Skip to main content
When enabled, the shell issues a stralos-cohort=staff cookie after a successful sign-in when the authenticated user’s email domain is exactly stralos.co.nz. This cookie selects the staff composition variant at the next full document request. It is a routing signal only — the API enforces all authorisation decisions independently.
The staff cohort cookie writer is currently disabled (ENABLE_STAFF_COHORT = false in cohortCookie.ts). While disabled, no email address is treated as staff. Every session sync writes the clearing cookie, so any browser that still holds a stralos-cohort=staff cookie loses it on its next shell load. Re-enable the switch only once every environment the shell deploys to serves /index.staff.html and /remotes-manifest.staff.json.
The Domain attribute is derived from the environment segment that appears immediately before stralos.app: The cookie is set on successful session persistence. If the session write is silently dropped or refused by the browser’s storage layer, the cookie is not set — a session that was never durably stored cannot opt a device into the staff manifest. The cookie is cleared on every session teardown, including manual sign-out and expired-session redirects. The shell loads its remotes manifest from the URL written into the serving index.html. An all index points at /remotes-manifest.json; a staff index points at /remotes-manifest.staff.json. Manifests and cached compositions are bound to the URL that was present when the page loaded. A cookie that appears in another tab cannot switch an already-loaded index onto a different manifest. The cookie selects which index the CDN or origin serves on the next full document request. It does not bypass any API permission check.

​
Staff composition variant

The COHORT=staff activation path produces two artefacts that do not exist in the all path:
  • /index.staff.html — the serving document bound to /remotes-manifest.staff.json
  • /built-against.staff.json — the built-against sidecar for the staff variant
It never writes to /index.html. The all and staff activation workflows use separate concurrency groups so a pending all dispatch and a pending staff dispatch never share a slot. The staff manifest, index.staff.html, and the provides sidecar must be provisioned and validated in every target environment before re-enabling ENABLE_STAFF_COHORT. Activating the cookie writer before those assets are available can prevent staff sessions from loading. Keep those assets reachable while any cookie may reference them. Rolling back repoints them to known-good bytes rather than removing them.

​
Manifest fetch binding

The shell fetches the manifest by the explicit URL the loaded index.html is bound to. Credentials are omitted from that fetch. The localStorage cache is keyed by the binding URL; a cached composition with a different binding is refused as a fallback. This means a staff cookie that appears mid-session in another tab cannot silently switch the current page onto the staff manifest.

​
Security boundary

The stralos-cohort cookie is routing, never authorisation. The API must enforce access regardless of which composition a client loaded or what the cookie contains. Do not use the cookie as evidence of identity or as an access gate. Targets, project IDs, and personal API keys are operator configuration; they must not appear as frontend literals regardless of cohort.