repository is now a presentation-ready development prototype

dashboard/README.md

@@ -1,10 +1,18 @@
 # Utah Vehicle Health dashboard
 
-This directory is a dependency-free static prototype. It uses semantic HTML,
-CSS, vanilla ES modules, and inline SVG generated from approved aggregate JSON.
-It has no database client, server credential, analytics SDK, or external CDN.
+This directory is a dependency-free static development prototype. It uses
+semantic HTML, CSS, vanilla ES modules, and inline SVG generated from approved,
+suppressed aggregate JSON. It has no database client, server credential,
+analytics SDK, or external CDN.
 
-## Run locally from the repository root
+Every displayed result comes from the private 10,000-vehicle development
+sample. Results are sample-based, are not population estimates, and must not be
+used for individual decisions. The final prototype model is calibrated logistic
+regression; the boosted tree is a benchmark only.
+
+## Run locally
+
+From the Utah Vehicle Health source-repository root:
 
 ```bash
 node dashboard/server.mjs
@@ -23,6 +31,14 @@ Run the dependency-free contract checks with:
 node --test dashboard/tests/contract.test.mjs
 ```
 
+After the contents of `dashboard/` have been copied into a dashboard-only
+repository or project root, use the self-contained equivalents:
+
+```bash
+npm start
+npm test
+```
+
 ## Public-data boundary
 
 The browser requires and validates these files beneath `public/data/`:
@@ -41,27 +57,33 @@ contains a denied identifier-like field, the dashboard shows an unavailable
 state and no estimates. Regenerate assets with the repository's private local
 pipeline; never hand-edit public JSON to bypass suppression.
 
-The next-test estimator is intentionally disabled. It must remain disabled
-until a separately reviewed and suppressed `prediction_lookup` contract is
-approved. Do not add a connection from this site to `countydata`.
+The site intentionally contains no vehicle lookup, individual estimator,
+operational connection, or row-level prediction output. VINs, plates, ZIPs,
+stations, technician identifiers, raw source JSON, credentials, and operational
+records must never enter this directory.
 
-## Import into Bolt
+## Publish through Bolt
 
-The recommended publication boundary is a separate static Bolt project (and,
-ideally, a separate deployment repository) containing only the contents of
-`dashboard/`. Upload or copy this directory's contents so `index.html` is at the
-new project root. There is no install or build step. If Bolt asks for a preview
-command, use `node server.mjs` with `HOST=0.0.0.0`; Bolt supplies `PORT`.
+Use a separate static Bolt project backed by a dashboard-only repository. Do
+not import this source repository into Bolt.
 
-Before publishing, confirm that `/public/data/data_manifest.json` resolves,
-the development-preview banner remains visible, and the contract test passes.
-The generated JSON bundle must also complete its privacy review.
+1. Run `npm test` from this directory and confirm every contract check passes.
+2. Create a clean dashboard-only repository or Bolt project.
+3. Copy only the *contents* of `dashboard/` into that project, so `index.html`
+   is at the project root.
+4. Confirm that private `data/`, `artifacts/`, `models/`, `.env` files, SQL,
+   notebooks, and database tooling are absent.
+5. Preview the project. There is no install or build step; if Bolt requests a
+   preview command, use `node server.mjs` with `HOST=0.0.0.0` and let Bolt
+   provide `PORT`.
+6. Verify all four views, the development-sample messaging on every view, and
+   that the in-app status reads **Validated sample aggregates**.
+7. Use **Publish** only after the aggregate bundle completes privacy review.
+   Bolt hosting is the default; Netlify can instead be selected before the
+   first publish if desired.
 
-Importing the whole source repository is a discouraged fallback because Bolt
-would receive SQL, database tooling, and other files that are not needed by the
-public site. If that has already happened, set the project/working root to
-`dashboard`, never serve the repository root, and create a dashboard-only
-project before production publication. Do not copy private `data/`,
-`artifacts/`, `models/`, `.env`, or database tooling into the public project.
+See Bolt's official documentation for [Git
+integration](https://support.bolt.new/integrations/git) and [publishing with
+Netlify](https://support.bolt.new/integrations/netlify).
 
 No publishing action is performed by this repository.