feat: add Open Lab research-community prototype

.env.example

@@ -1,7 +1,7 @@
 # Session encryption secret (must be at least 32 characters)
 COOKIE_SECRET=your-32-character-secret-here-change-me
 
-# Public URL for production (leave empty for localhost development)
+# Legacy CMS public URL for production (Open Lab uses LAB_PUBLIC_URL below)
 PUBLIC_URL=
 
 # ES256 Private Key in JWK format for confidential client authentication
@@ -23,11 +23,34 @@ NEXT_PUBLIC_GA_ID=
 NEXT_PUBLIC_COOKIE_CONSENT=on
 
 # GraphQL indexer URL for org.plresearch.* records
-# Default: https://api.hi.gainforest.app/graphql
+# Default: https://plresearch-indexer-production.up.railway.app/graphql
 # INDEXER_URL=http://localhost:4000/graphql
 
 # Metaculus API token — enables live community-forecast readings on the /impact
 # dashboard (e.g. the whole-brain-emulation question). Without it the question
 # is still linked, just without a live number. Create a token at
 # https://www.metaculus.com/accounts/settings/
 # METACULUS_API_TOKEN=
+
+# Open Lab: dedicated official browser OAuth, isolated from the legacy CMS.
+# Exact HTTPS origin (no path, credentials, query, or custom port).
+# Empty explicitly disables sign-in; browsing, local drafts, exports and public
+# DID/PDS reads do not require OAuth. Never inherit production identity in previews.
+# On Vercel, OMIT this variable entirely to use that deployment's VERCEL_URL.
+# A non-production deployment rejects a configured origin other than VERCEL_URL.
+LAB_PUBLIC_URL=
+# Local development: LAB_PUBLIC_URL=http://127.0.0.1:3000
+# Open that IP-based origin (not localhost). Official SDK uses its special
+# http://localhost client_id; the redirect_uri remains the loopback IP.
+# Writes remain off until explicitly enabled. Enabling does NOT prove OAuth,
+# consent, schema publication or PDS interoperability. Preview writes are real.
+LAB_ENABLE_PUBLISH=false
+# No new passwords, private keys, OAuth client secrets or CMS admin grants.
+# Setup, public-record privacy and owner-mediated smoke: docs/open-lab/protocol-runbook.md
+
+# Legacy CMS-only page-edit credentials (not used by Open Lab).
+ATPROTO_HANDLE=
+ATPROTO_PASSWORD=
+# Optional legacy CMS admin allowlist and standard.site publication record.
+NEXT_PUBLIC_ADMIN_DIDS=
+NEXT_PUBLIC_PUBLICATION_URI=

docs/lab-explorations.md

@@ -0,0 +1,55 @@
+# Open Lab entrance explorations
+
+Two independent, interactive entrances and a product comparison. These are prototype routes, not a second community deployment. All route content and styling is isolated under `src/app/lab/explorations/` and `src/components/lab/explorations/`. The integration owner supplies the outer Open Lab shell; no auth, server, shared stylesheet, shell, or package changes are required.
+
+## Routes
+
+- `/lab/explorations/` — A/B/C comparison with intent-based recommendations and substantive cold-start, maintenance, and trust tradeoffs. A is the main Open Lab foundation; its miniature is labeled a composition sketch, not a screenshot or live feed.
+- `/lab/explorations/arcade/` — Science Arcade: a paper-like tool cabinet centered on a deterministic elementary cellular-automaton print instrument. Rule slider (0–255), presets, initial-cell selection, boundary condition, and row count change the actual lattice. Exports are real SVG and JSON files generated in the browser, not placeholder downloads.
+- `/lab/explorations/observatory/` — Observatory: dark scientific-question map, with the Neurotech editorial brief selected initially.
+- `/lab/explorations/observatory/{question}/` — direct, server-renderable question briefs: `verifiable-artifacts`, `portable-evaluations`, `neural-measurements`, `robust-coordination`. Unknown IDs use Next's `notFound()`. In-place selections update browser history; back/forward restores the brief. Native links remain usable without client navigation. Map/List uses the same accessible link collection. Selecting a question focuses the brief heading, allowing offscreen results to come into view.
+
+## Instrument contract
+
+`lab-explorations.ts` contains the pure model and export builder. Rule numbering follows the elementary cellular-automaton convention: neighborhood `111` is rule bit 7 and `000` is bit 0. Each row updates synchronously from the previous row. Row zero is the seed, columns run left to right. Fixed boundaries are zero outside the lattice; wrapping boundaries connect the edges. A pair seed uses the central cell and its right neighbor.
+
+Bounds: integer rule 0–255; width 3–241; rows 1–160. The UI uses width 121 and 40, 80, or 120 rows. No randomness or clocks participate in output. SVG and JSON derive from the same cell matrix. JSON schema identifier: `org.plrd.explorations.automaton.v1`; fields include `config`, `convention`, `limit`, `cells`. SVG embeds the configuration, convention, and limit in XML metadata. Configuration is validated and narrowed before serialization; the SVG contains no script, remote image, or external app.
+
+This is a synthetic educational model, not biological data, a claim of computational universality, or evidence of discovery. Downloads are explicit user gestures; feedback says the download was requested, not that it was saved or published. No configuration or result is sent to a server. Object URLs are revoked after the download request.
+
+## Editorial boundaries and sources
+
+The Observatory's four questions are editorial starting points, not active campaigns or requests from project maintainers. Lines join questions to a shared methodological lens; positions are not a quantitative embedding and do not describe social relationships. Briefs separate what exists, the proposed opening, a useful contribution, and the limit of the source. No community identities, activity counts, or peer-review claims are invented.
+
+Public sources inspected September 10, 2026:
+
+- IPFS Content Identifiers: https://docs.ipfs.tech/concepts/content-addressing/
+- EleutherAI Evaluation Harness: https://github.com/EleutherAI/lm-evaluation-harness
+- Neuro Atlas public repository: https://github.com/lksbrssr/neuro-atlas
+- PL Neuro published field overview: https://www.plneuro.xyz/insights/neurotech-frontier-human-flourishing/
+- PL R&D Economies & Governance: https://www.plrd.org/areas/economies-governance/
+- JupyterLite documentation: https://jupyterlite.readthedocs.io/en/stable/
+- Observable Plot: https://observablehq.com/plot/
+
+The hosted Neuro Atlas is not claimed to be anonymously accessible. Tool links open only on explicit navigation, with `noopener noreferrer`; there are no iframes, automatic launches, key collection, or agent dispatch. Contribution links return to the parent lab routes and do not prepopulate, publish, or claim to create a task.
+
+## Verification
+
+Uses the existing Node test runner, TypeScript source loader, React, jsdom, and PostCSS. No dependencies or lockfiles changed.
+
+```sh
+UV_THREADPOOL_SIZE=1 NODE_OPTIONS=--v8-pool-size=1 node --test --test-concurrency=1 scripts/lab-explorations*.test.mjs
+UV_THREADPOOL_SIZE=1 NODE_OPTIONS=--v8-pool-size=1 node node_modules/typescript/bin/tsc --noEmit --incremental false
+```
+
+Vertical RED/GREEN slices covered exact lattice evolution, bounded validation, reproducible exports, actual UI controls and downloads, editorial route lookup, Observatory selection/history/list behavior, and intent-based comparison. Regression coverage checks range/row controls, download failure honesty, anonymous server rendering, all four dynamic route params, unknown-question 404, React server-render warnings, focus transfer, scoped CSS class references, and secondary touch targets.
+
+## Integration owner checks still required
+
+No full production build or independent critic was run in this lane. The parent owns integration, production build, browser QA/screenshots, security review, and the PR. In particular:
+
+1. Check the exact routes at 320/390/1440px within the final lab shell, in both site themes. Arcade/comparison intentionally keep a light paper surface; Observatory intentionally keeps a dark instrument surface. All use the existing Aileron/Newsreader, PL mark, and brand blue.
+2. Confirm native Next.js back/forward, refresh on every direct question route, keyboard selection, offscreen focus/scroll behavior, and Map/List at narrow widths. DOM tests exercise the history handler but are not a real-browser Next navigation smoke.
+3. Download both file types in a real browser, confirm the saved SVG matches the current plot and the JSON reproduces it. DOM tests inspect real generated Blob bytes, not the browser's download manager.
+4. Verify inherited root/shell CSS does not change the scoped composition, and the main lab links resolve after integration. The baseline worktree does not contain the parent primary UI.
+5. No real OAuth or PDS writes were exercised. These alternatives do not invoke them; any owner-consented account smoke is a separate integration gate.

docs/open-lab/README.md

@@ -0,0 +1,60 @@
+# Open Lab prototype
+
+A public-facing place to turn a shared bottleneck into a responsible intervention, a small test, and inspectable evidence. This branch is a product proposal and working prototype, **not a production community launch**. The existing PL R&D brochure is preserved.
+
+## Try the proposal
+
+On the deployment preview, begin at `/lab/`.
+
+- **Bottlenecks:** `/lab/bottlenecks/` — inspect a public-source diagnosis, refine it, or sketch an intervention with a causal hypothesis, affected parties, measurement, risks and stopping condition. Preparation is not acceptance or publication.
+- **Community:** `/lab/demo/` — follow three fictional collaborations, inspect people and discussion, reply locally, and follow a notification to the exact discussion. The demo label is intentional. Switching to real/empty mode hides this activity without deleting personal drafts.
+- **Apps:** `/lab/apps/` — try the synthetic signal experiment, change its sampling, and export its actual configuration/results; inspect external source-linked science tools.
+- **Atlas:** `/lab/atlas/` — prepare source-linked evidence proposals. These do not automatically change an Atlas.
+- **Collaborate:** `/lab/collaborate/` — export bounded researcher/reviewer packets, import their return files, retain disagreement, and export a human-resolution bundle. No agent is launched and no model-provider account is collected.
+- **Your starting point:** `/lab/onboarding/` and `/lab/profile/` — choose interests and contribution style, keep an owner-scoped profile draft, and optionally provide work/publication links. LinkedIn and Scholar are self-supplied links, not verified credentials or connected accounts.
+- **Effort backing:** `/lab/efforts/` — allocate and reclaim a finite illustrative local budget while recording evidence separately. No money moves and no Hypercert is issued. This experiment is separate from the demo community’s small fictional interest budget.
+- **Public record inspection:** `/lab/record/?uri=<encoded-exact-AT-URI>` — read a deliberately shared record from its current PDS. HTTPS retrieval is not repository-signature verification or scientific review.
+
+The alternative entrances are at `/lab/explorations/`: **Science Arcade**, a real cellular-automaton instrument, and **Observatory**, a source-linked question map. They explore different ways in, rather than merely changing colors.
+
+## What is real, illustrative, and not yet verified
+
+| Layer | Boundary |
+| --- | --- |
+| Local tools and drafts | Interactive computation, saving, bounded imports, comparisons and exports run locally. Browser storage is not encrypted or cross-device sync. |
+| Fictional community | People, discussion, proposals and narrative outcomes are clearly labeled fixtures. Local replies/interest never become public posts or actual notifications to other people. |
+| Public sources | Editorial artifacts and attributed Bluesky reads are separate from demo activity and membership. Outages remain unavailable states, not fabricated live feeds. |
+| AT Protocol | Dedicated official browser SDK, identity-only login followed by explicit per-action permissions, candidate schemas, direct PDS operations and exact current URI/CID/content readback. No CMS/admin identity reuse. |
+| Account-level verification | Real account OAuth and public PDS create/update/delete need a separately approved test account and exact public text. Injected transport tests do not establish hosted account compatibility. |
+| Launch operations | Global discovery/indexing, moderation, reporting/appeals, accepted-evidence workflow, founding cohort and public schema registration remain launch work. |
+
+`LAB_ENABLE_PUBLISH` is off by default. A configured origin is not a passed OAuth test. A public record is not accepted science. A preview is not a private PDS sandbox.
+
+## Local development and verification
+
+Use Node 22 or newer. Vercel uses the repository’s **pnpm 10 lockfile**, so a successful npm install alone is not the deployment install gate.
+
+```sh
+npx --yes pnpm@10.17.1 install --frozen-lockfile
+npm test
+npx tsc --noEmit --incremental false
+npm run build
+npm start
+```
+
+The tests include local synthetic fixtures and injected protocol transport, not real public mutations. The release evidence must additionally include actual desktop/mobile interaction checks and an independent review at the final source revision. If dependencies change, maintain both lockfiles without re-resolving unrelated packages.
+
+For identity-only local development, the runbook documents explicit IP-loopback configuration. Do not copy production credentials, disable a preview access gate, or reuse CMS authentication to make a test pass.
+
+## Design and technical notes
+
+- [Product rationale and launch experiment](strategy.md)
+- [Acceptance and evidence standard](acceptance.md)
+- [Protocol, candidate schemas and owner-gated launch checklist](protocol-runbook.md)
+- [Bottleneck model and permissioned-console boundary](bottleneck-co-creation.md)
+- [Demo fixtures, interactions and isolation](demo-community.md)
+- [Onboarding, optional links and local action inbox](social-onboarding.md)
+- [Finite backing and Hypercerts design](effort-backing.md)
+- [Alternative entrance comparison](../lab-explorations.md)
+
+The release PR is the home for the final revision, test/build receipts, screenshots, preview status and remaining limitations.

docs/open-lab/acceptance.md

@@ -0,0 +1,36 @@
+# Open Lab acceptance and launch boundary
+
+This is a feature-branch research-community prototype, not a launch or proof of community adoption. Production merge, real public-account publication, payments, additional data imports, and certificate issuance are separate decisions.
+
+## The product test
+
+A new visitor can do something useful before another member arrives: run a small reproducible synthetic experiment, inspect an actual source, or draft a bounded contribution. A second person can inspect a deliberately shared public record and prepare their own evidence response. The UI must not turn source discovery into invented participation.
+
+## Latest product center and social/demo criteria
+
+- Organizing loop: bottleneck → collective refinement → responsible intervention/invention proposal → bounded test → evidence → revise/continue/retire. Apps, maps, agent work and effort backing support this; they do not substitute for it.
+- Every intervention proposal targets a specific bottleneck and captures the causal hypothesis, smallest useful test, success/measurement signal, affected parties, risks, and stopping/review condition. Proposals do not silently overwrite accepted state or assign other people work.
+- Reuse the Console’s domain shape and source identity, but no direct exposure of a permissioned workspace. This prototype may use synthetic editorial cases; actual public projections and return reconciliation remain deliberate owner-reviewed gates.
+- Top-right action notifications, optional LinkedIn/Scholar profile completion, and skippable interest/contribution-style onboarding lead to concrete, explainable starting suggestions. Self-supplied links are not verified credentials; nothing posts without review.
+- The user explicitly authorized a populated demo. Clearly labeled fictional people, threads, interventions, evidence, and action notifications should form coherent stories across the app. They must be interactive and visually legible—not fake activity presented as actual usage. Switching to real/empty mode must hide demo identities/counts/events and preserve real drafts. Demo interactions never reach a public PDS.
+
+## Required probes
+
+- Preserve the existing PL R&D brochure and public focus-area pages; no unrelated preview promotion.
+- Real local paths for landing, feed/map, apps/sandbox, Atlas contribution, collaboration, bench, public-record viewer, design comparisons, and effort backing.
+- Desktop and small-screen rendering; visible focus, keyboard dialog dismissal, no page-width overflow, readable light/dark states. Local screenshots are labeled local; screenshots use pinned source.
+- Signal experiment and alternate cellular-automaton instrument actually compute from user controls. Export contains the configuration, method, limitations and computed result—not a fabricated scientific finding.
+- Editorial source cards are real and explicitly not asserted to be members. A live Bluesky source failure is not replaced by fake live posts. Map relationships have a stated meaning, never counterfeit social-network edges.
+- Draft persistence, recovery, storage-failure messages, owner isolation, no automatic migration/publication on sign-in, and fresh confirmation after any change.
+- Dedicated Open Lab OAuth, no reuse of CMS/admin sessions. Explicit granular permissions, per-action consent, direct PDS writes, exact URI/CID/content readback. Failure/uncertain write states preserve work and discourage duplicate retry. Mock transport tests are labeled mock; no claim of real OAuth verification without an actual authorized account flow.
+- Public record reads work without Lab sign-in, preserve identities and source content, limit responses, show unavailable/missing records honestly, and never call a PDS HTTPS response a verified repository signature.
+- Own-record update/deletion uses reviewed CID and fails on stale identity/version. Downstream-copy limits are explicit. Pagination or truncation is visible rather than a falsely complete notebook.
+- Two bounded agent-return files can be imported, validated, compared and reviewed. Dissent remains visible. An exported review is local/unsigned—not peer review, a remote agent run, or public publication. No subscription credentials, automatic spending, or arbitrary agent execution.
+- Finite local backing points enforce the displayed total; allocations can be reclaimed and exported. Corrupt storage cannot silently create a larger budget. No crowds, dollars, globally enforced identity budget, or issued Hypercert is fabricated. Support, evidence and evaluation stay distinct.
+- Hypercerts documentation is cited accurately: AT Protocol activity/context/evaluation records are a future interoperable path; no tokenization or finance claim inferred from an unsigned local design sketch.
+
+## Evidence standard
+
+Frozen pnpm 10 install, project-wide tests (including new Lab suites), no-emit typecheck, production build, actual route/interaction checks, and independent exact-revision security and product/design review. Test fixtures, local behavior, public-source reads, configured capabilities, and real account/provider verification are five different evidence categories. Keep them separate in the PR.
+
+A passed build is not a passed community loop. A configuration flag is not a successful OAuth session. A created record is not accepted science. A preview URL is not launch approval.