Conversion prove-up — every system, live
The adoption review Mike ordered: each section below binds to the REAL surface or RPC it claims — the sign-in frames are the live page, the dictionary lookup hits the live table, the QR is minted by the live generator, and the sections that refuse anonymous readers say so out loud, which is the PII gate doing its job in front of you. Companion to Interface Standards.
Sign-in — desktop, mobile, and the gates behind it
Both frames are the LIVE page, not screenshots — what ships is what you see. Desktop fills the viewport with no page scroll; under 880px the brand pane collapses to a band.
| Gate | What enforces it | Where it is managed |
|---|---|---|
| Human check (turnstile) | Server-verified challenge on sign-in + public forms; a failed check refuses with words, never a silent drop | Auth Providers |
| Passkeys / Face ID | PureMFA WebAuthn; the fast block offers it only where the device supports it — the duplicate lower buttons return automatically where not | MFA Scoreboard |
| TOTP MFA | Dormant per org until mfa_required flips; then enroll/challenge appears in this same page with no redeploy | MFA Console |
| QR cross-device sign-in | qr_login_start / approve / deny — approve on the phone, the desktop session lands signed in | Mobile Auth |
| Session & rank | PureMFA.gate on success paths + min_rank on nav rows + hat checks in every function — UI hides, functions refuse | Security Levels |
Email standard — buttons, footer, and the branded QR that deep-links
PURE
Your documents are ready to sign.
The seller''s disclosure for 58 Riner Road is waiting. It takes about three minutes, and your agent is copied automatically when you finish.
Scan to open on your phone — the code carries the same tokenized link as the button.
PURE · a product of Acquisto Real Estate · Unsubscribe · Privacy
The rules. Navy header bar + 3px gold rule; Arial body (email-safe); ONE navy pill
button per message — a second action is a text link; footer always carries unsubscribe + privacy and the
sender identity. Marketing sends honor
pure_comm_prefs suppression before anything else.The QR is minted, never pasted.
mcp_email_qr_url returns a branded code
wrapping a short /r/ redirect — so the printed code NEVER goes stale: repoint the redirect
row and every code already in the wild follows. The lockstep guard (mcp_email_qr_lockstep) fails
any template whose button href and QR target disagree. The specimen QR here is minted live on page load.Templates are rows. … versioned templates in
pure_email_templates, edited in the Command Center · Machine, sent via the
two live paths (resend-email fn / email.send tool). Nothing is hand-assembled at send time.The dictionary — one table, every tooltip
336 terms in pure_dictionary drive tooltips, field help, and glossary pages.
Hover the dotted terms: DOM… ·
CDA… ·
Earnest Money…
— each definition arrives from mcp_dict_lookup when this page loads, not from markup.
| Connection | How it works |
|---|---|
| Fields | A field whose name matches a dictionary term gets the dotted cue and the tooltip automatically — the label is the lookup key, nothing is retyped per page. |
| Live database | mcp_dict_lookup(term) / mcp_dictionary_list(); aliases resolve via the canon map, lint (mcp_dict_lint) catches orphans and duplicates on a cron. |
| Calendars & documents | Deadline names in the calendar and clause names in doc checklists are dictionary terms, so the same definition follows the word everywhere it appears. |
| Naming standard | The glossary carries "Naming standard" so file-stamp tooltips explain themselves in-product. |
| Managed at | Dictionary (browse) · Dict Lint (health) · Data Dictionary (schema-level). |
Onboarding — the path from stranger to seated user
1Land & verify
Public onboarding page; turnstile-checked form; email confirm.
2Seat & org
Invite binds person → org → hat(s); mcp_user_onboard writes the seat.
3Sign-in & gate
Providers + passkey enroll; MFA if the org requires it.
4Guided steps
mcp_onboarding_step advances a checklist ROW per person — resume anywhere.
5First value
Lands on the hat''s home with live data already scoped to their org.
Why the refusal above is a feature: the step list is per-person PII, so the RPC refuses
anonymous readers — this page shows the refusal exactly as the States standard requires (announced, with the
reason) instead of rendering zeros it did not read. Signed-in staff see the live list at
Onboarding · managed in Data Onboard.
PII & per-hat field control
| Field | Client | Agent | Broker | MLS staff |
|---|---|---|---|---|
| Price & terms | Own deal | Own book | Org | Read |
| SSN / DL | Own | Masked | Masked | No |
| Commission split | No | Own | Org | No |
| Client phone | Own | Own book | Step-up | No |
Illustrative rows — the real matrix is data, one row per field per hat.
How it is enforced.
pure_field_policy holds one row per field per hat;
mcp_pii_mask applies it INSIDE the definer functions, so a page that forgets to check cannot leak
— the masked value is what leaves the database. Step-up-gated fields (vault refs, payoff figures) demand
a fresh MFA before the function returns them.Sharing PII deliberately is
mcp_share_pii_link: a tokenized, expiring,
audited link — the same spine as the client room. Outbound mail passes
pure_outbox_pii_guard so a template cannot accidentally interpolate a masked field.Managed at Field Admin (policy rows) ·
Access Control (hats & ranks) ·
Protection Audit (who read what).
Comms — the one spine, with samples
SMS sample.
PURE: Your showing at 58 Riner Rd is confirmed for Sat 2:00pm. Reply C to cancel. Txt STOP to opt out.
Sender identity first, one fact, one action, opt-out always. A2P-registered; suppression honored before send.
PURE: Your showing at 58 Riner Rd is confirmed for Sat 2:00pm. Reply C to cancel. Txt STOP to opt out.
Sender identity first, one fact, one action, opt-out always. A2P-registered; suppression honored before send.
Voice. Poppy answers with the desk''s persona and voice_tag; a caller''s access is the
PIN''s rank, not the phone number''s claim. Transcripts land in the same comms log as email and SMS.
One log, one policy. Every send — email, SMS, voice,
in-app — lands in
pure_comms_log with topic, kind and delivery state;
pure_comms_policy + pure_comm_prefs decide who may be contacted about what;
suppression and opt-outs are rows the send path MUST consult. The lockstep guard extends here: a template''s
links, its QR and its plain-text twin must agree.The management console — everything above, governed in one place
| System | Console | What a button press does |
|---|---|---|
| Pages & scores | Site Control | Enable/park a page, run the scorer, see worst-first, fix queues, lessons — the six-tab cockpit. |
| Navigation | Navigation Management | Drag a page into a menu; hats and min-rank per row; the shells re-render from the row. |
| Identity & access | Users & Hats · Access Control | Seat a person, grant a hat, set rank; acting sessions and step-up rules. |
| Brand & theme | Palette & Tokens · Brand Kit | Edit a token row; all 13 palettes and both shells repaint from it. |
| Comms | Command Center | Templates, sends, suppression, deliverability — the comms spine''s cockpit. |
| Fields & PII | Field Admin | Flip a field''s per-hat policy row; masking changes platform-wide, no deploy. |
| Dictionary | Dictionary | Edit a definition; every tooltip that cites the term updates. |
| Standards | Interface Standards · Brand Standards | The normative specimens this prove-up is measured against. |
The conversion rule. Everything already established converts WITH us: the registries
(pages, nav, themes, families), the guards (grant gate, lockstep, orphan sweep, leak guard), the instruments
(scores, crawler, watchers) and the lessons. A new surface is born inside this system — row-registered,
shell-mounted, RPC-bound, standards-scored — or it does not ship.