# Utah Vehicle Health dashboard

This directory is a dependency-free static development prototype. It uses
semantic HTML, CSS, vanilla ES modules, and inline SVG generated from approved,
suppressed aggregate JSON. It has no database client, server credential,
analytics SDK, or external CDN.

Every displayed result comes from the private 10,000-vehicle development
sample. Results are sample-based, are not population estimates, and must not be
used for individual decisions. The final prototype model is calibrated logistic
regression; the boosted tree is a benchmark only.

## Run locally

From the Utah Vehicle Health source-repository root:

```bash
node dashboard/server.mjs
```

Open `http://127.0.0.1:4173`. Do not open `index.html` directly with a `file:`
URL; browsers will block the JSON module requests. To use another port:

```bash
PORT=8080 node dashboard/server.mjs
```

Run the dependency-free contract checks with:

```bash
node --test dashboard/tests/contract.test.mjs
```

After the contents of `dashboard/` have been copied into a dashboard-only
repository or project root, use the self-contained equivalents:

```bash
npm start
npm test
```

## Public-data boundary

The browser requires and validates these files beneath `public/data/`:

- `data_manifest.json`
- `overview_period_county.json`
- `age_risk_curve.json`
- `cohort_scorecard.json`
- `model_diagnostics.json`
- `coverage_quality.json`
- `filter_catalog.json`
- `sha256_manifest.json`

If any file is missing, malformed, has inconsistent publication flags, or
contains a denied identifier-like field, the dashboard shows an unavailable
state and no estimates. Regenerate assets with the repository's private local
pipeline; never hand-edit public JSON to bypass suppression.

Previously published cohort definitions are frozen against cross-release
differencing. New canonical model families may be added only when the combined
family clears every publication threshold; aliases or trims must not be folded
into an existing public cell. Increment `PUBLICATION_POLICY_VERSION` whenever
an approved aggregation policy changes.

The site intentionally contains no vehicle lookup, individual estimator,
operational connection, or row-level prediction output. VINs, plates, ZIPs,
stations, technician identifiers, raw source JSON, credentials, and operational
records must never enter this directory.

## Publish through Bolt

Use a separate static Bolt project backed by a dashboard-only repository. Do
not import this source repository into Bolt.

1. Run `npm test` from this directory and confirm every contract check passes.
2. Create a clean dashboard-only repository or Bolt project.
3. Copy only the *contents* of `dashboard/` into that project, so `index.html`
   is at the project root.
4. Confirm that private `data/`, `artifacts/`, `models/`, `.env` files, SQL,
   notebooks, and database tooling are absent.
5. Preview the project. There is no install or build step; if Bolt requests a
   preview command, use `node server.mjs` with `HOST=0.0.0.0` and let Bolt
   provide `PORT`.
6. Verify all four views, the development-sample messaging on every view, and
   that the in-app status reads **Validated sample aggregates**.
7. Use **Publish** only after the aggregate bundle completes privacy review.
   Bolt hosting is the default; Netlify can instead be selected before the
   first publish if desired.

See Bolt's official documentation for [Git
integration](https://support.bolt.new/integrations/git) and [publishing with
Netlify](https://support.bolt.new/integrations/netlify).

No publishing action is performed by this repository.