Trial state of 29 Oct 2026: ATOMA reader setup, app dashboards, embedding notes

Baseline before the clean-up (PD-13): the PD-11 reader setup and the PD-12 app
dashboards as they ran on the local stack, uncommitted until now. Not deployed,
not independently reviewed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

petrolyst-insights/roles/atoma_guest.py

@@ -0,0 +1,23 @@
+"""The role "ATOMA Guest": what the Petrolyst app's embedded dashboards may do (PD-12 trial).
+
+Superset gives every embedded viewer (a guest pass signed for one dashboard) the role named by
+GUEST_ROLE_NAME. That role gets the same permissions as "ATOMA Reader": reading a dashboard
+and its charts' data, nothing else. Which dashboard a guest sees comes from the pass, not from
+the role. Superset leaves the SQL out of chart-data responses for guests.
+
+Embedding is switched on in the local stack only (.local/fmdb-scratch, superset_config_local.py),
+so this script is not part of init.sh; run it by hand inside the Superset container:
+
+    docker exec <superset> /app/.venv/bin/python /app/petrolyst-roles/atoma_guest.py
+"""
+
+from __future__ import annotations
+
+import sys
+
+from atoma_reader import PERMISSIONS, sync
+
+ROLE = "ATOMA Guest"
+
+if __name__ == "__main__":
+    sys.exit(sync(ROLE, PERMISSIONS))