(&mut out, filtered);
+    apply_image_hints(out.trim())
+}
+
+/// Translate a markdown image's title (`![alt](url "right 9rem")`)
+/// into layout: `left`/`right` float via a class, a bare number
+/// (optionally with `rem`) into a validated `max-width`. Unknown
+/// tokens are ignored; the title attribute is dropped either way.
+/// Only touches `<img>` tags in our own render output, and only ever
+/// emits a numeric max-width - no arbitrary CSS reaches the page.
+pub(crate) fn apply_image_hints(html: &str) -> String {
+    let mut out = String::new();
+    let mut rest = html;
+    while let Some(pos) = rest.find("<img ") {
+        out.push_str(&rest[..pos]);
+        let after = &rest[pos..];
+        let end = after.find('>').map(|e| e + 1).unwrap_or(after.len());
+        out.push_str(&rewrite_img_tag(&after[..end]));
+        rest = &after[end..];
+    }
+    out.push_str(rest);
+    out
+}
+
+pub(crate) fn rewrite_img_tag(tag: &str) -> String {
+    // Pull the title value, if any.
+    let title = tag
+        .find("title=\"")
+        .map(|i| &tag[i + 7..])
+        .and_then(|r| r.find('"').map(|e| &r[..e]))
+        .unwrap_or("");
+
+    let mut class = String::new();
+    let mut max_rem: Option<f32> = None;
+    for tok in title.split_whitespace() {
+        match tok {
+            "left" => class = "md-float-left".into(),
+            "right" => class = "md-float-right".into(),
+            other => {
+                if let Ok(n) = other.trim_end_matches("rem").parse::<f32>() {
+                    if n > 0.0 && n <= 60.0 {
+                        max_rem = Some(n);
+                    }
+                }
+            }
+        }
+    }
+
+    // Strip the title attribute from the tag.
+    let mut cleaned = tag.to_string();
+    if let Some(i) = cleaned.find(" title=\"") {
+        if let Some(e) = cleaned[i + 8..].find('"') {
+            cleaned.replace_range(i..i + 8 + e + 1, "");
+        }
+    }
+
+    // Inject class/style right after `<img`.
+    let mut attrs = String::new();
+    if !class.is_empty() {
+        attrs.push_str(&format!(" class=\"{class}\""));
+    }
+    if let Some(n) = max_rem {
+        attrs.push_str(&format!(" style=\"max-width:{n}rem\""));
+    }
+    if attrs.is_empty() {
+        return cleaned;
+    }
+    cleaned.replacen("<img", &format!("<img{attrs}"), 1)
+}
+
@@ -0,0 +1,319 @@
+//! What a content repo must satisfy before it serves: every action
+//! lands on a page, every transition is one the state machine allows,
+//! every recorded bucket is read back somewhere, and the built-in
+//! aggregates the runtime owns are always present.
+
+#[allow(unused_imports)] // the browser build sees fewer items
+use super::*;
+
+/// A relay must be a ws:// or wss:// URL - shared between site.yaml's
+/// hero and `Requirement.relay` validation.
+#[cfg(feature = "ssr")]
+pub fn validate_relay_url(relay: &str) -> anyhow::Result<()> {
+    let parsed = url::Url::parse(relay)
+        .map_err(|e| anyhow::anyhow!("relay {relay:?} is not a valid URL: {e}"))?;
+    if !matches!(parsed.scheme(), "ws" | "wss") {
+        anyhow::bail!("relay {relay:?} must use the ws:// or wss:// scheme");
+    }
+    Ok(())
+}
+
+/// Validates every declared transition target (`SelfTransition.to`,
+/// `ResourceSpec.transitions[].to`) against `aggregates` - the real
+/// state graph loaded from `aggregates.yaml` - for every bucket that
+/// has one declared. A bucket with no entry in `aggregates` is left
+/// alone entirely (no validation applied): not every bucket needs to
+/// be event-sourced to keep working. Called on every content
+/// load/reload (`watch_for_reload`, `main.rs`'s boot path) and by the
+/// standalone `question-lint` binary, so a YAML typo becomes a caught,
+/// logged rejection instead of a silently-accepted, later-broken
+/// string.
+/// Bucket the runtime keeps for announced pages (`Question.event`):
+/// one record per event question, `announced` while the window is
+/// open, `awaiting_summary` once it closes - the "post what happened"
+/// task a desk reading this bucket picks up - and `summarized` when an
+/// owner marks it done. Declared here, not in content, because the
+/// runtime's sweeper (`announce.rs`) is what moves the records.
+pub const EVENTS_BUCKET: &str = "portal_events";
+
+#[cfg(feature = "ssr")]
+const BUILTIN_AGGREGATES_YAML: &str = "\
+aggregates:
+  - bucket: portal_events
+    initial: announced
+    states:
+      announced: { event: announced }
+      awaiting_summary: { event: ended }
+      summarized: { event: summarized }
+    transitions:
+      announced: [awaiting_summary, summarized]
+      awaiting_summary: [summarized]
+  - bucket: portal_invites
+    attended_by: the inviting group's own desk, or the link in the invite event
+    initial: open
+    states:
+      open: { event: invited }
+      done: { event: done }
+    transitions:
+      open: [done]
+";
+
+/// Adds the runtime's own state graphs to a content repo's. Content
+/// wins if it declares the same bucket (say, to add states).
+#[cfg(feature = "ssr")]
+pub fn with_builtin_aggregates(
+    mut aggregates: std::collections::HashMap<String, crate::aggregates::AggregateSchema>,
+) -> std::collections::HashMap<String, crate::aggregates::AggregateSchema> {
+    let builtin = crate::aggregates::parse_aggregates_yaml(BUILTIN_AGGREGATES_YAML)
+        .expect("builtin aggregates yaml is valid");
+    for (bucket, schema) in builtin {
+        aggregates.entry(bucket).or_insert(schema);
+    }
+    aggregates
+}
+
+/// True when some kv resource in the content reads `bucket` - the
+/// attended-bucket check, exposed so the lint can warn about the
+/// runtime's own `portal_events` (a warning, not a failure: a repo
+/// with no event pages has nothing to attend).
+#[cfg(feature = "ssr")]
+pub fn bucket_is_read(questions: &std::collections::HashMap<String, Question>, bucket: &str) -> bool {
+    questions.values().any(|q| {
+        q.alternatives.iter().any(|a| {
+            a.features
+                .iter()
+                .any(|f| f.resource.as_ref().and_then(|r| r.bucket()).is_some_and(|b| b == bucket))
+        })
+    })
+}
+
+#[cfg(feature = "ssr")]
+pub fn validate_questions(
+    questions: &std::collections::HashMap<String, Question>,
+    aggregates: &std::collections::HashMap<String, crate::aggregates::AggregateSchema>,
+) -> anyhow::Result<()> {
+    for question in questions.values() {
+        if let Some(event) = &question.event {
+            if question.is_dynamic() {
+                anyhow::bail!("question {:?}: a dynamic page can't carry an event", question.id);
+            }
+            if let Err(e) = event.window_ms() {
+                anyhow::bail!("question {:?}: event: {e}", question.id);
+            }
+        }
+        if let Some(target) = &question.requires_chain {
+            if !questions.contains_key(target) {
+                anyhow::bail!(
+                    "question {:?}: requires_chain {:?} does not match any declared question id",
+                    question.id,
+                    target
+                );
+            }
+        }
+        for alternative in &question.alternatives {
+            // A dangling action is a literal dead end: the submit
+            // button navigates to "Nothing here".
+            if let Some(action) = &alternative.action {
+                if action.contains('{') {
+                    // Placeholders are filled at submit time; the
+                    // shape must land on a dynamic page once filled.
+                    let probe = template_action(action, &serde_json::json!({}));
+                    let filled = {
+                        let mut a = action.clone();
+                        while let (Some(i), Some(j)) = (a.find('{'), a.find('}')) {
+                            a.replace_range(i..=j, "x");
+                        }
+                        a
+                    };
+                    let _ = probe;
+                    // Match the pattern itself: resolve_question would
+                    // hand back a clone whose id is already concrete.
+                    let lands = questions
+                        .values()
+                        .any(|q| q.is_dynamic() && path_matches(&q.id, &filled).is_some());
+                    if lands {
+                        continue;
+                    }
+                    anyhow::bail!(
+                        "question {:?} alternative {:?}: templated action {:?} must land on a dynamic page ([name].yaml)",
+                        question.id, alternative.name, action
+                    );
+                }
+                match questions.get(action) {
+                    None => anyhow::bail!(
+                        "question {:?} alternative {:?}: action {:?} does not match any declared question id",
+                        question.id, alternative.name, action
+                    ),
+                    // A dynamic page needs a concrete segment value to
+                    // be a URL - a submit button can't supply one.
+                    Some(target) if target.is_dynamic() => anyhow::bail!(
+                        "question {:?} alternative {:?}: action {:?} targets a dynamic page - actions must name a concrete question",
+                        question.id, alternative.name, action
+                    ),
+                    Some(_) => {}
+                }
+            }
+            if let Some(invite) = &alternative.invite {
+                if question.qualifies.is_none() {
+                    anyhow::bail!(
+                        "question {:?} alternative {:?}: an invite into {:?} must sit on a page gated by `qualifies` - that group is who may extend it",
+                        question.id, alternative.name, invite.group
+                    );
+                }
+                let has = |name: &str| {
+                    alternative
+                        .features
+                        .iter()
+                        .flat_map(|f| &f.requirements)
+                        .any(|r| r.name == name && !r.optional)
+                };
+                if !has("name") || !has("email") {
+                    anyhow::bail!(
+                        "question {:?} alternative {:?}: an invite must collect required `name` and `email` fields",
+                        question.id, alternative.name
+                    );
+                }
+            }
+            if let Some(st) = &alternative.self_transition {
+                if let Some(schema) = aggregates.get(&st.bucket) {
+                    if !schema.has_state(&st.to) {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?}: self_transition.to {:?} is not a declared state for bucket {:?}",
+                            question.id, alternative.name, st.to, st.bucket
+                        );
+                    }
+                }
+            }
+            // Bind targets resolve across the whole alternative, same
+            // scope as the signal maps the renderer builds.
+            let sibling_names: std::collections::HashSet<&str> = alternative
+                .features
+                .iter()
+                .flat_map(|f| f.requirements.iter())
+                .map(|r| r.name.as_str())
+                .collect();
+            for feature in &alternative.features {
+                for requirement in &feature.requirements {
+                    if requirement.kind == "select"
+                        && requirement.resource.is_none()
+                        && requirement.options.is_empty()
+                    {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: select but declares neither a resource nor inline options",
+                            question.id, alternative.name, feature.name, requirement.name
+                        );
+                    }
+                    if let Some(relay) = &requirement.relay {
+                        if requirement.kind != "gesture" && requirement.kind != "voice" {
+                            anyhow::bail!(
+                                "question {:?} alternative {:?} feature {:?}: requirement {:?} declares relay but is type {:?} - relay only makes sense on type: gesture or voice",
+                                question.id, alternative.name, feature.name, requirement.name, requirement.kind
+                            );
+                        }
+                        validate_relay_url(relay).map_err(|e| anyhow::anyhow!(
+                            "question {:?} alternative {:?} feature {:?}: requirement {:?}: {e}",
+                            question.id, alternative.name, feature.name, requirement.name
+                        ))?;
+                    }
+                    if requirement.kind == "gesture"
+                        && (requirement.resource.is_some() || requirement.bind.is_some())
+                    {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: requirement {:?} is type: gesture - it draws its value, it can't also load one from a resource or bind",
+                            question.id, alternative.name, feature.name, requirement.name
+                        );
+                    }
+                    if let Some(bind) = &requirement.bind {
+                        if bind.field == requirement.name
+                            || !sibling_names.contains(bind.field.as_str())
+                        {
+                            anyhow::bail!(
+                                "question {:?} alternative {:?} feature {:?}: requirement {:?} binds to {:?}, which is not another requirement on this alternative",
+                                question.id, alternative.name, feature.name, requirement.name, bind.field
+                            );
+                        }
+                    }
+                }
+                let Some(resource) = &feature.resource else {
+                    continue;
+                };
+                let Some(bucket) = resource.bucket() else {
+                    continue;
+                };
+                let Some(schema) = aggregates.get(bucket) else {
+                    continue;
+                };
+                for transition in &resource.transitions {
+                    if !schema.has_state(&transition.from) {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: transition.from {:?} is not a declared state for bucket {:?}",
+                            question.id, alternative.name, feature.name, transition.from, bucket
+                        );
+                    }
+                    if !schema.has_state(&transition.to) {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: transition.to {:?} is not a declared state for bucket {:?}",
+                            question.id, alternative.name, feature.name, transition.to, bucket
+                        );
+                    }
+                    if !schema.allowed(&transition.from).iter().any(|s| s == &transition.to) {
+                        anyhow::bail!(
+                            "question {:?} alternative {:?} feature {:?}: transition {:?} -> {:?} is not a declared edge for bucket {:?}",
+                            question.id, alternative.name, feature.name, transition.from, transition.to, bucket
+                        );
+                    }
+                }
+            }
+        }
+    }
+
+    // Attended buckets: no publicly collected answer may land somewhere
+    // nothing reads. Every `record_as` bucket must either be read back
+    // by some Kv resource in this same content repo (a desk or listing)
+    // or carry an explicit `attended_by:` annotation in aggregates.yaml
+    // naming the automation that consumes it. This is a contract, not a
+    // convention, because convention already failed once: a question
+    // was dropped and its bucket - answers included - silently fell out
+    // of every reader's view.
+    let mut read_buckets = std::collections::HashSet::new();
+    let note_resource = |spec: &ResourceSpec, set: &mut std::collections::HashSet<String>| {
+        if let ResourceSource::Kv { bucket } = &spec.source {
+            set.insert(bucket.clone());
+        }
+    };
+    for question in questions.values() {
+        for alternative in &question.alternatives {
+            for feature in &alternative.features {
+                if let Some(spec) = &feature.resource {
+                    note_resource(spec, &mut read_buckets);
+                }
+                for requirement in &feature.requirements {
+                    if let Some(spec) = &requirement.resource {
+                        note_resource(spec, &mut read_buckets);
+                    }
+                    if let Some(bind) = &requirement.bind {
+                        note_resource(&bind.resource, &mut read_buckets);
+                    }
+                }
+            }
+        }
+    }
+    for question in questions.values() {
+        for alternative in &question.alternatives {
+            if let Some(bucket) = &alternative.record_as {
+                let attended = read_buckets.contains(bucket)
+                    || aggregates
+                        .get(bucket)
+                        .is_some_and(|schema| schema.attended_by.is_some());
+                if !attended {
+                    anyhow::bail!(
+                        "question {:?} alternative {:?}: record_as {bucket:?} is unattended - no page reads that bucket back, and aggregates.yaml declares no attended_by for it. Add a desk/listing resource over it, or annotate the automation that consumes it.",
+                        question.id, alternative.name
+                    );
+                }
+            }
+        }
+    }
+    Ok(())
+}
+
@@ -0,0 +1,64 @@
+//! The one outbound HTTP client, bounded. Every server-side fetch -
+//! Gitea content at boot and on reload, the raw-asset proxy, the
+//! repo-info endpoint, and the content-declared `url` resource - goes
+//! through here, so a slow or oversized upstream can cost a request at
+//! most `TIMEOUT` and `cap` bytes, never a thread or the heap. Before
+//! this module each call site built its own client with no timeout and
+//! read whole bodies with `.text()`.
+#![cfg(feature = "ssr")]
+
+use std::sync::OnceLock;
+use std::time::Duration;
+
+use openidconnect::reqwest;
+
+/// Whole-request budget: connect, headers, and body.
+pub const TIMEOUT: Duration = Duration::from_secs(20);
+const CONNECT_TIMEOUT: Duration = Duration::from_secs(5);
+
+/// A content-declared URL resource: JSON for one card.
+pub const URL_RESOURCE_CAP: usize = 2 * 1024 * 1024;
+/// A Gitea API reply or one content file (a tree listing, a YAML page).
+pub const GITEA_CAP: usize = 8 * 1024 * 1024;
+/// A content-shipped asset proxied to the browser (an image, a font).
+pub const ASSET_CAP: usize = 32 * 1024 * 1024;
+
+pub fn client() -> &'static reqwest::Client {
+    static CLIENT: OnceLock<reqwest::Client> = OnceLock::new();
+    CLIENT.get_or_init(|| {
+        reqwest::Client::builder()
+            .connect_timeout(CONNECT_TIMEOUT)
+            .timeout(TIMEOUT)
+            .redirect(reqwest::redirect::Policy::limited(5))
+            .user_agent(concat!("portal/", env!("CARGO_PKG_VERSION")))
+            .build()
+            .expect("a client with static options always builds")
+    })
+}
+
+/// Reads a body up to `cap` bytes; one byte more is an error, not a
+/// truncation, so a caller never parses half a document.
+pub async fn bytes(mut response: reqwest::Response, cap: usize) -> anyhow::Result<Vec<u8>> {
+    let hint = response.content_length().unwrap_or(0) as usize;
+    if hint > cap {
+        anyhow::bail!("response of {hint} bytes exceeds the cap of {cap}");
+    }
+    let mut out = Vec::with_capacity(hint.min(cap));
+    while let Some(chunk) = response.chunk().await? {
+        if out.len() + chunk.len() > cap {
+            anyhow::bail!("response exceeds the cap of {cap} bytes");
+        }
+        out.extend_from_slice(&chunk);
+    }
+    Ok(out)
+}
+
+pub async fn text(response: reqwest::Response, cap: usize) -> anyhow::Result<String> {
+    Ok(String::from_utf8(bytes(response, cap).await?)?)
+}
+
+/// `GET url`, status checked, body read under `cap`.
+pub async fn get_text(url: &str, cap: usize) -> anyhow::Result<String> {
+    let response = client().get(url).send().await?.error_for_status()?;
+    text(response, cap).await
+}
@@ -13,6 +13,15 @@ pub mod aggregates;
 #[cfg(feature = "ssr")]
 pub mod announce;

+#[cfg(feature = "ssr")]
+pub mod http;
+
+#[cfg(feature = "ssr")]
+pub mod access;
+
+#[cfg(feature = "ssr")]
+pub mod people;
+
 #[cfg(feature = "ssr")]
 pub mod server;

@@ -37,6 +37,7 @@ async fn main() -> anyhow::Result<()> {
    content::validate_questions(&questions, &aggregates)?;
    let site = content::load_site_from_gitea(&content_repo, &content_branch).await?;
    tracing::info!(count = questions.len(), repo = %content_repo, branch = %content_branch, "loaded content");
+    let access = Arc::new(arc_swap::ArcSwap::from_pointee(portal::access::Policy::from_content(&questions, &aggregates)));
    let questions = Arc::new(arc_swap::ArcSwap::from_pointee(questions));
    let aggregates = Arc::new(arc_swap::ArcSwap::from_pointee(aggregates));
    let site = Arc::new(arc_swap::ArcSwap::from_pointee(site));
@@ -75,7 +76,10 @@ async fn main() -> anyhow::Result<()> {
        questions.clone(),
        aggregates.clone(),
        site.clone(),
+        access.clone(),
    ));
+    // The same decisions, answerable by other apps over NATS.
+    tokio::spawn(portal::access::serve(nats.clone(), site_name_for_subjects(), access.clone()));

    let state = AppState {
        leptos_options: leptos_options.clone(),
@@ -84,6 +88,7 @@ async fn main() -> anyhow::Result<()> {
        questions,
        aggregates,
        site,
+        access,
        gitea_base,
        content_raw_base,
        content_branch: content_branch.clone(),
@@ -145,7 +150,13 @@ async fn main() -> anyhow::Result<()> {
        .route("/auth/callback", get(oidc::callback))
        .route("/auth/logout", get(oidc::logout))
        .route("/api/{*fn_name}", any(server_fn_handler))
-        .route("/upload", post(upload::upload))
+        // axum caps request bodies at 2 MB by default, which had made the
+        // 20 MB upload limit unreachable; raise the fence on this route only,
+        // with room for the multipart framing.
+        .route(
+            "/upload",
+            post(upload::upload).layer(axum::extract::DefaultBodyLimit::max(upload::MAX_UPLOAD_BYTES + 64 * 1024)),
+        )
        .route("/gitea-repo", get(content::gitea_repo_handler))
        // Content-shipped assets (hero module etc.), same-origin.
        .route("/site/{*path}", get(content::site_asset_handler))
@@ -201,3 +212,15 @@ fn main() {
    // The browser build is a cdylib; this stub only exists so `cargo check`
    // without features still succeeds.
 }
+
+#[cfg(feature = "ssr")]
+/// The site's name in NATS subjects (`portal.access.<site>.may`):
+/// `SITE_NAME`, folded to what a subject token allows.
+fn site_name_for_subjects() -> String {
+    let raw = std::env::var("SITE_NAME").unwrap_or_else(|_| "portal".to_string());
+    let folded: String = raw
+        .chars()
+        .map(|c| if c.is_ascii_alphanumeric() || c == '_' || c == '-' { c.to_ascii_lowercase() } else { '_' })
+        .collect();
+    if folded.is_empty() { "portal".to_string() } else { folded }
+}
@@ -0,0 +1,164 @@
+//! Onboarding a person into Kanidm from a desk, without an admin
+//! session: create the account, record their email, add them to the
+//! group, and mint a one-time link where they set their own password
+//! or passkey. Kanidm has no self-registration by design; a member of
+//! the business vouching for each person is the intended shape, and
+//! this is that, as a form.
+//!
+//! Talks to Kanidm's REST API with a service-account token
+//! (`KANIDM_API_TOKEN`, read-write) through the bounded client. The
+//! service account belongs to `idm_people_on_boarding`, which may
+//! create persons and issue first-credential resets and nothing else,
+//! so a leaked token cannot touch existing credentials or admins.
+#![cfg(feature = "ssr")]
+
+use serde::{Deserialize, Serialize};
+
+pub const INVITES_BUCKET: &str = "portal_invites";
+pub const INVITED_SUBJECT: &str = "portal.people.invited";
+
+/// What an invite produced: the account, and the link that sets it up.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct Invited {
+    pub username: String,
+    pub display_name: String,
+    pub email: String,
+    pub group: String,
+    /// Absent when the person already had an account: they were added
+    /// to the group and their credentials were left alone.
+    pub reset_link: Option<String>,
+    pub link_expires_ms: Option<i64>,
+    pub created: bool,
+}
+
+pub struct Kanidm {
+    base: String,
+    token: String,
+}
+
+impl Kanidm {
+    /// `None` when `KANIDM_API_TOKEN` is unset: invites fail closed with
+    /// a clear message instead of a half-made account.
+    pub fn from_env() -> Option<Self> {
+        let base = std::env::var("KANIDM_URL").ok()?.trim_end_matches('/').to_string();
+        let token = std::env::var("KANIDM_API_TOKEN").ok().filter(|t| !t.is_empty())?;
+        Some(Kanidm { base, token })
+    }
+
+    async fn call(&self, method: openidconnect::reqwest::Method, path: &str, body: Option<serde_json::Value>) -> anyhow::Result<(u16, String)> {
+        let mut req = crate::http::client()
+            .request(method, format!("{}{path}", self.base))
+            .bearer_auth(&self.token)
+            .header("content-type", "application/json");
+        if let Some(body) = body {
+            req = req.body(serde_json::to_vec(&body)?);
+        }
+        let response = req.send().await?;
+        let status = response.status().as_u16();
+        let text = crate::http::text(response, crate::http::GITEA_CAP).await?;
+        Ok((status, text))
+    }
+
+    async fn person_exists(&self, username: &str) -> anyhow::Result<bool> {
+        let (status, _) = self.call(openidconnect::reqwest::Method::GET, &format!("/v1/person/{username}"), None).await?;
+        match status {
+            200 => Ok(true),
+            404 => Ok(false),
+            other => anyhow::bail!("kanidm: looking up {username}: http {other}"),
+        }
+    }
+
+    /// The whole onboarding, in the order that leaves the least behind
+    /// if a step fails: create, then email, then group, then the link.
+    pub async fn invite(&self, name: &str, email: &str, group: &str) -> anyhow::Result<Invited> {
+        let username = username_for(email);
+        let created = if self.person_exists(&username).await? {
+            false
+        } else {
+            let (status, text) = self
+                .call(
+                    openidconnect::reqwest::Method::POST,
+                    "/v1/person",
+                    Some(serde_json::json!({ "attrs": { "name": [username], "displayname": [name] } })),
+                )
+                .await?;
+            if !(200..300).contains(&status) {
+                anyhow::bail!("kanidm: creating {username}: http {status}: {text}");
+            }
+            let (status, text) = self
+                .call(openidconnect::reqwest::Method::PUT, &format!("/v1/person/{username}/_attr/mail"), Some(serde_json::json!([email])))
+                .await?;
+            if !(200..300).contains(&status) {
+                anyhow::bail!("kanidm: setting mail on {username}: http {status}: {text}");
+            }
+            true
+        };
+        let (status, text) = self
+            .call(openidconnect::reqwest::Method::POST, &format!("/v1/group/{group}/_attr/member"), Some(serde_json::json!([username])))
+            .await?;
+        if !(200..300).contains(&status) {
+            anyhow::bail!("kanidm: adding {username} to {group}: http {status}: {text}");
+        }
+        let (reset_link, link_expires_ms) = if created {
+            // 24 hours: the longest Kanidm allows, since the link travels
+            // by email and is read when the person gets to it.
+            let (status, text) = self
+                .call(openidconnect::reqwest::Method::GET, &format!("/v1/person/{username}/_credential/_update_intent/86400"), None)
+                .await?;
+            if !(200..300).contains(&status) {
+                anyhow::bail!("kanidm: reset token for {username}: http {status}: {text}");
+            }
+            #[derive(Deserialize)]
+            struct Intent {
+                token: String,
+                #[serde(default)]
+                expiry_time: Option<serde_json::Value>,
+            }
+            let intent: Intent = serde_json::from_str(&text)?;
+            let expires = intent.expiry_time.as_ref().and_then(|v| v.as_str()).and_then(|s| chrono::DateTime::parse_from_rfc3339(s).ok()).map(|t| t.timestamp_millis());
+            (Some(format!("{}/ui/reset?token={}", self.base, intent.token)), expires)
+        } else {
+            (None, None)
+        };
+        Ok(Invited {
+            username,
+            display_name: name.to_string(),
+            email: email.to_string(),
+            group: group.to_string(),
+            reset_link,
+            link_expires_ms,
+            created,
+        })
+    }
+}
+
+/// A Kanidm account name from an email: the local part, lowercased,
+/// anything outside `[a-z0-9._-]` folded to `-`, led by a letter.
+pub fn username_for(email: &str) -> String {
+    let local = email.split('@').next().unwrap_or(email).to_lowercase();
+    let mut out: String = local
+        .chars()
+        .map(|c| if c.is_ascii_lowercase() || c.is_ascii_digit() || matches!(c, '.' | '_' | '-') { c } else { '-' })
+        .collect();
+    while out.starts_with(|c: char| !c.is_ascii_lowercase()) && !out.is_empty() {
+        out.remove(0);
+    }
+    if out.is_empty() {
+        "person".to_string()
+    } else {
+        out
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn usernames_are_the_email_local_part_made_safe() {
+        assert_eq!(username_for("jorn@westra-engineering.no"), "jorn");
+        assert_eq!(username_for("Ole.Nordmann+site@Example.com"), "ole.nordmann-site");
+        assert_eq!(username_for("42@x.no"), "person");
+        assert_eq!(username_for("Ærlig@x.no"), "rlig");
+    }
+}
@@ -38,7 +38,7 @@ pub async fn get_resource(
        .resource
        .as_ref()
        .ok_or_else(|| ServerFnError::new("feature has no resource"))?;
-    authorize_resource(resource).await?;
+    authorize_resource(&state, &question_id, &alternative, &feature_name).await?;
    fetch_resource_value(&state, resource, &params).await
 }

@@ -82,7 +82,7 @@ pub async fn get_requirement_options(
        .resource
        .as_ref()
        .ok_or_else(|| ServerFnError::new("requirement has no resource"))?;
-    authorize_resource(resource).await?;
+    authorize_resource(&state, &question_id, &alternative, &format!("{feature_name}|{requirement_name}")).await?;
    fetch_resource_value(&state, resource, &params).await
 }

@@ -113,7 +113,7 @@ pub async fn get_requirement_binding(
        .bind
        .as_ref()
        .ok_or_else(|| ServerFnError::new("requirement has no binding"))?;
-    authorize_resource(&bind.resource).await?;
+    authorize_resource(&state, &question_id, &alternative, &format!("{feature_name}|{requirement_name}|bind")).await?;
    fetch_resource_value(&state, &bind.resource, &params).await
 }

@@ -152,26 +152,40 @@ fn find_feature(
 }

 #[cfg(feature = "ssr")]
-async fn authorize_resource(resource: &crate::content::ResourceSpec) -> Result<(), ServerFnError> {
+async fn authorize_resource(
+    state: &crate::server::AppState,
+    question_id: &str,
+    alternative: &str,
+    feature: &str,
+) -> Result<(), ServerFnError> {
+    use crate::access::{decide_and_publish, Action, Principal, Resource};
    use crate::auth::{User, SESSION_USER_KEY};

-    if resource.public {
-        return Ok(());
-    }
-    let group = resource
-        .requires_group
-        .as_deref()
-        .ok_or_else(|| ServerFnError::new("resource is not accessible"))?;
    let session: tower_sessions::Session = leptos_axum::extract().await?;
    let user = session
        .get::<User>(SESSION_USER_KEY)
        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?
-        .ok_or_else(|| ServerFnError::new("not signed in"))?;
-    if !user.groups.iter().any(|g| g == group) {
-        return Err(ServerFnError::new("not authorized"));
+        .map_err(|e| ServerFnError::new(e.to_string()))?;
+    let resource = Resource::Feature {
+        page: question_id.to_string(),
+        alternative: alternative.to_string(),
+        feature: feature.to_string(),
+    };
+    let decision = decide_and_publish(
+        &state.nats,
+        &state.access.load(),
+        &Principal::from_user(user.as_ref()),
+        Action::Read,
+        &resource,
+        serde_json::json!({}),
+    );
+    if decision.allow {
+        Ok(())
+    } else if user.is_none() {
+        Err(ServerFnError::new("not signed in"))
+    } else {
+        Err(ServerFnError::new("not authorized"))
    }
-    Ok(())
 }

 #[cfg(feature = "ssr")]
@@ -260,21 +274,20 @@ async fn fetch_gitea_json(
    for (k, v) in params {
        url.query_pairs_mut().append_pair(k, v);
    }
-    let client = openidconnect::reqwest::Client::new();
-    let mut req = client.get(url.clone());
+    let mut req = crate::http::client().get(url.clone());
    if let Ok(token) = std::env::var("GITEA_API_TOKEN") {
        if !token.is_empty() {
            req = req.header("Authorization", format!("token {token}"));
        }
    }
-    let text = req
+    let response = req
        .send()
        .await
        .and_then(|r| r.error_for_status())
-        .map_err(|e| ServerFnError::new(format!("fetching {url}: {e}")))?
-        .text()
+        .map_err(|e| ServerFnError::new(format!("fetching {url}: {e}")))?;
+    let text = crate::http::text(response, crate::http::GITEA_CAP)
        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
+        .map_err(|e| ServerFnError::new(format!("reading {url}: {e}")))?;
    serde_json::from_str(&text).map_err(|e| ServerFnError::new(e.to_string()))
 }

@@ -341,16 +354,17 @@ async fn fetch_url_json(
    for (k, v) in &leftover {
        parsed.query_pairs_mut().append_pair(k, v);
    }
-    let client = openidconnect::reqwest::Client::new();
-    let text = client
+    let response = crate::http::client()
        .get(parsed.clone())
        .send()
        .await
        .and_then(|r| r.error_for_status())
-        .map_err(|e| ServerFnError::new(format!("fetching {parsed}: {e}")))?
-        .text()
+        .map_err(|e| ServerFnError::new(format!("fetching {parsed}: {e}")))?;
+    // Content picks the URL; the cap is what keeps a runaway endpoint
+    // from becoming a runaway allocation here.
+    let text = crate::http::text(response, crate::http::URL_RESOURCE_CAP)
        .await
-        .map_err(|e| ServerFnError::new(e.to_string()))?;
+        .map_err(|e| ServerFnError::new(format!("reading {parsed}: {e}")))?;
    serde_json::from_str(&text).map_err(|e| ServerFnError::new(e.to_string()))
 }

@@ -33,6 +33,10 @@ pub struct AppState {
    /// `aggregates` on the same reload. Default = the historical uhhm
    /// look.
    pub site: Arc<ArcSwap<crate::content::SiteConfig>>,
+    /// The access policy compiled from the content above (see
+    /// `access.rs`), swapped with it on every reload. Every server entry
+    /// point decides through this and nothing else.
+    pub access: Arc<ArcSwap<crate::access::Policy>>,
    /// `scheme://host` of the Gitea instance content is loaded from
    /// (see `content::gitea_api_base`) - kept alongside `questions`
    /// rather than re-derived per call, since `resolve_gitea_repo` needs
@@ -15,7 +15,7 @@ use serde::Serialize;

 use crate::server::AppState;

-const MAX_UPLOAD_BYTES: usize = 20 * 1024 * 1024;
+pub const MAX_UPLOAD_BYTES: usize = 20 * 1024 * 1024;

 #[derive(Clone)]
 pub struct Garage {
@@ -84,12 +84,20 @@ pub async fn upload(
            .unwrap_or("application/octet-stream")
            .to_string();
        let filename = field.file_name().unwrap_or("upload").to_string();
-        let bytes = field
-            .bytes()
+        // Chunk by chunk, refused the moment the cap is crossed: an
+        // oversized body is never buffered whole before being turned
+        // away. The route's body limit (main.rs) is the outer fence.
+        let mut bytes: Vec<u8> = Vec::new();
+        let mut field = field;
+        while let Some(chunk) = field
+            .chunk()
            .await
-            .map_err(|e| (StatusCode::BAD_REQUEST, e.to_string()))?;
-        if bytes.len() > MAX_UPLOAD_BYTES {
-            return Err((StatusCode::PAYLOAD_TOO_LARGE, "file too large".to_string()));
+            .map_err(|e| (StatusCode::BAD_REQUEST, e.to_string()))?
+        {
+            if bytes.len() + chunk.len() > MAX_UPLOAD_BYTES {
+                return Err((StatusCode::PAYLOAD_TOO_LARGE, "file too large".to_string()));
+            }
+            bytes.extend_from_slice(&chunk);
        }

        let key = format!("{}-{filename}", uuid::Uuid::new_v4());
@@ -147,6 +147,10 @@ a {
 main.loading,
 main.not-found {
  min-height: 60vh;
+  /* svh so wrapper browsers that resize the webview as their toolbar
+     animates (Firefox/Chrome iOS) don't reflow this placeholder - the
+     small viewport is a fixed value. Same ladder as .hero-piece. */
+  min-height: 60svh;
  display: flex;
  flex-direction: column;
  align-items: center;
@@ -368,8 +372,12 @@ main.not-found {
 .alt-image {
  display: block;
  width: 100%;
-  max-height: 14rem;
-  object-fit: cover;
+  height: auto;
+  /* Natural aspect, not a cropped band; a very tall image is still
+     bounded so it can't tower. The deck below overrides for its
+     fixed-height cards. */
+  max-height: 32rem;
+  object-fit: contain;
  border-radius: calc(var(--radius) - 0.3rem);
  margin-bottom: 1.1rem;
 }
@@ -552,6 +560,30 @@ main.not-found {
  border: 0.06rem solid var(--line);
 }

+/* Content hint via a markdown image title (`![alt](url "right 9rem")`):
+   float and shrink so text wraps around a portrait. */
+.alt-description img.md-float-left,
+.item-card-description img.md-float-left,
+.feature p img.md-float-left,
+.alt-description img.md-float-right,
+.item-card-description img.md-float-right,
+.feature p img.md-float-right {
+  width: auto;
+  max-width: 45%;
+}
+.alt-description img.md-float-left,
+.item-card-description img.md-float-left,
+.feature p img.md-float-left {
+  float: left;
+  margin: 0.2rem 1.1rem 0.5rem 0;
+}
+.alt-description img.md-float-right,
+.item-card-description img.md-float-right,
+.feature p img.md-float-right {
+  float: right;
+  margin: 0.2rem 0 0.5rem 1.1rem;
+}
+
 .alt-description code,
 .feature p code {
  font-size: 0.9em;
@@ -1013,6 +1045,9 @@ textarea:focus {
 .item-card-description {
  font-size: 0.9rem;
  color: var(--ink-dim);
+  /* The card is a grid with its own gap; the global p bottom margin
+     would stack on top of it. */
+  margin: 0;
 }

 .item-card-fields {
@@ -0,0 +1,66 @@
+//! The one test that meets a real JetStream: a submission becomes an
+//! aggregate, a desk move is accepted, an undeclared move is refused,
+//! and the record reads back from its own event log. Everything else
+//! in the suite replays in memory; this is what proves the store, the
+//! event log and the projection agree with each other.
+//!
+//! Runs only when `PORTAL_TEST_NATS_URL` points at a JetStream (CI
+//! starts a throwaway one, see `.gitea/workflows/test.yml`); without
+//! it the test passes as skipped, so `cargo test` stays green offline.
+#![cfg(feature = "ssr")]
+
+use portal::aggregates::{self, parse_aggregates_yaml, TransitionError};
+use portal::answers::{store_answer, Answer};
+use portal::events::store::{ensure_stream, load_events};
+use serde_json::json;
+
+#[tokio::test]
+async fn a_submission_is_created_moved_refused_and_read_back_through_the_real_engine() {
+    let Ok(url) = std::env::var("PORTAL_TEST_NATS_URL") else {
+        eprintln!("skipped: PORTAL_TEST_NATS_URL is not set");
+        return;
+    };
+    let js = async_nats::jetstream::new(async_nats::connect(&url).await.expect("connect"));
+    ensure_stream(&js).await.expect("event stream");
+
+    // A bucket of its own per run, so reruns and parallel runs never
+    // read each other's records.
+    let bucket = format!("it_{}", chrono::Utc::now().timestamp_millis());
+    let schemas = parse_aggregates_yaml(&format!(
+        "aggregates:\n  - bucket: {bucket}\n    initial: open\n    states:\n      open: {{ event: received }}\n      quoted: {{ event: quoted }}\n      won: {{ event: won }}\n      lost: {{ event: lost }}\n    transitions:\n      open: [quoted, lost]\n      quoted: [won, lost]\n"
+    ))
+    .expect("schema");
+    let schema = &schemas[&bucket];
+    let now = chrono::Utc::now().timestamp_millis();
+
+    // The submission: a KV record in the initial state, plus the first event.
+    store_answer(&js, &schemas, &bucket, "rec-1".into(), "/", "Hire us", &json!({"email": "a@b.example"}), now)
+        .await
+        .expect("store");
+    let store = js.get_key_value(&bucket).await.expect("bucket exists");
+    let stored: Answer = serde_json::from_slice(&store.get("rec-1").await.unwrap().expect("record")).unwrap();
+    assert_eq!(stored.state, "open");
+    assert_eq!(stored.responses["email"], "a@b.example");
+
+    // A desk move the machine allows.
+    let moved = aggregates::transition(&js, schema, "rec-1", "quoted", json!({"by": "test"}), now + 1)
+        .await
+        .expect("open -> quoted is declared");
+    assert_eq!(moved.state, "quoted");
+
+    // Moves the machine does not allow are refused, whoever asks.
+    let back = aggregates::transition(&js, schema, "rec-1", "open", json!({}), now + 2).await;
+    assert!(matches!(back, Err(TransitionError::DisallowedTransition { .. })), "{back:?}");
+    let skip = aggregates::transition(&js, schema, "rec-1", "won", json!({}), now + 2).await;
+    assert!(skip.is_ok(), "quoted -> won is declared: {skip:?}");
+    let nobody = aggregates::transition(&js, schema, "rec-9", "quoted", json!({}), now + 3).await;
+    assert!(matches!(nobody, Err(TransitionError::UnknownAggregate)), "{nobody:?}");
+
+    // The record reads back from its own event log, in the state the
+    // accepted moves left it, with a sequence that moved forward.
+    let events = load_events(&js, &bucket, "rec-1").await.expect("events");
+    assert_eq!(events.len(), 3, "received, quoted, won");
+    let replayed = aggregates::replay(schema, "rec-1", &events).expect("replays");
+    assert_eq!(replayed.state, "won");
+    assert!(replayed.sequence > moved.sequence);
+}