Agencies and contractors

The platform lead installs Occlude and turns on Observation Mode: a read-only GitHub app plus build and test telemetry. For a week it only watches.

The report says which files the build touched, which the tests ran, and which the last twelve dashboard tickets changed. One click turns that into a Frontend Contractor profile. Nobody writes a path rule.

1. An email invite and single sign-on. No install, no VPN, no clone. The browser workspace opens; their own VS Code over SSH is the next door.
2. The file tree holds the files the task needs. Not the whole repository with padlocks: the rest is not there.
3. They open Dashboard.tsx, which imports calculateInvoice from the billing module. Autocomplete works. Hover shows the signature. Go-to-definition opens a declaration that says the module is protected.
4. npm run dev boots the app with a live preview. The whole repository is on disk, on the build's side.
5. cat on the billing file answers No such file or directory, and the attempt goes on the record.
6. npm test runs the whole suite, including tests of code they cannot open. A failure inside billing shows as a protected module, next to the line in their own file that triggered it.
7. Submit for review opens a pull request on the real repository.

The grant expires and the workspace closes. The contractor's laptop never held the code, so there is nothing to recover, and nothing for a compromised package on their machine to leak.

One export per engagement: the profile the contractor worked under, every file they touched, every attempt that was refused, and the rule that refused it.