> ## Documentation Index
> Fetch the complete documentation index at: https://help.stralos.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Staff cohort

> Staff cohort cookie and composition variant in the Stralos shell

When enabled, the shell issues a `stralos-cohort=staff` cookie after a successful sign-in when the authenticated user's email domain is exactly `stralos.co.nz`. This cookie selects the staff composition variant at the next full document request. It is a routing signal only — the API enforces all authorisation decisions independently.

> [!WARNING]
>
> The staff cohort cookie writer is currently **disabled** (`ENABLE_STAFF_COHORT = false` in `cohortCookie.ts`). While disabled, no email address is treated as staff. Every session sync writes the clearing cookie, so any browser that still holds a `stralos-cohort=staff` cookie loses it on its next shell load. Re-enable the switch only once every environment the shell deploys to serves `/index.staff.html` and `/remotes-manifest.staff.json`.

## Cookie shape

```
stralos-cohort=staff; Path=/; SameSite=Lax; Secure; Max-Age=2592000
```

The `Domain` attribute is derived from the environment segment that appears immediately before `stralos.app`:

| Hostname | Domain attribute |
| - | - |
| `au-nz.dev.stralos.app` | `.dev.stralos.app` |
| `au-nz.test.stralos.app` | `.test.stralos.app` |
| Production apex, `localhost`, unrelated hosts | No `Domain` attribute (host-only cookie) |

The cookie is set on successful session persistence. If the session write is silently dropped or refused by the browser's storage layer, the cookie is not set — a session that was never durably stored cannot opt a device into the staff manifest. The cookie is cleared on every session teardown, including manual sign-out and expired-session redirects.

## Why the cookie exists

The shell loads its remotes manifest from the URL written into the serving `index.html`. An `all` index points at `/remotes-manifest.json`; a `staff` index points at `/remotes-manifest.staff.json`. Manifests and cached compositions are bound to the URL that was present when the page loaded. A cookie that appears in another tab cannot switch an already-loaded index onto a different manifest.

The cookie selects which index the CDN or origin serves on the next full document request. It does not bypass any API permission check.

## Staff composition variant

The `COHORT=staff` activation path produces two artefacts that do not exist in the `all` path:

* `/index.staff.html` — the serving document bound to `/remotes-manifest.staff.json`
* `/built-against.staff.json` — the built-against sidecar for the staff variant

It never writes to `/index.html`. The `all` and `staff` activation workflows use separate concurrency groups so a pending `all` dispatch and a pending `staff` dispatch never share a slot.

The staff manifest, `index.staff.html`, and the provides sidecar must be provisioned and validated in every target environment before re-enabling `ENABLE_STAFF_COHORT`. Activating the cookie writer before those assets are available can prevent staff sessions from loading. Keep those assets reachable while any cookie may reference them. Rolling back repoints them to known-good bytes rather than removing them.

## Manifest fetch binding

The shell fetches the manifest by the explicit URL the loaded `index.html` is bound to. Credentials are omitted from that fetch. The `localStorage` cache is keyed by the binding URL; a cached composition with a different binding is refused as a fallback. This means a staff cookie that appears mid-session in another tab cannot silently switch the current page onto the staff manifest.

## Security boundary

The `stralos-cohort` cookie is routing, never authorisation. The API must enforce access regardless of which composition a client loaded or what the cookie contains. Do not use the cookie as evidence of identity or as an access gate.

Targets, project IDs, and personal API keys are operator configuration; they must not appear as frontend literals regardless of cohort.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.