One interface, three trust levels
A shared frontend does not require a shared trust boundary. The useful separation happens in projections, paths, and server-side capability checks.
The tempting version of a unified platform interface is also the dangerous one: fetch everything, hide what the current user should not see, and call the result an access-control model.
That is not an access-control model. It is a presentation preference.
The interface I want for RS Platform starts from a different premise: everyone can enter through the same conceptual front door, but nobody gets the same projection by accident.
The page can be shared
The public site is static and independently hosted. That matters because it should survive the failure of the platform it describes. It can explain the system, preserve the writing, and say honestly when live information is unavailable.
Later, small interactive parts of that page may request platform state. The browser will render the response, but it will never decide the caller’s authority.
The backend will produce three distinct views:
- a delayed and coarse public projection;
- a self-service view scoped to one approved user; and
- a private, complete operator view.
They are related products, not a large response with different CSS.
Network path still matters
The operator view will require the private Role 4 WireGuard path before application authentication is even considered. That keeps administrative routes structurally absent from public ingress.
Approved users are different. They need to recover or manage their own access even when the VPN is disconnected, so their narrow self-service surface can be publicly reachable after strong authentication. Publicly reachable is not the same as publicly enumerable.
Capability is more precise than role
“Operator” is a convenient description, but a poor long-term authorization contract. When write operations arrive, they should arrive as individual capabilities: inspect a server, start it, stop it, manage a player, approve a peer.
That makes the dangerous question explicit: which exact action is this identity allowed to perform right now?
Start with what the system is not allowed to pretend.
Name exactly where durable truth and mutation live.
Make recovery part of the design rather than its appendix.
Why the first version is disconnected
This release intentionally contains no authentication and no platform API client. The interactive status panel is fixture data, labelled as such.
That is not a shortcut around the architecture. It is the architecture doing its job: presentation can ship before authority does, and a convincing mock does not earn the right to become a control surface by looking finished.