Hosted papercuts: policy publish validator scans comments/strings; fresh-org eval-authoring dead end and empty /plan #851

Description

Two rough edges on the hosted side (app.befailproof.ai + fp CLI), hit during the Jev Buildathon today. Filing together since both are cloud-surface papercuts rather than CLI bugs; happy to split if you'd rather track them apart.

1. The policy publish validator scans comments and strings, so documenting a limitation gets your pack refused

fp policies publish refused a pack whose source mentioned semanticPolicies in a comment:

this policy source mentions Jev-only names a cloud policy never reads: semanticPolicies (line 11).
A cloud-managed policy is always hard (authority, reviewedBy and userCanOverride are ignored) and
its semanticPolicies are never loaded, so it would publish as Jev-aware and enforce as hard. This
check is a whole-word scan of the entire source, comments and strings included, so a comment,
string or variable that only uses one of these words is refused too: rename or remove.

The rule itself is right - silently enforcing as hard when the source looks Jev-aware would be worse. But a whole-word scan over comments and strings means the natural response to learning the rule (writing it down in the file) is the one thing the file can't contain. Stripping comments/strings before the scan, or running the check on the parsed AST, keeps the protection without the trap.

2. Fresh org: eval-authoring dead-ends on a permission, and /plan renders empty

On a freshly created org:

• Admin → eval authoring shows only "The evaluations:trigger permission is required to view or manage hosted code." - no pointer to where the permission comes from (plan, role, key).
• Admin → plan renders its heading and "// what this workspace is entitled to, and until when" and then nothing - an empty entitlement list, which reads exactly like a page that failed to load.

The way through turned out to be claiming the Team offer, but nothing on either screen points there. A "this needs plan X - see /plan" link on the first, and an explicit "no paid entitlements" line (or the claim CTA) on the second, would close both.

Steps to Reproduce

1. Validator: write a cloud policy whose source contains the word semanticPolicies only in a comment; fp policies publish <name> <file> - refused as above.
2. Fresh org: create a new cloud org, open Admin → eval authoring and Admin → plan.

Expected Behavior

1. Comments and strings shouldn't trip the Jev-only check (or the error should say where such notes may live).
2. The permission wall should name the path to the permission; the plan page should render something when the list is empty.

Version

CLI 1.0.8-beta.0; cloud as of 2026-09-27. Node 22, Linux.