Persona 02 — Program Owner

Confidence markers and citation shorthand per README.md.

Who they are

The organisation that runs a fibre programme commercially: sets it up with FT Admin, supplies its credentials (certificates, documents, claim wording) and watches uptake across participants. Malcolm’s example is “Danny at FibreTrace” — an internal programme office — and the demo seed persona is “ACME Program Office”. STATED (BL:2026-07-08-malcolm-walkthrough-demo.md:88; L:src/components/DemoNavBar.tsx:15-28). In the real world this is a programme operator such as a fibre initiative or FibreTrace itself acting on behalf of one.

Being Program Owner is a company-level fact, not a user role: a program_owners(programme_id, company_id) join row (max one owner company per programme, enforced by delete-then-insert in admin) plus a per-company company_modules row program_owner that separately controls owner nav visibility. VERIFIED (L:src/hooks/useProgramOwner.ts:20; L:src/pages/admin/AdminProgrammes.tsx:262-272; L:src/pages/admin/AdminCompanies.tsx:97,254). There is no self-service path to become an owner — no signup option exists for it. VERIFIED (L:src/lib/signup.ts:5-19 has no owner option).

A good day: uptake volumes reconcile with reservations and claims, no participant is over-committed, programme credentials are current (nothing expired), and the wording participants see on their evidence packs is exactly what the owner published.

How the app decides they are an owner

On login, Home checks program_owners for the user’s company and redirects to /owner before any other persona resolution. VERIFIED (L:src/pages/Home.tsx:136-151). The owner nav group (Program record, Program uptake, Documents, Certificates) renders only when programOwnerEnabled from company modules is on. VERIFIED (AppSidebar owner group gating, agent-verified at origin/main). Note the rPET demo persona is a hybrid: producer-style sidebar but Home resolves to /owner — flagged in the July walkthrough as a question for Malcolm. VERIFIED observation (BL:gui-walkthrough README case 9; BL:ux-findings-for-malcolm.md).

Every screen they touch

Known live bug: OwnerDashboard links to /owner/programme-uptake while the route is /owner/program-uptake — a 404 confirmed in the July GUI walkthrough. VERIFIED (L:src/pages/OwnerDashboard.tsx:254 vs App route; BL:persona-case-matrix.md Part C item 3). Re-verify at HEAD before filing — the Aug HIG rewrites may have fixed it. UNKNOWN current status.

CRUD abilities and gates

Create: programme certificates, programme documents, program-record items (wording). Read: uptake, programme record, dashboards. Update: own uploads, item visibility/order. Delete: own uploads. VERIFIED (owner pages at origin/main). They cannot: create programmes, register producers/participants, grant reservations, or approve claims — all FT Admin or participant actions. Programme detail editing is deliberately split: owners manage credentials/wording, admin manages the programme record itself (the July “CRUD bug” was reclassified as this deliberate permission split). STATED (BL:2026-07-16-code-resolved-open-questions.md:68).

Business rules binding to them

• One owner company per programme. VERIFIED (AdminProgrammes.tsx:262-272 delete-then-insert).
• Owner KPIs are denominated in CU (1000 CU = 1 MT). VERIFIED (claimUnits.ts; OwnerDashboard CU labels per port-plan unit 13).
• Owner-uploaded certificates/documents surface in participant verification records (QC O-02 expected result). STATED (QC:111) — the assignment tables exist VERIFIED but the end-to-end render into evidence packs is not independently confirmed at HEAD. INFERRED from pack sections referencing programme scope/methods.
• Demand-vs-supply signal compares nomination demand (sum of open PO line quantities) against programme supply capacity. VERIFIED (port-plan.md unit 13 beSpecForGap; OwnerDashboard reads purchase_orders/purchase_order_lines).

Dependencies

Upstream: FT Admin must create the programme, register the owner company, toggle the program_owner module and invite the owner user (QC A-09). Downstream: producers’ production and participants’ claims are what uptake reports on; participants see the owner’s wording and certificates on their evidence. The owner blocks participants only in the soft sense that missing wording/credentials makes evidence packs thinner.

First-login / empty state

An owner with a fresh programme sees the same “next-actions inbox” all-clear card pattern as other personas: “You’re all caught up… View programmes”. VERIFIED (L:src/pages/OwnerDashboard.tsx:276-286).

Likely failure modes and confusions

• The programme-uptake 404 link (above). VERIFIED as of July.
• Expecting to edit programme fields (dates, ceilings) — that is admin-only by design. STATED (BL:resolved:68).
• Expecting uptake to reconcile to the CU while the underlying nomination tables are the newest, least-stable domain (the whole PO domain is mid-rewrite; .legacy.tsx snapshots exist). INFERRED from sync-20260819 RUN-SUMMARY caution 3.
• Owner visibility depends on TWO switches (join row AND module toggle); enabling only one produces a half-state (redirect without nav, or nav without data). INFERRED from the two independent gates; exact half-state behaviour UNKNOWN.

Implementation state

Lovable: fully working (all five owner pages, Aug HIG restyle applied; the owner-dashboard/uptake unit resolved GAP in the Aug-19 API pass — its nomination-demand data has no real backend). VERIFIED (port-plan.md unit 13). Monet: /owner is NOT routed at all (OwnerDashboard imported but never given a Route — dead code); the four sub-pages are routed but are empty shells over no-op stubs (program_certificates, program_documents, program_record_items all stubbed). VERIFIED (M:src/App.tsx:73,151-154; .local/qc-test-script/analysis.md route matrix). Real backend: GET /fibre-programs/{id} returns certificates[] and documents[] arrays read-only; no owner write surface exists. VERIFIED (.local/backend-specs/fibre-program/README.md:22).