The MVP vault: a reading app with a left navigation, the consequence layer, and the dual licence

The Gmail-connector vault oc433z3m is the first vault taken end to end, and the design template the rest will reuse. Three things landed together.

A grant is a union of capabilities; the reader needs the consequences. The build derives a new layer beside the grant. data/assets.json names what is in the deployment for the grant to act on — mail from other people, secrets and reset links (assumed present, and you can untick them), the owner's filing, and the fact that this deployment also has Claude's web tools on. data/consequences.json names what follows when a capability meets an asset, each one explicit and in the mailbox's own words: read the secrets, read the reset links, take over an account that resets by email, forward any message, harvest the addresses, mass-send, attack others from the account, provoke a suspension, rearrange the filing, forward with a standing filter, send without a trace. The build writes CONSEQUENCES.md with the assets, the routes out counted, and every consequence with its barrier derived as the weakest among the capabilities it needs. It refuses a grant row that is the parent of no consequence, and a consequence that reads like a score. data/standards/ carries GDPR, the EU AI Act and MITRE ATT&CK as mini-graphs of titles and identifiers only, so a consequence links to the article or technique it touches without the vault reproducing a standard's text.

The dual licence. A licence block in vault.json drives a new LICENCE.md: the published template is CC BY 4.0; a paid copy carries a commercial licence to the named buyer, granting full rights to use the material, including in client work, without attribution. The build refuses a commercial copy that does not name its buyer, order and level, and the footer of every derived file now names the licence.

The reading app, rebuilt. The renderer becomes v5 and moves to a new app vault, vbhmlulo, because this session cannot write the old one. It takes the layout of the store's marketplace mock-up — a left navigation — in RiskMandate's own paper-and-green skin. Start here opens with Who are you?, five audiences that filter the same record. The rail groups the views: the record (the ABP, Evidence, the gap, What follows), what you do (Customise, Use it, Build it, Authorise it), and what you hold (Licence, Your keys, Keep it, Download). Your keys explains the read key and the write key and what clone-change-commit means; Keep it shows the vault's own commit log beside the recompute history; Download shows the zip with its size and sha256.

What is where now. oc433z3m is re-pushed so its live view loads v5; the catalogue points at vbhmlulo; the previous app vault fl3i7lu4 (v4) still serves the fifteen vaults not yet re-pushed, which each catch up when someone re-pushes them. The site's vault page takes the mock-up's positioning: Open the vault. See what you get, the reading-app / files / keys / history caption, and the three claims — your keys, multiple formats, version history — under the two live frames.

Still open, and said so on the console. The research list for the Gmail grant — Google's sending limits, what suspends an account, which modify tools the connector exposes — is documented from Google's pages or left open, never provoked. The authored per-audience views and projections remain their own task. And at release time oc433z3m's live host frame was still resolving the newly-pushed sub-vault mount to vbhmlulo; the vault data is verified correct server-side and the renderer is proven through a static preview, so this is the host indexing a brand-new mount target, as the first push was.