[immakermatty]

Status: ready for review — verified by the DEV-6631 lead (lint, typecheck, public-content check, the changed test files 70/70; headless screenshots of both cases); the guide video story was approved by Matěj on 2026-10-17.

Why

The public reference Organization LazurioExampleOrganization keeps its Environments without a vault (root decision 0204): it is public and shared, and a Lazurio Vaultwarden answers only inside an Organization's tailnet (root decision 0203). On its Environments other than the visitors' (which have no Trezor at all, F55), Nastavení → Trezor showed only „Toto Prostředí zatím trezor nemá." That says neither how a vault works nor that there is deliberately none here, and its „zatím" (yet) is not true there. Matěj asked for a proper explanation with a motion graphic of a real Organization, and for the demo to say it has no vault on purpose.

What changes

Nastavení → Trezor on an Environment without a vault now says why in the page's line and explains the vault under it:

• the line, by reason:
  • public Organization (no-tailnet): „Tato Organizace je veřejná ukázka a skutečná hesla do ní nepatří, proto v ní trezor záměrně není. Všechno ostatní funguje jako ve skutečné Organizaci." / "This Organization is a public demo and real passwords do not belong in it, so it has no vault on purpose. Everything else works as in a real Organization."
  • any other (no-vault): „Trezor tohoto Prostředí není nastavený. Nastaví ho Admin Organizace a pak ho najdete tady." / "This Environment's vault is not set up. The Organization's Admin sets it up, and then you will find it here."
• the group „Jak trezor funguje" / "How the vault works": the new guide video vault-overview, its player there from the start at its poster (nothing else of it loads before it plays, nothing plays by itself, no audio track), and three sentences: „V Organizaci má každé Prostředí vlastní trezor. Lidé do něj sdílejí hesla ze svého Bitwardenu a agenti v Prostředí je použijí bez ptaní. Sdílení můžete kdykoli vzít zpět." / "In an Organization, every Environment has its own vault. People share passwords with it from their own Bitwarden, and the Environment's agents use them without asking. You can take the sharing back at any time."

How the two cases are told apart (same code for every Organization, no login named). The vault core reads it from the handover. Without a vault member, an Organization's Environment whose handover has no network member is unsupported / no-tailnet; otherwise it stays no-vault. Machines writes no network exactly for the public-entry work VMs of a platform-public Organization (root decision 0204; Machines' PUBLIC_ORGANIZATIONS list, which holds LazurioExampleOrganization by its GitHub id and needs a root decision for any other) and asserts a Headscale selection for every other work VM; a personal VM always has one. No new declaration in Machines or the Organization's settings is needed.

Also, so nothing else says "yet" there: lazurio vault status says "this Environment has no vault and gets none: it is reached without a private network (a public Organization's Environment), and a vault answers only inside one"; the Tools row says „V tomto Prostředí není k dispozici"; an agent's secret request is refused with the same reason and its page says „Toto Prostředí trezor nemá." Runtime secrets stay no-vault-identity.

The video (src/launchpad/videos/vault-overview-<cs|en>.mp4 + .webp): HumanAndMachine-ai/design-system-lazurio#93, cuts vault / vault-en in the approved Lazurio video style. 23.8 s, H.264 High 1920×1080, 30 fps, no audio track, index first, 1.17 / 1.20 MB; posters 22 / 23 KB (the Organization with its vault and each Environment with its own). Five scenes, as approved: every Organization has its own vault → each of its Environments has its own → a person shares a login from their own Bitwarden into one (collection Agenti) → the Environment's agent finds it and signs in to an app → the person takes the sharing back; the Lazurio lockup with „Sdílení můžete kdykoli vzít zpět" / "You can take the sharing back at any time".

Dev: the hosted preview takes no-vault or no-tailnet (bun scripts/preview-launchpad.ts hosted cs|en <port> owner no-tailnet).

What intentionally does not change

• The public visitors' Environment (entry.audience: "public", try-01) still has no Trezor section and its vault routes answer as absent (F55).
• Environments with a vault, a personal Environment's own Bitwarden, the Bitwarden steps and their video, this computer's line, and every other unsupported reason.
• No Machines, handover schema or Organization manifest change.

Verified

• bun run check on ffa17505: static gate green (biome lint, tsc --noEmit, check:public over 924 files, build:proof, smoke:proof); bun test 3912 pass, 9 skip, 0 fail across 271 files.
• New/changed contract tests: tests/vault-context.test.ts (no network and no member → no-tailnet on work, Team and Automated; with network → no-vault; a member is the vault either way), tests/vault-page-view.test.ts (both lines word for word in cs/en with the explainer, the other reasons and a vault without it, no Bitwarden steps for no-tailnet), tests/launchpad-vault-page.test.ts (GET /api/vault answers both reasons; the page explains them), tests/launchpad-guide-video.test.ts (section order, the player's files and names in both languages, every video file's format), tests/vault-view.test.ts, tests/vault-requests-view.test.ts, tests/vault-cli.test.ts; tests/public-environment.test.ts unchanged and passing.
• Headless Chrome (root decision 0178) on the hosted preview, Czech and English, no-tailnet and no-vault: the line, the heading, the player at its poster with its sentences, no vault row and no Bitwarden steps; before playing only the poster was requested, then the MP4 from byte ranges (206), playing and seeking; a 390 px wide screen; no page errors. With public: /settings/vault shows Obecné, no Trezor in the navigation.

Direction note (2026-10-17 evening): Buddy will explain the page

Matěj decided on 2026-10-17 (relayed by the prototype thread, prototypes-lazurio #54) that Launchpad explanations will not be texts or diagrams on the page: the "?" opens Buddy, who points at the interface and plays the animation in place. This applies explicitly to the Trezor page. So:

• the reason sentence of this PR (one sentence: the public demo has no vault on purpose / the vault is not set up yet) fits the target page (one sentence, the main action, "?");
• the "Jak trezor funguje" section (the guide video and the three sentences under it) is interim: a follow-up replaces it with Buddy's explanation of Trezor, which takes over the same video and cut (design-system-lazurio#93). This PR keeps its approved scope unless Matěj says otherwise.

Risks and open points

• "No tailnet ⇒ public Organization" holds while Machines writes network for every other work VM (it asserts it today); HumanAndMachine-ai/Machines#597 asks Machines to state that in the handover contract. A second public Organization needs its own root decision before Machines lists it and would get the same words („veřejná ukázka"); that decision has to confirm or change them.
• The video is 23.8 s rather than the script's about 22 s, so that every caption stays readable for at least 1.5 s.
• In the video, the Organization's vault and the Environments' vaults are both labelled „Trezor" (separate tiles, none inside another), as the approved caption „Každá Organizace má vlastní trezor" asks; a viewer could take the Organization's tile for the people's shared Organization vault, which is in fact separate (0203).
• The poster (22 KB) loads whenever the section shows on such an Environment.

Work context

• Agent / thread: Claude Code (Opus 5.5), DEV-6631 vault explainer, a subagent of the DEV-6631 lead (session lazurio-76); session 147aa467-937c-4d0b-895c-9d8e8ba89499 on matejsuchanek.local.
• Worktree: HumanAndMachine-ai_GEN3/.worktrees/productionspace/LazurioPlatform/DEV-6631-vault-explainer, branch agent/DEV-6631-vault-explainer from main 72fdf205.
• Mission Control: DEV-6631 (HumanAndMachine-ai/mission-control-data:v3, data/mission-control/plans/2026/09/DEV-6631-environment-agent-vault.yaml).
• Decision: F53's addendum of 2026-10-17 in docs/decisions.md.

🤖 Generated with Claude Code

Note

Distinguish no-tailnet and no-vault vault reasons and add vault-overview explainer to Launchpad

• Adds no-tailnet as a distinct unsupported vault reason: a handover with no vault and no network resolves to no-tailnet (Environment is public on purpose), while a handover with a network but no vault stays no-vault (Organization Admin has not set it up yet). See context.ts.
• The Launchpad vault page shows a distinct note per reason and, for both, a localized explainer section with a new vault-overview guide video (Czech and English MP4/poster assets) rendered via a new open mode in guide-video.ts that shows the video paused with preload="none".
• CLI status output, request refusal text, and vault view rows get dedicated messages for no-tailnet; the preview script accepts no-vault/no-tailnet flags to start an Environment without a vault.
• Documents the decision and setup in decisions.md, environment-tools.md, and launchpad-development.md.
• Risk: VaultPageView gains an explainer field and vaultContextOf changes reason precedence (no-tailnet when network is absent) — consumers of the old generic no-vault message or status text will see different wording.

^{Macroscope summarized ffa1750.}

[agentrozjedemeai]

Approved at exact head ffa1750. The handover split, personal Bitwarden path, public-visitor gate, Czech/English copy, guide-video embedding and range route are coherent. Independent validation: 97 focused tests passed across 8 files; lint and typecheck passed; the local hosted preview loaded only the poster before play (no autoplay), and a range request returned 206. CI static checks and both test shards are green. Local check:public did not finish within the host time limit, so its green status is CI evidence rather than my local result. In this headless preview playback did not advance for either the new video or the pre-existing Bitwarden video; I cannot claim independent playback verification, but found no new-video-specific defect. No blocking findings; @immakermatty can take the final look. No merge performed.