feat(user-role): persona/capability-gating — role model, callsite reclassification, and role-picker UI

CHANGELOG.md

@@ -99,6 +99,19 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
   including pasting a raw shielded address in hex form — there are just fewer
   screens to navigate between.
 
+- **Expert mode replaced by three interface levels**: the single Expert-mode
+  toggle is now a three-way choice — **Default view**, **Detailed view**, and
+  **Developer tools** — set from Network Settings or during first-time setup.
+  Detailed view unlocks everything the old Expert mode did (account
+  breakdowns, address tables, masternode tools); a few of the most advanced
+  actions (state-transition signing overrides, proceeding without a locally
+  held key, clearing Platform addresses) now require the new Developer tools
+  level. Until you pick a level, the app starts in Detailed view, so nothing
+  the old Expert mode showed you is hidden. The choice is remembered and can
+  be changed anytime, and it is made in the app — the `DEVELOPER_MODE` entry
+  in `.env` no longer has any effect on it. See
+  [User Roles](docs/user-roles.md) for details.
+
 ### Known Limitations
 
 - **Single-key wallets — send and balance refresh not available**: importing a

README.md

@@ -107,6 +107,11 @@ When the application runs for the first time, it creates an application director
 | - | - | - | - |
 | `DASH_EVO_TOOL_ACCESSIBILITY` | `1` / unset | unset | Force-enable accessibility support. Activates AccessKit eagerly so the UI element tree is populated every frame and (on macOS) forces the platform accessibility adapter to initialize. Without this flag, accessibility still works normally — VoiceOver and other assistive technologies trigger AccessKit's lazy activation automatically. This flag is needed for tools that query the accessibility tree without registering as assistive technology clients (e.g. AXUIElement-based automation like Peekaboo). |
 
+The interface mode (Default view / Detailed view / Developer tools) is not an
+environment variable — it is chosen in the app and stored with your settings.
+See [docs/user-roles.md](docs/user-roles.md), which also covers the obsolete
+`DEVELOPER_MODE` entry older configurations may still contain.
+
 ## Contributing
 
 Contributions are welcome! See the [Contributing Guide](CONTRIBUTING.md) for details.

docs/user-roles.md

@@ -0,0 +1,70 @@
+# User Roles (Interface Mode)
+
+Dash Evo Tool adapts its interface to how you use it. Instead of a single
+"Expert mode" on/off switch, the app offers three interface modes, each
+revealing more advanced controls than the one before it:
+
+| Mode | What it shows |
+| - | - |
+| **Default view** | Your balance, send and receive, and usernames. |
+| **Detailed view** | Adds account details, address tables, and masternode tools. |
+| **Developer tools** | Adds raw protocol data, Devnet, and signing overrides. |
+
+Each mode includes everything the one before it does — Developer tools has
+everything Detailed view has, plus more. **Detailed view** is the starting
+point until you pick a mode yourself; switch down to Default view for a
+simpler screen, or up to Developer tools when you need raw protocol data.
+
+## Where to set it
+
+The three modes are chosen the same way, with the same descriptions, in two
+places:
+
+- **Network Settings** — open the network chooser screen. An **Interface
+  mode** card sits above Advanced Settings, always visible (it is not tucked
+  inside a collapsed section).
+- **Welcome screen** — on first launch, the onboarding screen shows a
+  "Choose your experience level" row with the same three options before you
+  create or load a wallet.
+
+Picking a mode in either place updates the other — there is only one active
+mode, shared across the whole app.
+
+**This choice is reversible.** You are not locking yourself into a mode by
+picking one at onboarding: open **Network Settings** at any time and change
+it from the **Interface mode** card. The app applies the change immediately,
+with no restart required.
+
+## Upgrading from an older install
+
+Earlier versions had a **Developer mode** on/off switch instead of the three
+interface modes. If you are upgrading, and you have not picked an interface
+mode yet, the app starts you in **Detailed view** — the mode that matches the
+account details, address tables and masternode tools those builds exposed.
+Nothing you had is hidden, and you can move to another mode at any time from
+**Network Settings**.
+
+The interface mode is chosen in the app, not in a file: it is stored with your
+other settings, and it is the same on every network.
+
+## Migration note: obsolete `.env` entries
+
+Older configurations may still contain a global `DEVELOPER_MODE=true|false`
+entry, or per-network entries such as `MAINNET_developer_mode=true`. Neither has
+any effect on the interface mode — that is chosen in the app and stored with your
+settings. New installs no longer get a `DEVELOPER_MODE` line at all.
+
+Leave the leftover entries or delete them, as you prefer. The one place
+`DEVELOPER_MODE` is still consulted is the one-time database upgrade that moved
+existing installs onto the built-in light client (SPV): an install that had both
+`DEVELOPER_MODE=true` and a Dash Core RPC password configured keeps talking to
+its local Dash Core node. That upgrade runs once, and only for installs that
+predate it.
+
+The application directory holding `.env` is:
+
+| Operating System | Path |
+| - | - |
+| macOS | `~/Library/Application Support/Dash-Evo-Tool/.env` |
+| Windows | `C:\Users\<User>\AppData\Roaming\Dash-Evo-Tool\config\.env` |
+| Linux | `~/.config/dash-evo-tool/.env` |

docs/user-stories.md

@@ -204,12 +204,12 @@ As a user, I want to see clear tabs for Dash Core, Platform, and Shielded so tha
 - Empty accounts display "(empty)" indicator.
 - Switching tabs is instant with no data reload.
 
-### WAL-022: View system accounts in developer mode [Implemented]
-**Persona:** Jordan
+### WAL-022: View system accounts in the Detailed view [Implemented]
+**Persona:** Priya, Jordan
 
-As a developer, I want a System tab that reveals all internal account categories (Identity Registration, CoinJoin, Provider keys, etc.) so that I can inspect low-level wallet structure without cluttering the default view.
+As a power user, I want a System tab that reveals all internal account categories (Identity Registration, CoinJoin, Provider keys, etc.) so that I can inspect low-level wallet structure without cluttering the default view.
 
-- System tab appears only when developer mode is enabled.
+- System tab appears only at the Power role (Detailed view) or above.
 - Each system account category is shown as a collapsible section.
 - Section headers display address count and balance.
 
@@ -1050,20 +1050,21 @@ As a user, I want to choose between light, dark, or auto theme so that the app m
 - Light, dark, and system-auto options.
 - Theme change applied immediately.
 
-### NET-005: Toggle developer mode [Implemented]
+### NET-005: Unlock advanced features by interface mode [Implemented]
 **Persona:** Priya, Jordan
 
-As a user, I want to enable developer mode so that I can access advanced features like address tables, refresh controls, and debug tools.
+As a user, I want a higher interface mode to reveal advanced features like address tables, refresh controls, and debug tools, so that complexity stays out of my way until I ask for it.
 
-- Toggles visibility of advanced UI elements.
+- Detailed view and Developer tools each add capabilities on top of the mode below them.
+- Feature availability is monotonic: anything a lower mode can do, a higher mode can too.
 
-### NET-006: Select user mode [Gap]
-**Persona:** Alex, Priya
+### NET-006: Select interface mode [Implemented]
+**Persona:** Alex, Priya, Jordan
 
-As a user, I want to choose between Beginner and Advanced mode so that the interface matches my experience level.
+As a user, I want to choose between Default view, Detailed view, and Developer tools so that the interface matches my experience level.
 
-- Beginner mode hides complexity; Advanced mode shows full detail.
-- `UserMode` enum and database persistence exist but no UI control is implemented.
+- Same three choices and descriptions on the Network Settings "Interface mode" card and the Welcome screen onboarding row.
+- Choice persists and applies immediately, and can be changed again at any time.
 
 ### NET-007: Granular refresh controls [Implemented]
 **Persona:** Priya
@@ -1136,7 +1137,7 @@ As an everyday user, I want to install and use Dash Evo Tool without having to r
 
 - Fresh install connects to the Dash network via the built-in SPV light client with zero configuration.
 - The user sees sync progress and status clearly; the default everyday-user UI avoids mentions of SPV, RPC, or nodes.
-- Technical/protocol terminology may appear in Expert mode or advanced settings, where Dash Core RPC remains available as an opt-in for users who do run a local node.
+- Technical/protocol terminology may appear in Detailed view, Developer tools, or advanced settings, where Dash Core RPC remains available as an opt-in for users who do run a local node.
 
 ---
 
@@ -1254,13 +1255,13 @@ As Alex, setting up a social profile to unlock DashPay contacts is clearly optio
 - Settings tab hosts the social-profile block where display name and avatar can be edited; identities without a profile continue to use payments and usernames untouched.
 - Home tab renders a `Set up your social profile` entry in the onboarding checklist with a skip affordance — opting in is never forced.
 
-### IDH-005: Developer bulk identity creation [Gap]
-**Persona:** Jordan
+### IDH-005: Bulk identity creation [Gap]
+**Persona:** Priya, Jordan
 
-As Jordan in Developer Mode, I have a single entry point to create many test identities without leaving the Identities section.
+As a power user, I have a single entry point to create many test identities without leaving the Identities section.
 
-- Onboarding screen surfaces a Developer-mode footer mentioning `Create multiple test identities` / `Load identity by ID` as plain text.
-- Planned (follow-up): wire those footer items to the existing `AddNewIdentityScreen` bulk path and dev-mode identity-picker dropdown entries.
+- Onboarding screen surfaces a footer, shown at the Power role or above, mentioning `Create multiple test identities` / `Load identity by ID` as plain text.
+- Planned (follow-up): wire those footer items to the existing `AddNewIdentityScreen` bulk path and the Power-role identity-picker dropdown entries.
 
 ### IDH-006: Unified activity timeline [Gap]
 **Persona:** All
@@ -1289,7 +1290,7 @@ As a masternode operator, I want a card list of my loaded masternodes showing ty
 
 - Each card shows a shortened ProTxHash (or alias as heading), a Masternode/Evonode type badge, voter-identity readiness ("Voting ready" / "No voting key"), a compact Voting/Owner/Payout key-status indicator, a DPNS-voting status line, and an identity status dot with a text label.
 - An empty state explains what a masternode identity is for and offers a primary "Load a masternode" action when none are loaded.
-- The Masternodes tab and its nav entry are visible only with Expert Mode enabled; turning Expert Mode off while the tab is active falls back to the Identities screen.
+- The Masternodes tab and its nav entry are visible only at the Detailed view interface mode or above; dropping below Detailed view while the tab is active falls back to the Identities screen.
 
 ### MN-003: Open a masternode and vote [Implemented]
 **Persona:** Priya

src/app.rs

@@ -13,6 +13,7 @@ use crate::backend_task::error::TaskError;
 use crate::backend_task::{BackendTask, BackendTaskSuccessResult};
 use crate::context::AppContext;
 use crate::context::connection_status::{ConnectionStatus, OverallConnectionState};
+use crate::context::feature_gate::FeatureGate;
 use crate::context::migration_status::MigrationStep;
 use crate::database::Database;
 use crate::model::settings::AppSettings;
@@ -563,15 +564,11 @@ impl AppState {
 
         let saved_network = settings.network;
 
-        // App-global Expert Mode flag: read once from config and shared into
-        // every per-network context (including any created later by a network
-        // switch), so a live toggle is observed everywhere without a restart.
-        let developer_mode = Arc::new(std::sync::atomic::AtomicBool::new(
-            crate::config::Config::load_from(&data_dir)
-                .ok()
-                .and_then(|c| c.developer_mode)
-                .unwrap_or(false),
-        ));
+        // App-global user role, shared into every per-network context (including
+        // any created later by a network switch) so a live change is observed
+        // everywhere without a restart. Seeded below from `get_app_settings()`
+        // once the active context exists — the single persisted source of truth.
+        let user_role = crate::model::user_role::UserRoleCell::default();
 
         // Build a helper to create AppContext for a given network.
         let make_context = |network: Network| -> Option<Arc<AppContext>> {
@@ -584,7 +581,7 @@ impl AppState {
                 ctx.clone(),
                 Arc::clone(&app_kv),
                 Arc::clone(&secret_store),
-                Arc::clone(&developer_mode),
+                user_role.clone(),
             )
         };
 
@@ -636,6 +633,17 @@ impl AppState {
             .expect("invariant: chosen_network was just taken from network_contexts")
             .clone();
 
+        // Seed the shared role cell from AppSettings — the single source of truth.
+        // `get_app_settings` resolves an account that never chose a role to
+        // `UserRole::WHEN_UNSET`. `set_user_role` publishes the value to every
+        // context holding the cell and syncs animation gating.
+        active_context.set_user_role(
+            active_context
+                .get_app_settings()
+                .user_role
+                .unwrap_or(crate::model::user_role::UserRole::WHEN_UNSET),
+        );
+
         // load fonts
         ctx.set_fonts(crate::bundled::fonts().expect("failed to load fonts"));
 
@@ -1057,12 +1065,12 @@ impl AppState {
     }
 
     pub fn active_root_screen_mut(&mut self) -> &mut Screen {
-        // Live de-gating (§10.11): if Expert Mode flipped off while the
+        // Live de-gating (§10.11): if the role dropped below Power while the
         // Masternodes tab was active, fall back to the neutral Identities tab so
-        // the Expert-gated screen is never shown without its gate. Identities is
-        // always registered, so the subsequent lookup cannot fail.
+        // the gated screen is never shown without its gate. Identities is always
+        // registered, so the subsequent lookup cannot fail.
         if self.selected_main_screen == RootScreenType::RootScreenMasternodes
-            && !self.current_app_context().is_developer_mode()
+            && !FeatureGate::Masternodes.is_available(self.current_app_context())
         {
             self.selected_main_screen = RootScreenType::RootScreenIdentities;
         }

src/backend_task/core/mod.rs

@@ -425,7 +425,7 @@ mod send_payment_unsupported_options {
             egui::Context::default(),
             app_kv,
             secret_store,
-            std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false)),
+            crate::model::user_role::UserRoleCell::default(),
         )
         .expect("AppContext")
     }

src/backend_task/identity/load_identity.rs

@@ -827,7 +827,7 @@ mod tests {
             egui::Context::default(),
             app_kv,
             secret_store,
-            std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false)),
+            crate::model::user_role::UserRoleCell::default(),
         )
         .expect("offline testnet AppContext::new");
         let (tx, _rx) = tokio::sync::mpsc::channel::<TaskResult>(32);
@@ -954,7 +954,7 @@ mod tests {
             egui::Context::default(),
             app_kv,
             secret_store,
-            std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false)),
+            crate::model::user_role::UserRoleCell::default(),
         )
         .expect("offline testnet AppContext::new");
         let (tx, _rx) = tokio::sync::mpsc::channel::<TaskResult>(32);
@@ -1038,7 +1038,7 @@ mod tests {
             egui::Context::default(),
             app_kv,
             secret_store,
-            std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false)),
+            crate::model::user_role::UserRoleCell::default(),
         )
         .expect("offline testnet AppContext::new");
         // The scoped merge prompt asks for the node's object password once.
@@ -1149,7 +1149,7 @@ mod tests {
             egui::Context::default(),
             app_kv,
             secret_store,
-            std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false)),
+            crate::model::user_role::UserRoleCell::default(),
         )
         .expect("offline testnet AppContext::new");
         // No prompt installed: the default NullSecretPrompt fails closed.
@@ -1222,7 +1222,7 @@ mod tests {
             egui::Context::default(),
             app_kv,
             secret_store,
-            std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false)),
+            crate::model::user_role::UserRoleCell::default(),
         )
         .expect("offline testnet AppContext::new");
         let (tx, _rx) = tokio::sync::mpsc::channel::<TaskResult>(32);

src/backend_task/identity/protect_identity_keys.rs

@@ -721,7 +721,7 @@ mod tests {
             egui::Context::default(),
             app_kv,
             secret_store,
-            std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false)),
+            crate::model::user_role::UserRoleCell::default(),
         )
         .expect("offline testnet AppContext::new");
         let (tx, _rx) = tokio::sync::mpsc::channel::<TaskResult>(32);
@@ -792,7 +792,7 @@ mod tests {
             egui::Context::default(),
             app_kv,
             secret_store,
-            std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false)),
+            crate::model::user_role::UserRoleCell::default(),
         )
         .expect("offline testnet AppContext::new");
         let (tx, _rx) = tokio::sync::mpsc::channel::<TaskResult>(32);

src/backend_task/migration/finish_unwire.rs

@@ -2880,7 +2880,7 @@ mod tests {
             egui::Context::default(),
             app_kv,
             secret_store,
-            std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false)),
+            crate::model::user_role::UserRoleCell::default(),
         )
         .expect("AppContext")
     }

src/backend_task/mod.rs

@@ -624,10 +624,10 @@ impl AppContext {
                 let egui_ctx = self.egui_ctx().clone();
                 let app_kv = self.app_kv();
                 let secret_store = self.secret_store();
-                // Share the app-global Expert Mode flag so the freshly-switched
-                // context observes the same value (and live toggles) as the rest
-                // of the app — never a fresh per-context flag.
-                let developer_mode = self.developer_mode_handle();
+                // Share the app-global role cell so the freshly-switched context
+                // observes the same value (and live changes) as the rest of the
+                // app — never a fresh per-context cell.
+                let user_role = self.user_role_cell();
                 let new_ctx = tokio::task::block_in_place(|| {
                     AppContext::new(
                         data_dir,
@@ -638,7 +638,7 @@ impl AppContext {
                         egui_ctx,
                         app_kv,
                         secret_store,
-                        developer_mode,
+                        user_role,
                     )
                 })
                 .ok_or(TaskError::NetworkContextCreationFailed { network })?;

src/backend_task/wallet/generate_receive_address.rs

@@ -55,7 +55,7 @@ mod tests {
             egui::Context::default(),
             app_kv,
             secret_store,
-            std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false)),
+            crate::model::user_role::UserRoleCell::default(),
         )
         .expect("offline testnet AppContext::new");