/home.html

PREFIX dcterms: <http://purl.org/dc/terms/>
PREFIX gcs:     <https://graphcentric.com/schema/>
PREFIX rdf:     <http://www.w3.org/1999/02/22-rdf-syntax-ns#>
PREFIX rdfs:    <http://www.w3.org/2000/01/rdf-schema#>
PREFIX schema:  <https://schema.org/>
PREFIX sh:      <http://www.w3.org/ns/shacl#>
PREFIX xsd:     <http://www.w3.org/2001/XMLSchema#>

<https://graphcentric.one/home.html>
        rdf:type           gcs:WebResource;
        gcs:contentType    "text/html;charset=utf-8";
        gcs:frame          <s3://graphcentric.one/home-frame.jsonld>;
        gcs:graph          <https://graphcentric.one/graphs/public-resources>;
        gcs:outerTemplate  <s3://graphcentric.one/templates/one-root.html>;
        gcs:query          <s3://graphcentric.one/home.sparql>;
        gcs:template       <s3://graphcentric.one/home.html>;
        schema:name        "Home HTML" .

BASE <https://graphcentric.one/>

PREFIX schema: <https://schema.org/>
PREFIX as: <https://www.w3.org/ns/activitystreams#>
PREFIX one: <https://graphcentric.info/ns/one#>
PREFIX gcs: <https://graphcentric.com/schema/>

# ============================================================================
# /home — the caller's VIEWER IDENTITY STAMP (plan 2026-07-19-spotlight-home-shell,
# GC-6; amputated by ISSUE-PAL-2, command palette v2 stage 1).
# ============================================================================
#
# NAVIGATION MOVED TO /affordances.jsonld. This document used to be two things:
# the viewer's identity AND a hand-maintained navigation registry (a 16-row
# module VALUES, a 41-row section VALUES, a 6-row create-action VALUES and an
# 8-arm role-ladder guard FILTER). That registry WAS the ISSUE-PAL-2 bug: a page
# absent from it was unreachable from ⌘K, so every new screen had to be
# remembered here, and its guard ladder (Admin > Manager > Recruiter > Employee,
# ONE primary role) drifted from the real ACL, which is a SET of team
# memberships. site/affordances.sparql derives destinations from the deployed
# HTML representations and trims them with real grants; the exception table
# there lists only exceptions, so a page absent from it is VISIBLE. The failure
# mode inverts — that is the whole fix (spec 3.1).
#
# WHAT REMAINS, and why the doc was not deleted outright:
#   * site/templates/one-root.html fetches it once post-paint to stamp
#     <one-palette user-role viewer-worker-type> and fill the avatar-menu role
#     label. worker-type still drives the contractor time verb, and role is
#     still the honest label source.
#   * tests/e2e-playwright/palette-harness.mjs BLOCKS on
#     `window.__oneHome && one-palette[user-role]` and FAILs any scenario where
#     the role never stamps — deleting the doc would red the entire bank.
#   * tests/lib/provision-test-users.sh reads /home.jsonld `viewer` to verify
#     provisioning.
#
# ACL: the rep's read-ACL is the manifest `graph` binding; the QUERY runs
# against the CALLER's ACL-filtered dataset. Every BIND below is TOTAL, so the
# one:HomeState root always constructs for a signed-in caller.
#
# F-1 EMPTY @set OMISSION: mothership OMITS an @set-typed key entirely when a
# caller has zero rows for it. All values STR()-wrapped (house style).

CONSTRUCT {
  ?_subject a one:HomeState ;
    one:viewer ?_user .

  ?_user one:username ?viewerUsername ;
    schema:name ?viewerName ;
    schema:image ?viewerImage ;
    one:userRole ?viewerRole ;
    one:userRoleLabel ?viewerRoleLabel ;
    one:viewerWorkerType ?viewerWorkerType .
}
WHERE {
  # ---- viewer identity block (scalars; every BIND total) ----------------------
  OPTIONAL {
    GRAPH </graphs/one-org> {
      ?_user a schema:Person ; schema:identifier ?viewerPersonId .
      OPTIONAL { ?_user as:preferredUsername ?viewerUsernameRaw . }
      OPTIONAL { ?_user schema:name ?viewerNameRaw . }
      OPTIONAL { ?_user schema:image ?viewerImage . }
    }
  }
  BIND(IF(BOUND(?viewerPersonId), COALESCE(STR(?viewerUsernameRaw), ""),
       COALESCE(REPLACE(STR(?_user), "^.*/", ""), "")) AS ?viewerUsername)

  # Caller role — the nav-counts.sparql ladder VERBATIM (first-match). This is a
  # DISPLAY label and the contractor-verb input, NOT an authorization decision:
  # a primary role from a priority ladder is a different object from the SET of
  # teams a caller belongs to, and the two disagree for every persona in two or
  # more role teams (which, on this roster, is everyone). Nothing may gate on it
  # — that was the drift ISSUE-PAL-2 deleted. Grants gate; labels label.
  BIND(IF(EXISTS { GRAPH </graphs/org-chart> { ?_user gcs:memberOf </teams/one-admins> } }, "Admin",
       IF(EXISTS { GRAPH </graphs/org-chart> { ?_user gcs:memberOf </teams/one-managers> } }, "Manager",
       IF(EXISTS { GRAPH </graphs/org-chart> { ?_user gcs:memberOf </teams/one-recruiters> } }, "Recruiter",
       IF(EXISTS { GRAPH </graphs/org-chart> { ?_user gcs:memberOf </teams/one-employees> } }, "Employee", "")))) AS ?viewerRole)
  # Display-only role label (plan 37): contractors read "Contractor".
  BIND(IF(EXISTS { GRAPH </graphs/one-org> { ?_user one:workerType </worker-types/contractor> } }, "Contractor", ?viewerRole) AS ?viewerRoleLabel)

  # Viewer display name (one-org owns persona records; absent -> fall back to
  # the username client-side).
  OPTIONAL { GRAPH </graphs/one-people> { ?_user schema:name ?externalViewerNameRaw . } }
  BIND(STR(COALESCE(?viewerNameRaw, ?externalViewerNameRaw, ?viewerUsername)) AS ?viewerName)

  # workerType — the Time-page idiom verbatim: pointer in one-org, identifier
  # in the one-internal vocab. Absent -> employee default applies client-side.
  OPTIONAL {
    GRAPH </graphs/one-org> { ?_user one:workerType ?vwtIri . }
    GRAPH </graphs/one-internal> { ?vwtIri schema:identifier ?vwtIdRaw . }
  }
  BIND(STR(?vwtIdRaw) AS ?viewerWorkerType)

  # Force the three referenced graphs into the dataset (platform quirk, DEVLOG
  # #90 — the sidebar.sparql idiom). Three scalar rows (1x1 cross-join), no fan-out.
  { SELECT (COUNT(*) AS ?orgChartLoaded) WHERE { GRAPH </graphs/org-chart>    { ?ocS ?ocP ?ocO } } }
  { SELECT (COUNT(*) AS ?internalLoaded) WHERE { GRAPH </graphs/one-internal> { ?oiS ?oiP ?oiO } } }
  { SELECT (COUNT(*) AS ?oneOrgLoaded)   WHERE { GRAPH </graphs/one-org>      { ?ooS ?ooP ?ooO } } }
}

PREFIX as:      <https://www.w3.org/ns/activitystreams#>
PREFIX dcterms: <http://purl.org/dc/terms/>
PREFIX gcs:     <https://graphcentric.com/schema/>
PREFIX one:     <https://graphcentric.info/ns/one#>
PREFIX rdf:     <http://www.w3.org/1999/02/22-rdf-syntax-ns#>
PREFIX rdfs:    <http://www.w3.org/2000/01/rdf-schema#>
PREFIX schema:  <https://schema.org/>
PREFIX sh:      <http://www.w3.org/ns/shacl#>
PREFIX xsd:     <http://www.w3.org/2001/XMLSchema#>

<https://graphcentric.one/home.html>
        rdf:type    one:HomeState;
        one:viewer  <https://graphcentric.one/_anonymous> .

<https://graphcentric.one/_anonymous>
        one:userRole       "";
        one:userRoleLabel  "";
        one:username       "_anonymous";
        schema:name        "_anonymous" .