{
  "schemaVersion": 1,
  "generatedFrom": "src/data/catalogue.js",
  "wiki": {
    "title": "Co.Property internal wiki",
    "version": "2026.10.20.2",
    "date": "20 October 2026"
  },
  "page": {
    "stableId": "access#page",
    "pageId": "access",
    "pageTitle": "Personal access: choose the least-privileged path",
    "pageSlug": "contribution/access",
    "sectionId": "page",
    "sectionTitle": "Personal access: choose the least-privileged path",
    "sectionProse": [
      "Most staff should use approved dashboard access. Technical operators use their own Tailscale identity and SSH key to reach the office mini only after owner approval.",
      "Give macOS, Windows, and Linux contributors a safe access checklist without distributing private keys, assuming Tailscale SSH, or treating installed tools as proof of identity.",
      "A contributor creates a personal key, joins Tailscale through an invitation, receives authorisation, verifies the host fingerprint, then uses the coproperty-office SSH alias. Staff dashboard access is a separate least-privileged path.",
      "Ask for dashboard access before SSH when it is enough",
      "The usual staff entry point is the approved dashboard. It lets a teammate read company information and use role-enabled features without becoming an infrastructure operator. A technical operator path exists for people who need to work on the office computer itself, and it requires explicit owner approval.",
      "This distinction is not a judgement about trust. It is a practical way to minimise access and keep operational and infrastructure responsibilities understandable.",
      "macOS, Windows, and Linux use your own key and approved network identity",
      "macOS: install Tailscale from https://tailscale.com/download/mac, sign in with your invited company identity, and open Terminal. Check `ssh -V`, then create a personal key with `ssh-keygen -t ed25519 -f ~/.ssh/coproperty_office`. Choose a passphrase and send only ~/.ssh/coproperty_office.pub to the access administrator. Keep the private file on your computer.",
      "Windows: install Tailscale from https://tailscale.com/download/windows and join the invited company network. In PowerShell, check `ssh -V`. If it is missing, use Microsoft’s OpenSSH Client instructions at https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse. Run `ssh-keygen -t ed25519 -f \"$HOME/.ssh/coproperty_office\"` and send only the resulting .pub file. Arrange an observed first connection; installing the client does not grant access.",
      "Linux: follow https://tailscale.com/download/linux for your distribution and install its OpenSSH client. In a terminal, check `ssh -V`, then run `ssh-keygen -t ed25519 -f ~/.ssh/coproperty_office`. Choose a passphrase and send only ~/.ssh/coproperty_office.pub. Join the invited Tailscale identity before connecting.",
      "After approval, ask the administrator to confirm your SSH alias configuration and the host fingerprint below. Run `ssh coproperty-office`. Success is a shell on the expected company mini; verify `hostname`, `whoami`, and the project path before any change. If access is denied or the host key changes, stop and contact the administrator. Do not install a private-key bundle. A shared Unix account does not isolate permissions. Setup prepares your device but does not grant access on the mini.",
      "Verify the host before you trust the alias",
      "Use the standard SSH alias `coproperty-office` only after verifying with the owner that it resolves to `copropertys-mac-mini.tail3ab9e5.ts.net`, user `coproperty`, and the pinned host fingerprint `SHA256:UUFmlsdclEmRtyRWNqAdVYUoFxeUkRUGhbzObQPsOPg`. Do not assume Tailscale SSH; this contract uses standard SSH over the approved private route.",
      "Once connected, first verify hostname, project path `/Users/coproperty/Projects/coproperty-office-os`, and repository status. Installed Codex at `/Users/coproperty/.local/bin/codex` is a local tool path, not evidence that a teammate is authenticated; use a personal or approved identity."
    ],
    "version": "2026.10.20.2",
    "date": "20 October 2026",
    "status": "Checked",
    "currentStatus": "Checked — personal-key and approved-access requirements are documented; an individual connection still needs its own verification.",
    "proposedStatus": "Complete a first connection only with own keys, a Tailscale invitation, admin authorisation, and owner-verified host fingerprint.",
    "expectedOutcome": "A contributor can request the right access level and prepare their device without changing the mini or using someone else’s credentials.",
    "tests": [
      "Check every platform path requires a personal key and approved Tailscale identity.",
      "Check no guide offers a private-key bundle, token, unattended access, or automatic remote command."
    ],
    "sourcePointers": [
      "docs/MAC-MINI-SETUP.md",
      "docs/HEADLESS-OPERATOR-CONTROL.md",
      "docs/RECOVERY.md",
      "ops/macmini/setup.py",
      "tests/test_macmini_setup.py",
      "Handoff / pages/access.html",
      "Handoff / pages/infrastructure.html",
      "Handoff / START-HERE.html"
    ],
    "related": [
      {
        "id": "workspace-pr",
        "title": "Contribution: isolated workspaces, meaningful tests, reviewed release",
        "summary": "A safe change begins by verifying the remote target, then uses an isolated worktree outside the installed project. It is tested, submitted as a pull request, and reviewed before a person releases it.",
        "status": "Checked",
        "path": "/contribution/workspace-and-pr/"
      },
      {
        "id": "mac-mini",
        "title": "The Mac mini: authoritative writer and local operating core",
        "summary": "The office Mac mini holds internal company state and runs configured operating processes. It is the authoritative writer for internal tasks, decisions, identity links, and audit state.",
        "status": "Checked",
        "path": "/systems/mac-mini/"
      },
      {
        "id": "services",
        "title": "Service directory: approved destinations, not shared access",
        "summary": "This directory names the approved service destinations used around Co.Property. Every destination requires an existing authorised account or approved auth; the wiki never stores tokens, credentials, or private logs.",
        "status": "Checked",
        "path": "/reference/service-directory/"
      }
    ],
    "sshTarget": {
      "alias": "coproperty-office",
      "hostname": "copropertys-mac-mini.tail3ab9e5.ts.net",
      "user": "coproperty",
      "projectPath": "/Users/coproperty/Projects/coproperty-office-os",
      "codexPath": "/Users/coproperty/.local/bin/codex",
      "hostFingerprint": "SHA256:UUFmlsdclEmRtyRWNqAdVYUoFxeUkRUGhbzObQPsOPg",
      "requiredChecks": [
        "Verify the hostname, project path, and repository status before any work.",
        "Create an isolated task worktree outside the installed project.",
        "Never modify the installed runtime from this contribution path."
      ]
    }
  },
  "sections": {
    "access-choice": {
      "stableId": "access#access-choice",
      "pageId": "access",
      "pageTitle": "Personal access: choose the least-privileged path",
      "pageSlug": "contribution/access",
      "sectionId": "access-choice",
      "sectionTitle": "Ask for dashboard access before SSH when it is enough",
      "sectionProse": [
        "The usual staff entry point is the approved dashboard. It lets a teammate read company information and use role-enabled features without becoming an infrastructure operator. A technical operator path exists for people who need to work on the office computer itself, and it requires explicit owner approval.",
        "This distinction is not a judgement about trust. It is a practical way to minimise access and keep operational and infrastructure responsibilities understandable."
      ],
      "version": "2026.10.20.2",
      "date": "20 October 2026",
      "status": "Checked",
      "currentStatus": "Checked — staff and technical access are documented as different paths.",
      "proposedStatus": "Start every access request by naming the task and the least-privileged surface that can perform it.",
      "expectedOutcome": "People receive only the access needed for their work and have a clear reason for it.",
      "tests": [
        "Check dashboard is presented before SSH in the page and Markdown export.",
        "Check all external service links say existing authorised account required."
      ],
      "sourcePointers": [
        "docs/MAC-MINI-SETUP.md",
        "docs/HEADLESS-OPERATOR-CONTROL.md",
        "docs/RECOVERY.md",
        "ops/macmini/setup.py",
        "tests/test_macmini_setup.py",
        "Handoff / pages/access.html",
        "Handoff / pages/infrastructure.html",
        "Handoff / START-HERE.html"
      ],
      "related": [
        {
          "id": "workspace-pr",
          "title": "Contribution: isolated workspaces, meaningful tests, reviewed release",
          "summary": "A safe change begins by verifying the remote target, then uses an isolated worktree outside the installed project. It is tested, submitted as a pull request, and reviewed before a person releases it.",
          "status": "Checked",
          "path": "/contribution/workspace-and-pr/"
        },
        {
          "id": "mac-mini",
          "title": "The Mac mini: authoritative writer and local operating core",
          "summary": "The office Mac mini holds internal company state and runs configured operating processes. It is the authoritative writer for internal tasks, decisions, identity links, and audit state.",
          "status": "Checked",
          "path": "/systems/mac-mini/"
        },
        {
          "id": "services",
          "title": "Service directory: approved destinations, not shared access",
          "summary": "This directory names the approved service destinations used around Co.Property. Every destination requires an existing authorised account or approved auth; the wiki never stores tokens, credentials, or private logs.",
          "status": "Checked",
          "path": "/reference/service-directory/"
        }
      ],
      "sshTarget": {
        "alias": "coproperty-office",
        "hostname": "copropertys-mac-mini.tail3ab9e5.ts.net",
        "user": "coproperty",
        "projectPath": "/Users/coproperty/Projects/coproperty-office-os",
        "codexPath": "/Users/coproperty/.local/bin/codex",
        "hostFingerprint": "SHA256:UUFmlsdclEmRtyRWNqAdVYUoFxeUkRUGhbzObQPsOPg",
        "requiredChecks": [
          "Verify the hostname, project path, and repository status before any work.",
          "Create an isolated task worktree outside the installed project.",
          "Never modify the installed runtime from this contribution path."
        ]
      }
    },
    "device-setup": {
      "stableId": "access#device-setup",
      "pageId": "access",
      "pageTitle": "Personal access: choose the least-privileged path",
      "pageSlug": "contribution/access",
      "sectionId": "device-setup",
      "sectionTitle": "macOS, Windows, and Linux use your own key and approved network identity",
      "sectionProse": [
        "macOS: install Tailscale from https://tailscale.com/download/mac, sign in with your invited company identity, and open Terminal. Check `ssh -V`, then create a personal key with `ssh-keygen -t ed25519 -f ~/.ssh/coproperty_office`. Choose a passphrase and send only ~/.ssh/coproperty_office.pub to the access administrator. Keep the private file on your computer.",
        "Windows: install Tailscale from https://tailscale.com/download/windows and join the invited company network. In PowerShell, check `ssh -V`. If it is missing, use Microsoft’s OpenSSH Client instructions at https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse. Run `ssh-keygen -t ed25519 -f \"$HOME/.ssh/coproperty_office\"` and send only the resulting .pub file. Arrange an observed first connection; installing the client does not grant access.",
        "Linux: follow https://tailscale.com/download/linux for your distribution and install its OpenSSH client. In a terminal, check `ssh -V`, then run `ssh-keygen -t ed25519 -f ~/.ssh/coproperty_office`. Choose a passphrase and send only ~/.ssh/coproperty_office.pub. Join the invited Tailscale identity before connecting.",
        "After approval, ask the administrator to confirm your SSH alias configuration and the host fingerprint below. Run `ssh coproperty-office`. Success is a shell on the expected company mini; verify `hostname`, `whoami`, and the project path before any change. If access is denied or the host key changes, stop and contact the administrator. Do not install a private-key bundle. A shared Unix account does not isolate permissions. Setup prepares your device but does not grant access on the mini."
      ],
      "version": "2026.10.20.2",
      "date": "20 October 2026",
      "status": "Checked",
      "currentStatus": "Checked — platform preparation is documented; each person’s actual access remains subject to invitation and approval.",
      "proposedStatus": "Use a supported, observed first connection for Windows and any unfamiliar device configuration.",
      "expectedOutcome": "Each operating system follows the same identity and approval model without sharing credentials.",
      "tests": [
        "Check macOS, Windows, and Linux are each mentioned with personal-key guidance.",
        "Check no command in generated output creates, imports, or distributes someone else’s private key."
      ],
      "sourcePointers": [
        "docs/MAC-MINI-SETUP.md",
        "docs/HEADLESS-OPERATOR-CONTROL.md",
        "docs/RECOVERY.md",
        "ops/macmini/setup.py",
        "tests/test_macmini_setup.py",
        "Handoff / pages/access.html",
        "Handoff / pages/infrastructure.html",
        "Handoff / START-HERE.html"
      ],
      "related": [
        {
          "id": "workspace-pr",
          "title": "Contribution: isolated workspaces, meaningful tests, reviewed release",
          "summary": "A safe change begins by verifying the remote target, then uses an isolated worktree outside the installed project. It is tested, submitted as a pull request, and reviewed before a person releases it.",
          "status": "Checked",
          "path": "/contribution/workspace-and-pr/"
        },
        {
          "id": "mac-mini",
          "title": "The Mac mini: authoritative writer and local operating core",
          "summary": "The office Mac mini holds internal company state and runs configured operating processes. It is the authoritative writer for internal tasks, decisions, identity links, and audit state.",
          "status": "Checked",
          "path": "/systems/mac-mini/"
        },
        {
          "id": "services",
          "title": "Service directory: approved destinations, not shared access",
          "summary": "This directory names the approved service destinations used around Co.Property. Every destination requires an existing authorised account or approved auth; the wiki never stores tokens, credentials, or private logs.",
          "status": "Checked",
          "path": "/reference/service-directory/"
        }
      ],
      "sshTarget": {
        "alias": "coproperty-office",
        "hostname": "copropertys-mac-mini.tail3ab9e5.ts.net",
        "user": "coproperty",
        "projectPath": "/Users/coproperty/Projects/coproperty-office-os",
        "codexPath": "/Users/coproperty/.local/bin/codex",
        "hostFingerprint": "SHA256:UUFmlsdclEmRtyRWNqAdVYUoFxeUkRUGhbzObQPsOPg",
        "requiredChecks": [
          "Verify the hostname, project path, and repository status before any work.",
          "Create an isolated task worktree outside the installed project.",
          "Never modify the installed runtime from this contribution path."
        ]
      }
    },
    "first-connection": {
      "stableId": "access#first-connection",
      "pageId": "access",
      "pageTitle": "Personal access: choose the least-privileged path",
      "pageSlug": "contribution/access",
      "sectionId": "first-connection",
      "sectionTitle": "Verify the host before you trust the alias",
      "sectionProse": [
        "Use the standard SSH alias `coproperty-office` only after verifying with the owner that it resolves to `copropertys-mac-mini.tail3ab9e5.ts.net`, user `coproperty`, and the pinned host fingerprint `SHA256:UUFmlsdclEmRtyRWNqAdVYUoFxeUkRUGhbzObQPsOPg`. Do not assume Tailscale SSH; this contract uses standard SSH over the approved private route.",
        "Once connected, first verify hostname, project path `/Users/coproperty/Projects/coproperty-office-os`, and repository status. Installed Codex at `/Users/coproperty/.local/bin/codex` is a local tool path, not evidence that a teammate is authenticated; use a personal or approved identity."
      ],
      "version": "2026.10.20.2",
      "date": "20 October 2026",
      "status": "Checked",
      "currentStatus": "Checked — the target contract is documented; first use still requires owner verification and personal approved authentication.",
      "proposedStatus": "Record any changed host fingerprint or target contract through an owner-approved documentation update, not a guess.",
      "expectedOutcome": "A contributor connects to the intended machine and validates the actual work surface before taking any action.",
      "tests": [
        "Check the exact target contract is available in every contextual work draft.",
        "Check no Codex URL includes a remote path parameter or tries to open a remote shell."
      ],
      "sourcePointers": [
        "docs/MAC-MINI-SETUP.md",
        "docs/HEADLESS-OPERATOR-CONTROL.md",
        "docs/RECOVERY.md",
        "ops/macmini/setup.py",
        "tests/test_macmini_setup.py",
        "Handoff / pages/access.html",
        "Handoff / pages/infrastructure.html",
        "Handoff / START-HERE.html"
      ],
      "related": [
        {
          "id": "workspace-pr",
          "title": "Contribution: isolated workspaces, meaningful tests, reviewed release",
          "summary": "A safe change begins by verifying the remote target, then uses an isolated worktree outside the installed project. It is tested, submitted as a pull request, and reviewed before a person releases it.",
          "status": "Checked",
          "path": "/contribution/workspace-and-pr/"
        },
        {
          "id": "mac-mini",
          "title": "The Mac mini: authoritative writer and local operating core",
          "summary": "The office Mac mini holds internal company state and runs configured operating processes. It is the authoritative writer for internal tasks, decisions, identity links, and audit state.",
          "status": "Checked",
          "path": "/systems/mac-mini/"
        },
        {
          "id": "services",
          "title": "Service directory: approved destinations, not shared access",
          "summary": "This directory names the approved service destinations used around Co.Property. Every destination requires an existing authorised account or approved auth; the wiki never stores tokens, credentials, or private logs.",
          "status": "Checked",
          "path": "/reference/service-directory/"
        }
      ],
      "sshTarget": {
        "alias": "coproperty-office",
        "hostname": "copropertys-mac-mini.tail3ab9e5.ts.net",
        "user": "coproperty",
        "projectPath": "/Users/coproperty/Projects/coproperty-office-os",
        "codexPath": "/Users/coproperty/.local/bin/codex",
        "hostFingerprint": "SHA256:UUFmlsdclEmRtyRWNqAdVYUoFxeUkRUGhbzObQPsOPg",
        "requiredChecks": [
          "Verify the hostname, project path, and repository status before any work.",
          "Create an isolated task worktree outside the installed project.",
          "Never modify the installed runtime from this contribution path."
        ]
      }
    }
  }
}