@panaversity/ksor 0.0.2 → 0.0.3

package/templates/scaffold/.claude/skills/format-checker/check.mjs

@@ -23,6 +23,7 @@ const ALLOWED_KEYS = new Set([
   "title",
   "description",
   "status",
+  "visibility",
   "owner",
   "provenance",
   "effective",
@@ -96,9 +97,10 @@ function unquote(value) {
 
 /**
  * The frontmatter block, two levels deep (`ksor:` has children; `provenance:`
- * has list items). Returns null when there is no block at all, and collects
- * every line that is neither `key: value`, a list item, an indented
- * continuation, nor blank — those mean the block was never closed.
+ * and `audiences:` have list items, collected under the key above them).
+ * Returns null when there is no block at all, and collects every line that is
+ * neither `key: value`, a list item, an indented continuation, nor blank —
+ * those mean the block was never closed.
  */
 function parseFrontmatter(text) {
   // An editor's byte-order mark is invisible to the author; it must not be
@@ -108,6 +110,7 @@ function parseFrontmatter(text) {
   if (!match) return null;
   const keys = new Map();
   const children = new Map();
+  const lists = new Map();
   const quoted = new Set();
   const malformedQuote = new Map();
   const malformed = [];
@@ -139,6 +142,7 @@ function parseFrontmatter(text) {
       }
       keys.set(current, unquote(top[2]));
       children.set(current, new Map());
+      lists.set(current, []);
       continue;
     }
     const nested = /^[ \t]+([A-Za-z_][\w-]*)\s*:\s*(.*)$/.exec(line);
@@ -146,10 +150,40 @@ function parseFrontmatter(text) {
       children.get(current).set(nested[1], unquote(nested[2]));
       continue;
     }
+    // A list item belongs to the key above it: audiences: is a list of
+    // audiences, and the rules that read it need the entries, not their count.
+    const item = /^[ \t]*-[ \t]+(.*)$/.exec(line);
+    if (item && current !== null) {
+      // YAML ends a plain scalar at ` #` — the comment is not part of the
+      // entry, and reading it as one refuses the documents instead of the
+      // list (found live 2026-08-18: `- public # the default` made every
+      // public document's visibility undeclared).
+      const value = /^["']/.test(item[1]) ? item[1] : item[1].replace(/\s+#.*$/, "");
+      lists.get(current).push(unquote(value));
+      continue;
+    }
+    // A dash glued to its value (`-internal`) is a list item to nobody —
+    // the indented-continuation escape below swallowed it while the build
+    // scanners stopped reading the list there: one green record, two
+    // different audience lists (review finding, 2026-08-19).
+    if (/^[ \t]*-\S/.test(line)) {
+      malformed.push(line.trim());
+      continue;
+    }
     if (/^[ \t]*-([ \t]|$)/.test(line) || /^[ \t]+\S/.test(line)) continue;
     malformed.push(line.trim());
   }
-  return { keys, children, quoted, malformedQuote, duplicates, malformed, tightColons, tabIndents };
+  return {
+    keys,
+    children,
+    lists,
+    quoted,
+    malformedQuote,
+    duplicates,
+    malformed,
+    tightColons,
+    tabIndents,
+  };
 }
 
 /**
@@ -218,13 +252,14 @@ function linkTargets(body) {
   return raw.map((t) => (t.startsWith("<") && t.endsWith(">") ? t.slice(1, -1).trim() : t));
 }
 
+/** Reports a broken target; returns the record document it resolves to, if any. */
 function checkLinkTarget(rel, docPath, target) {
   // Anything with a URI scheme (https:, mailto:, tel:, ftp:, …) or a
   // protocol-relative // host leaves the record on purpose — only relative
   // paths are the record's own links (review finding 2026-08-18: tel: was
   // reported as a dead file and //host as an escape).
-  if (target === "" || target.startsWith("#") || target.startsWith("//")) return;
-  if (/^[a-z][a-z0-9+.-]*:/i.test(target)) return;
+  if (target === "" || target.startsWith("#") || target.startsWith("//")) return null;
+  if (/^[a-z][a-z0-9+.-]*:/i.test(target)) return null;
   const resolved = path.resolve(path.dirname(docPath), target.split("#")[0]);
   if (!resolved.startsWith(knowledgeDir + path.sep) && resolved !== knowledgeDir) {
     problem(
@@ -240,9 +275,46 @@ function checkLinkTarget(rel, docPath, target) {
       "a record with dead internal links serves different truths by path",
       "fix the path or remove the link",
     );
+  } else if (resolved.endsWith(".md")) {
+    return resolved;
   }
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// the audience model: who may read a document, declared in instance.md
+// ---------------------------------------------------------------------------
+const instanceMd = path.join(root, "instance.md");
+
+/**
+ * The declared audiences, ordered least- to most-restricted, or null when the
+ * record declares none — and then every visibility rule below stays inert, so
+ * a record without an audience model behaves exactly as it did before the key
+ * existed. Read before the record itself: who may read what is a property of
+ * the whole record, which no single document can answer.
+ */
+function readAudienceModel() {
+  if (!existsSync(instanceMd)) return null;
+  const fm = parseFrontmatter(readFileSync(instanceMd, "utf8"));
+  const audiences = fm?.lists.get("audiences") ?? [];
+  if (audiences.length === 0) return null;
+  return { audiences, defaultVisibility: scalarValue(fm, "default_visibility") ?? "" };
+}
+
+/**
+ * A plain scalar ends at ` #` — the rule the list items above already follow
+ * and both build scanners apply. The checker not applying it to values let
+ * `default_visibility: public # the default` build fine and fail `pnpm check`
+ * (review finding, 2026-08-19).
+ */
+function scalarValue(fm, key) {
+  const value = fm.keys.get(key);
+  if (value === undefined || fm.quoted.has(key)) return value;
+  return value.replace(/\s+#.*$/, "").trim();
 }
 
+const audienceModel = readAudienceModel();
+
 if (!existsSync(knowledgeDir)) {
   problem(
     "knowledge/",
@@ -389,6 +461,8 @@ if (!existsSync(knowledgeDir)) {
   }
 
   // frontmatter + links per document
+  const visibilityByPath = new Map();
+  const crossings = [];
   for (const p of mdFiles) {
     const rel = path.relative(root, p);
     const text = readFileSync(p, "utf8");
@@ -552,22 +626,97 @@ if (!existsSync(knowledgeDir)) {
             "a replaced document must hand the reader its successor — a broken pointer dead-ends them on stale truth",
             "fix the path (it resolves relative to this document), or write the successor first",
           );
+        } else {
+          crossings.push({ kind: "superseded_by", rel, from: p, to: resolved, target: successor });
+        }
+      }
+      // visibility: one audience per document, from the set instance.md declares
+      const visibility = fm.keys.get("visibility");
+      const listed = fm.lists.get("visibility") ?? [];
+      // A flow list ([a, b]) is already named by the shape rule above.
+      const flowList = !fm.quoted.has("visibility") && /^\[.*\]$/.test(visibility ?? "");
+      if (listed.length > 0) {
+        problem(
+          rel,
+          "visibility is one value, not a list",
+          "a list makes every document a set-membership question, and set intersection is where access-control bugs live — one document belongs to exactly one audience",
+          `write a single audience: visibility: ${audienceModel?.audiences.at(-1) ?? "<audience>"}`,
+        );
+      } else if (visibility !== undefined && !flowList) {
+        if (audienceModel === null) {
+          problem(
+            rel,
+            `visibility: ${visibility} — the record declares no audience model`,
+            "who may read a document is governance, not a comment: with no audiences: in instance.md nothing constrains this value, and every surface publishes the document to everyone regardless",
+            "add audiences: to instance.md (ordered least- to most-restricted, public first) with default_visibility:, or remove the visibility: key",
+          );
+        } else if (!audienceModel.audiences.includes(visibility)) {
+          problem(
+            rel,
+            `visibility "${visibility}" is not a declared audience`,
+            "the audience set is closed in instance.md — a value outside it names a build that does not exist, so the document reaches either nobody or everybody",
+            `use one of: ${audienceModel.audiences.join(", ")} — or remove the key to take the default (${audienceModel.defaultVisibility})`,
+          );
         }
       }
+      if (audienceModel !== null) {
+        visibilityByPath.set(p, visibility ?? audienceModel.defaultVisibility);
+      }
     }
     // links: resolve, and never escape the record
-    for (const target of linkTargets(stripCode(text))) checkLinkTarget(rel, p, target);
+    for (const target of linkTargets(stripCode(text))) {
+      const to = checkLinkTarget(rel, p, target);
+      if (to !== null) crossings.push({ kind: "link", rel, from: p, to, target });
+    }
+  }
+
+  // Pointers across audiences: the leak no single build can catch, because the
+  // build that publishes the pointer has already dropped its target and cannot
+  // know it ever existed. Only the whole record sees both ends.
+  if (audienceModel !== null) {
+    const audienceOf = (file) => visibilityByPath.get(file) ?? audienceModel.defaultVisibility;
+    const tier = (file) => audienceModel.audiences.indexOf(audienceOf(file));
+    for (const { kind, rel, from, to, target } of crossings) {
+      const here = tier(from);
+      const there = tier(to);
+      // An undeclared audience at either end is already reported; comparing
+      // against a tier that does not exist would invent a second problem.
+      if (here === -1 || there === -1 || there <= here) continue;
+      const relTo = path.relative(root, to);
+      const both = `${relTo} is ${audienceOf(to)}, this document is ${audienceOf(from)}`;
+      if (kind === "link") {
+        problem(
+          rel,
+          `link to a more restricted document: ${target} — ${both}`,
+          "the build that publishes this link has already dropped its target: the link text and URL ship to readers who cannot open them, naming a document they were never meant to know exists",
+          `raise this document to ${audienceOf(to)}, widen ${relTo} to ${audienceOf(from)}, or remove the link`,
+        );
+      } else {
+        problem(
+          rel,
+          `superseded_by points at a more restricted document: ${target} — ${both}`,
+          "it strands the very readers the supersession exists to redirect: they are told this document is replaced, by a successor their build does not contain",
+          `widen ${relTo} to ${audienceOf(from)}, raise this document to ${audienceOf(to)}, or supersede it with a document its readers can reach`,
+        );
+      }
+    }
   }
 }
 
 // ---------------------------------------------------------------------------
 // instance.md: the identity of this SoR — format 1, closed key set
 // ---------------------------------------------------------------------------
-const INSTANCE_KEYS = new Set(["format", "name", "ksor", "site"]);
+const INSTANCE_KEYS = new Set([
+  "format",
+  "name",
+  "ksor",
+  "site",
+  "audiences",
+  "default_visibility",
+]);
 const INSTANCE_KSOR_KEYS = new Set(["requires", "scaffolded"]);
 const INSTANCE_SITE_KEYS = new Set(["url"]);
 
-const instanceMd = path.join(root, "instance.md");
 if (!existsSync(instanceMd)) {
   problem(
     "instance.md",
@@ -673,6 +822,63 @@ if (!existsSync(instanceMd)) {
         );
       }
     }
+    // the audience model: ordered, public first, and never without its default
+    const audiences = fm.lists.get("audiences") ?? [];
+    const defaultVisibility = scalarValue(fm, "default_visibility") ?? "";
+    if (fm.keys.has("audiences") && audiences.length === 0) {
+      const value = fm.keys.get("audiences");
+      problem(
+        "instance.md",
+        value === ""
+          ? "audiences: declares no audiences"
+          : `audiences is a list, not a value: ${value}`,
+        "the audience list is the record's whole access model, ordered least- to most-restricted — with nothing in it, no document's visibility: can be answered",
+        "write it as list items:\n      audiences:\n        - public\n        - internal",
+      );
+    } else if (audiences.length > 0) {
+      if (audiences[0] !== "public") {
+        problem(
+          "instance.md",
+          `audiences: does not start with public (it starts with "${audiences[0]}")`,
+          "the order is the restriction level, and that ordering is what makes an internal build mean public-and-internal with no further configuration — public is the least restricted tier by definition",
+          "list public first, then each narrower audience in turn",
+        );
+      }
+      const seen = new Set();
+      for (const audience of audiences) {
+        if (seen.has(audience)) {
+          problem(
+            "instance.md",
+            `duplicate audience: ${audience}`,
+            "an audience's position in the list is its restriction level — named twice, it has two levels and neither can be trusted",
+            `keep one ${audience} entry`,
+          );
+        }
+        seen.add(audience);
+      }
+      if (defaultVisibility === "") {
+        problem(
+          "instance.md",
+          "audiences: without default_visibility:",
+          "there is no safe inference for a document that declares no audience: guessing the widest leaks the first document whose key is forgotten, guessing the narrowest hides the record from everyone it was written for",
+          `add default_visibility: — one of ${audiences.join(", ")} — the audience a document belongs to when it declares none`,
+        );
+      } else if (!audiences.includes(defaultVisibility)) {
+        problem(
+          "instance.md",
+          `default_visibility "${defaultVisibility}" is not one of the declared audiences`,
+          "every document without a visibility: key takes this value — a default outside the list puts most of the record in an audience that does not exist",
+          `use one of: ${audiences.join(", ")}`,
+        );
+      }
+    } else if (fm.keys.has("default_visibility")) {
+      problem(
+        "instance.md",
+        "default_visibility: without audiences:",
+        "a default audience with no audience list is a setting with nothing to select from — the owner believes the record has a visibility model while every surface publishes every document to everyone",
+        "add audiences: (ordered least- to most-restricted, public first), or remove default_visibility:",
+      );
+    }
     for (const [parent, allowed] of [
       ["ksor", INSTANCE_KSOR_KEYS],
       ["site", INSTANCE_SITE_KEYS],
@@ -757,6 +963,9 @@ if (existsSync(siteDir)) {
       (p) =>
         !p.includes(`${path.sep}.next${path.sep}`) &&
         !p.includes(`${path.sep}.source${path.sep}`) &&
+        // The per-audience stage: generated copies of the record a build makes
+        // for one audience, never authored content (specs/ksor/visibility).
+        !p.includes(`${path.sep}.staged-knowledge${path.sep}`) &&
         !p.includes(`${path.sep}out${path.sep}`),
     )
     .filter((p) => p.toLowerCase().endsWith(".md") || p.toLowerCase().endsWith(".mdx"));

package/templates/scaffold/.claude/skills/intake-interview/SKILL.md

@@ -1,8 +1,8 @@
 ---
 name: intake-interview
-description: The first conversation with the owner of this Knowledge System of Record — five questions that define what it is authoritative for, then write instance.md together. Use when the owner asks to set up, configure, or "get started with" this project, when instance.md still contains its scaffold placeholder text, or when the scope of the corpus is unclear.
+description: The first conversation with the owner of this Knowledge System of Record — six questions that define what it is authoritative for and who may read it, then write instance.md together. Use when the owner asks to set up, configure, or "get started with" this project, when instance.md still contains its scaffold placeholder text, or when the scope of the corpus is unclear.
 metadata:
-  version: "1.1.0"
+  version: "1.2.0"
 ---
 
 # Intake interview
@@ -12,7 +12,7 @@ prose will one day be the agent surface's system prompt. Do not draft it from
 guesses — interview the owner, one question at a time, and write down what
 they actually say.
 
-## The five questions
+## The six questions
 
 Ask these one at a time; follow up until each answer is concrete enough to
 act on:
@@ -30,6 +30,18 @@ act on:
 5. **Strictness** — "When the record doesn't cover a question, how firmly
    should it decline? ('Not in this corpus' is a correct answer here —
    confirm the owner wants that behavior and where they want it softened.)"
+6. **Audiences** — "Does every reader of this record see every document? If
+   not, what are the audiences, from most public to most restricted?" A yes
+   is the common answer and the whole answer: write no `audiences:` key and
+   nothing about the project changes. A list means writing it into
+   `instance.md`'s frontmatter — ordered least- to most-restricted with
+   `public` first, plus `default_visibility:` naming the audience a document
+   takes when it says nothing (there is no safe guess, so the checker
+   requires it). Tell the owner what the key does and does not do:
+   documents carry `visibility:` and builds are made per audience, but
+   anyone who can clone the repository reads everything in it — if someone
+   must not read a document and can clone, that document belongs in a
+   different repository.
 
 ## Then write
 
@@ -37,7 +49,10 @@ act on:
   record's **display title**, the human name every page will lead with
   ("Acme Operations Handbook", not the slug) — then the authority sentence,
   boundary, audience, and strictness — plain prose, written for a reader
-  who must act on it. Do not touch the frontmatter keys.
+  who must act on it. Leave the frontmatter keys alone, with one exception:
+  an audience model from question 6 is written there as `audiences:` (a
+  list) and `default_visibility:`, and `pnpm check` will hold the record to
+  it from that moment on.
 - Restart `pnpm dev` afterwards so the site picks the new title up, and
   show the owner their name on the page.
 - Offer to capture the source list from question 4 as the first real

package/templates/scaffold/AGENTS.md

@@ -15,8 +15,11 @@ The record survives the system: `knowledge/` must stay readable and complete
 even if `system/` is deleted. Dependency flows one way — the system reads the
 record; the record never references the system.
 
-`instance.md` carries a closed key set — `format`, `name`, `ksor`, `site` —
-and everything that matters about it is the prose below that frontmatter;
+`instance.md` carries a closed key set — `format`, `name`, `ksor`, `site`,
+and the optional pair `audiences` + `default_visibility` (the record's reader
+audiences, ordered least- to most-restricted with `public` first, and the one
+a document takes when it names none — declared together or not at all) — and
+everything that matters about it is the prose below that frontmatter;
 `pnpm check` names any other key rather than ignoring it.
 
 ## Critical rules
@@ -27,6 +30,8 @@ and everything that matters about it is the prose below that frontmatter;
 2. **`knowledge/` is CommonMark `.md` only.** No `.mdx`, no `meta.json`, no
    framework files. A document must read cleanly in any markdown viewer.
 3. **Never edit generated files** — `system/site/.source/`, `.next/`, `out/`,
+   `system/site/.staged-knowledge/` (a build's per-audience copy of the
+   record — edit `knowledge/`, or the next build erases the change),
    lockfiles by hand.
 
 ## Commands (run at the repo root)
@@ -38,6 +43,17 @@ pnpm build       # static site into system/site/out/
 pnpm check       # the format checker — run before handing off any knowledge change
 ```
 
+## Publishing
+
+`pnpm build` emits a fully static site (`system/site/out/`) deployable to
+any host — Vercel reads the shipped `vercel.json` (deploy from the repo
+ROOT, never `system/site/`), and every other host just serves the folder.
+`KSOR_BASE_PATH=/repo pnpm build` targets sub-path hosting. With
+`audiences:` declared, plain `pnpm build` is always the public tier;
+`KSOR_AUDIENCE=<audience> pnpm build` builds a wider tier that belongs
+behind that audience's own access control, never on a public host.
+Details in README → Deploying.
+
 ## Writing knowledge
 
 - One document per file under `knowledge/`; the path is the document's
@@ -51,10 +67,23 @@ pnpm check       # the format checker — run before handing off any knowledge c
 - Frontmatter: `title` and `status` (`draft | review | approved | superseded`)
   are required. `owner` and `provenance` (a list naming real sources) are
   strongly encouraged — they become required as this project climbs the
-  governance ladder. `description`, `order` (sidebar position), `effective`
-  (the date the document takes effect) and `superseded` (a legacy marker —
-  prefer `status`) are available. No other keys; never `id:` or `name:` — the
-  path is the identity.
+  governance ladder. `description`, `visibility` (below), `order` (sidebar
+  position), `effective` (the date the document takes effect) and `superseded`
+  (a legacy marker — prefer `status`) are available. No other keys; never
+  `id:` or `name:` — the path is the identity.
+- `visibility:` names the one audience a document belongs to — a single value
+  from `instance.md`'s `audiences:`, never a list, and orthogonal to `status:`
+  (an approved document can be restricted, and a draft is not hidden). Leave
+  it off and the document takes `default_visibility`. The key does nothing
+  until `instance.md` declares `audiences:`; once it does, `pnpm check`
+  refuses any link or `superseded_by:` pointing from a wider audience at a
+  narrower one — the leak no single build can catch, because the build that
+  publishes the link has already dropped its target.
+
+  **Publication, not authorship: anyone who can clone the repository reads
+  every document regardless of frontmatter; if someone must not read a
+  document and can clone, the answer is a second repository.**
+
 - A replaced document is marked `status: superseded` with `superseded_by:`
   pointing at its successor — superseded documents are never deleted.
 - Images and assets live in `knowledge/` beside the document that uses them,
@@ -94,7 +123,7 @@ You own `system/site/` outright — these are the seams, cheapest first:
   and the home-page mark are the same file.
 - **Anything deeper** — edit the site like the Next.js app it is; the only
   rule that survives customization is critical rule 1. The whole shell is
-  replaceable behind a four-clause contract (a themed Docusaurus shell with
+  replaceable behind a five-clause contract (a themed Docusaurus shell with
   a swap recipe lives in the ksor repository under `workbench/shells/`).
 
 ## What this project owns

package/templates/scaffold/README.md

@@ -55,6 +55,33 @@ and how to fix it.
 Everything here is yours to change. The kit exists so that any coding agent can
 operate this project without being taught it first.
 
+## Deploying
+
+The built site is a folder of files — 2 MB of HTML, JS and CSS with zero
+host-specific dependencies. `pnpm build` writes it to `system/site/out/`,
+and anything that can serve files can serve it.
+
+- **Vercel** — connect the repository (or run `vercel`); the shipped
+  `vercel.json` answers the setup interview: deploy from the repo root
+  (never pin `system/site` as the root directory — the record lives
+  outside it), build with `pnpm build`, serve `system/site/out/`. If the
+  build image's pnpm predates the `packageManager` pin, set the
+  `ENABLE_EXPERIMENTAL_COREPACK=1` build environment variable.
+- **GitHub Pages, nginx, S3, anything static** — run `pnpm build` and
+  upload `system/site/out/`. Hosted under a sub-path (like
+  `user.github.io/repo`)? Build with `KSOR_BASE_PATH=/repo pnpm build`.
+- **Verify any deploy** the same way: the home page, one document page,
+  and `/llms.txt` all load; nothing else is required.
+
+If `instance.md` declares `audiences:`, what you deploy is a **tier**.
+Plain `pnpm build` always builds the public tier — safe for any host.
+`KSOR_AUDIENCE=<audience> pnpm build` builds a wider tier for that
+audience's own deployment, and that build carries an
+"— not for publication" label because it must never reach a public host:
+put it behind access control you already trust (VPN, SSO proxy,
+authenticated host). The tiers govern what a build contains; where each
+build may be served is yours to enforce.
+
 ## Ownership
 
 Everything here is yours. The scaffold was generated by

package/templates/scaffold/gitignore

@@ -5,6 +5,9 @@ node_modules/
 system/site/.next/
 system/site/.source/
 system/site/out/
+# the per-audience copy of the record a build stages — a filtered derivative,
+# never a second record; committing it would publish what a build excluded
+system/site/.staged-knowledge/
 *.tsbuildinfo
 
 # secrets never enter the record — system/ is their future home (serve)

package/templates/scaffold/system/site/app/(home)/page.tsx

@@ -3,7 +3,7 @@ import Link from "next/link";
 // The same file Next serves as the favicon (app/icon.png) — one mark, one
 // asset. Replace it with your own and the tab icon changes with the page.
 import mark from "@/app/icon.png";
-import { BuiltWith } from "@/components/built-with";
+import { FooterMark } from "@/components/footer-mark";
 import { appName, appTitle } from "@/lib/shared";
 import { basePath, getSortedPages } from "@/lib/source";
 
@@ -75,7 +75,7 @@ export default function HomePage() {
 
       <footer className="mx-auto w-full max-w-2xl px-6 pb-10">
         <p className="border-t border-fd-border pt-6 text-xs">
-          <BuiltWith />
+          <FooterMark />
         </p>
       </footer>
     </main>

package/templates/scaffold/system/site/app/docs/layout.tsx

@@ -1,7 +1,7 @@
 import { getSortedPageTree } from "@/lib/source";
 import { DocsLayout } from "fumadocs-ui/layouts/docs";
 import { baseOptions } from "@/lib/layout.shared";
-import { BuiltWith } from "@/components/built-with";
+import { FooterMark } from "@/components/footer-mark";
 
 export default function Layout({ children }: LayoutProps<"/docs">) {
   return (
@@ -13,7 +13,7 @@ export default function Layout({ children }: LayoutProps<"/docs">) {
       sidebar={{
         footer: (
           <p className="mt-3 text-xs">
-            <BuiltWith />
+            <FooterMark />
           </p>
         ),
       }}

package/templates/scaffold/system/site/components/footer-mark.tsx

@@ -0,0 +1,22 @@
+import type { ReactElement } from "react";
+import { BuiltWith } from "@/components/built-with";
+import { audienceNotice } from "@/lib/audience";
+
+/**
+ * The foot of the site chrome: who built it, and — on any build below the
+ * public tier — which audience that build was for, so a screenshot of an
+ * internal site names itself and a page that escapes carries its own
+ * warning.
+ *
+ * The public build renders the attribution ALONE, exactly as a site with no
+ * audience model does: the one build with nothing to disclose must not even
+ * carry the shape of a disclosure.
+ */
+export function FooterMark(): ReactElement {
+  if (audienceNotice === null) return <BuiltWith />;
+  return (
+    <>
+      <BuiltWith /> &middot; <span className="text-fd-muted-foreground">{audienceNotice}</span>
+    </>
+  );
+}