Trial state of 29 Oct 2026: ATOMA reader setup, app dashboards, embedding notes

Baseline before the clean-up (PD-13): the PD-11 reader setup and the PD-12 app
dashboards as they ran on the local stack, uncommitted until now. Not deployed,
not independently reviewed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -93,7 +93,8 @@ deploy secrets.
    and "Skip" if a resource exists. This creates:
    - the confidential client `petrolyst`: standard flow only, PKCE S256, redirect URIs for both
      hosts;
-   - its client roles `superset-admin`, `superset-editor`, `superset-viewer` and `traefik-admin`;
+   - its client roles `superset-admin`, `superset-editor`, `superset-viewer`, `atoma-reader`
+     and `traefik-admin`;
    - a mapper that puts those roles into the claim `petrolyst_roles`.
 2. Clients → petrolyst → Credentials: copy the client secret (step 3 stores it on the server).
 3. **MFA**, which Exhibit B requires. A copy of the built-in `browser` flow is not enough, for two
@@ -109,7 +110,11 @@ deploy secrets.
    enrols first. Other clients of the realm are unaffected. There is no silent SSO between
    Superset and the dashboard.
 4. Give people roles: Users → (user) → Role mapping → Assign role → filter by clients →
-   `petrolyst`. Group mappings work too.
+   `petrolyst`. Group mappings work too. ATOMA's users get `atoma-reader` and nothing else.
+   They then see only the ATOMA dashboard: no menus, nothing to edit, and Settings offers only
+   Logout (Superset role "ATOMA Reader", `petrolyst-insights/roles/atoma_reader.py`).
+   A realm that already has the client gets the new role by hand (Clients → petrolyst →
+   Roles → Create role) or by importing again with "Skip".
 5. Users of the Traefik dashboard need **Email verified** switched on, because oauth2-proxy
    refuses unverified addresses.
 
@@ -160,6 +165,7 @@ becomes the first Superset admin; there is no local admin account.
 | fuel-db from the Mac | `ssh -L 5433:127.0.0.1:5433 petrolyst`, then connect to `localhost:5433`, database `fuel` |
 | Logs | `docker compose -p fuel-monitoring logs -f superset` (or `-p traefik`) |
 | Superset break-glass | `docker exec -it fuel-monitoring-superset-1 superset fab ...` |
+| Reset the role "ATOMA Reader" (after an edit in the UI) | `docker exec fuel-monitoring-superset-1 /app/.venv/bin/python /app/petrolyst-roles/atoma_reader.py`; a deploy does it whenever the Superset image changes |
 
 **Manual deploy**, the only way to deploy (there is no CI runner). On the Mac, in this
 repository: