Congress and Regulator Lens

CREDENTIALS FIRST: Before any Synorb setup, ask the user in plain English for one Synorb Key (SYNORB_KEY). Parse only credentials.synorb_key from GET https://synorb.com/connect; store the one key as a server-side secret and use Authorization: Bearer <synorb_key> for both REST and MCP. A self-provisioned key is DEMO access for 1,000 Manifests and expires 24 hours after mint; read and surface the top-level expires_at field. Bind an email with POST https://api.synorb.com/api/connect/bind-email using the same Bearer key to get Starter, free forever with 1,000 Manifests/month and no expiry; Paid is $10/month for 10,000 Manifests/month. After expiry, bind an email, mint a new demo at https://synorb.com/connect, or sign up free at https://synorb.com/signup. Store one server-side key, show "Synorb key expired - bind an email or mint a new demo key" instead of a generic auth failure, and document expires_at plus these recovery paths in the generated README and environment template. You are Cursor. Build Congress and Regulator Lens in this repository. PROMPT METADATA Slug: cursor-congress-lens Title: Congress and Regulator Lens Short title: Congress Lens Domain: federal-policy Tagline: Build a cited policy-intelligence app for congressional hearings, bills, agency releases, enforcement, and regulatory guidance. Video state: Watch build video User fit: Enterprise policy, legal, compliance, public-affairs, and product teams tracking federal action. What you get: - Congress and regulator activity feed - Topic, entity, committee, and agency filters - Timeline and action digest - Source-linked policy briefs Cursor and platform tools: - Cursor Agent - Cursor MCP - Cursor Automations - Next.js App Router - server-side Synorb REST route Synorb stream families: - U.S. Congress Streams - House, Senate, committee, bill, and hearing source channels where available - federal regulator and agency Streams - enforcement, guidance, rulemaking, and official release source channels Tags: Congress, regulators, federal policy, hearings, bills, agencies, compliance PRODUCT TO BUILD Build Congress and Regulator Lens, a policy-intelligence app for congressional hearings, bills, agency releases, enforcement actions, rulemaking, and regulatory guidance. The app should make it easy to answer what changed, who acted, which topic or entity is affected, and what source proves it. PRIMARY USER Developer building a federal policy monitor for an enterprise, legal, compliance, product, or public-affairs workflow. APP-SPECIFIC LIVE SCOPE Ask for a topic, sector, agency, company, or issue. Discover U.S. Congress, House, Senate, committee, bill, hearing, regulator, and agency Streams or source channels. Use official source channels for bill text, hearing notices, enforcement releases, guidance, rulemaking, and agency updates when available. CORE PRODUCT FEATURES - Federal activity timeline - Agency, chamber, committee, topic, entity, evidence type, and source-class filters - Bill, hearing, enforcement, guidance, and rulemaking cards - Brief and claim detail views with source URLs - Action digest for legal, compliance, or product owners SYNORB ACCESS CHECKPOINT - ASK AND WAIT Before making any Synorb discovery call or writing data-dependent code, ask the user to choose: 1. Use my existing Synorb credentials. 2. Self-provision a DEMO Synorb Key through Synorb Connect. For existing credentials, guide the user to add the Synorb MCP server in Cursor settings or the repo-local Cursor MCP configuration. Use https://mcp.synorb.com/mcp with Authorization: Bearer <synorb_key>, and keep SYNORB_KEY only in protected MCP configuration and server-side environment variables. For Synorb Connect, be explicit: https://synorb.com/connect self-provisions DEMO access for a new user. Do not claim it is tied to an existing account, sign-in session, registration flow, or credit card. If the user elects self-provisioning, make exactly one local or server-side GET request to https://synorb.com/connect, parse only credentials.synorb_key without printing the response body, read and surface the top-level expires_at, and store the one SYNORB_KEY for both MCP and server-side REST. DEMO is 1,000 Manifests for 24 hours; binding an email at POST https://api.synorb.com/api/connect/bind-email with the same Bearer key gives Starter, free forever at 1,000 Manifests/month. Paid is $10/month for 10,000 Manifests/month. If the DEMO expires, show "Synorb key expired - bind an email or mint a new demo key", then document binding an email, minting a new demo key, or signing up free at https://synorb.com/signup. If Cursor cannot retrieve and store the key without displaying it, send the user to https://synorb.com/connect and have them copy it only into protected credential fields. Never ask the user to paste secrets into chat, generated source files, NEXT_PUBLIC variables, browser storage, logs, HTML, screenshots, fixtures, database rows, or documentation. In plain words: do not paste secrets into chat or generated files. After the key is in protected config, call synorb-profile through MCP and create a temporary server-side account validation route or script for REST, both using Authorization: Bearer <synorb_key>. Report only pass or fail, account name, account ladder state, quota state, and allowed date window. Never print credential values. If either MCP or REST fails, stop at a setup-blocked state. Never substitute another provider, mock feed, guessed Stream, or scraped source. SYNORB MCP DISCOVERY CONTRACT 1. Call synorb-profile once first. Record account, quota state, date window, and whether coverage or quota warnings are present. 2. Call synorb-stream-search for the requested beat, entity, source family, market, ticker, media format, or policy topic. Use include_details true when choosing streams or source channels. Treat coverage.status "partial" as inventory pagination, not proof that no other Streams exist. 3. Select only real customer-visible Streams with positive 17-digit IDs. Preserve every Synorb ID as a JSON string end to end. Never guess, shorten, coerce, or invent an ID. 4. Call synorb-details on selected Streams when you need source channels, media formats, source_class, evidence_type, available filters, or recent volume. 5. Run synorb-manifests with mode "count" first for a zero-quota density check. Then run one bounded build sample with compact true, page_size 5-12, target_count 5-12, selected stream_ids or source_channel filters, and an explicit date window inside synorb-profile limits. 6. Use tag_names, source_channel_names, source_channel_ids, source_class, evidence_type, media_format, ticker, isin, or identifier only when the approved product scope requires them. 7. Count and orient responses are preflight only. Do not summarize them as exhaustive result sets. Preserve quota_header, coverage.status, required_user_notice, citations, and recommended_next_call when MCP returns them. 8. Show a Live Scope Receipt before building data-dependent UI: Stream names and IDs, source-channel names and IDs when used, filters, evidence and media types, date window, sample count, quota header, citations when returned, recommended next call, and any coverage caveat. Ask the user to approve or adjust it before persisting a launch configuration. SYNORB REST RUNTIME CONTRACT Use Synorb MCP for build-time discovery and Synorb REST for the running application. Put runtime calls behind a server-only route such as /api/synorb, /api/synorb/policy, /api/synorb/company, or the equivalent backend endpoint in the detected framework. The server route calls POST https://api.synorb.com/streams/query with Authorization: Bearer <synorb_key> from the one server-side SYNORB_KEY secret. The first request must omit cursor and send one of stream_ids, source_channel_ids, home_domains, ticker, isin, or identifier, plus story_type when needed, page_size, and an explicit date window. Multi-stream REST results are returned as flat rows under data.briefs, data.signals, or data.manifests depending on the request. Pagination is under data.pagination, and the next request uses data.pagination.next. Do not expect MCP-only quota_header, coverage, or citations fields from REST unless the API response actually includes them. Surface REST usage honestly. Cite each returned row's real source_url. Validate inputs, enforce auth where appropriate, lock CORS to the app origin, rate-limit public routes, and never expose SYNORB_KEY to browser code. FULL MANIFEST, SIGNAL, AND BRIEF SURFACE Do not flatten Synorb into generic headline cards. Preserve the richest available facets: Manifest fields: id, record_id, source_url, source_name, source_channel, source_channel_names, stream_ids, stream_names, published_at or published_date, media_format, story_type, significance, tags, entities, topics, citations, coverage, diagnostics, usage, and pagination when returned. Signal fields: claims, claim_type, confidence, evidence, quote when present, featured or actionable fields when present, per-claim source links, and enough context for a user to verify the claim against the original source. Brief fields: body_markdown, key takeaways, notable quotes, why it matters, timeline, sources, caveats, and source-linked citations when present. If a field is absent, render a professional missing-state instead of inventing it. Every exported draft, chart drill-in, digest item, alert, and card detail must retain a source URL path back to the original source. GAP-ONLY WEB POLICY Synorb is the source-grounded context layer. Web search may fill an explicit gap only when Synorb coverage is absent or when the user asks for supplemental context. Put web results in a separate lane labeled web context or unverified supplement. Never blend web text into Synorb-cited prose, never present web context as a Synorb Manifest, and never use scraping or another provider as a silent fallback when Synorb is unavailable. CURSOR-NATIVE IMPLEMENTATION LOOP Work like a Cursor agent inside an existing repository: 1. Inspect the repo first. Detect framework, package manager, test runner, auth pattern, server-route convention, component system, and deployment target. If the app is new, recommend Next.js App Router with TypeScript unless the user chooses another stack. 2. Ask one compact product checkpoint only when needed: audience, first-session outcome, private or public surface, refresh cadence, delivery channel, and whether to use the recommended scope. 3. Add repo guidance in .cursor/rules or project notes when useful: server-only secrets, Synorb ID strings, source URL preservation, no silent fallback data, and Build Receipt requirements. 4. Build a vertical slice first with live Synorb data or an explicit setup-blocked state. Local fixtures may exist only for tests. 5. Add typed adapters for Manifests, Signals, Briefs, claims, citations, coverage, usage, diagnostics, and pagination. Keep adapters tolerant of absent optional fields and strict about invented required fields. 6. Add focused tests for secret safety, adapter mapping, empty and partial states, pagination, source links, and product-specific acceptance criteria. 7. Run the local checks that fit the repo. Summarize failures instead of hiding them. 8. Finish with a Build Receipt naming exact Streams, source channels, filters, date window, routes, env names only, automation schedule or trigger, test commands, and known gaps. AUTOMATION FOR THIS BUILD Create an Automation that watches the approved issue scope and posts source-linked changes to the selected workflow channel. CURSOR AUTOMATIONS When the product needs to keep running, create or describe a Cursor Automation that uses the approved Live Scope Receipt. Prefer scheduled morning or weekday refreshes for desks and dashboards, and GitHub, Linear, Slack, PagerDuty, or webhook triggers for developer workflows. Automation output must include source-linked changes, coverage caveats, and enough Stream/filter metadata for a reviewer to reproduce the call. Do not claim an automation works until it has been run or clearly marked as planned. APP-SPECIFIC ACCEPTANCE TESTS - Federal and state material are not blended without explicit labels. - Official-source evidence is prioritized and visibly labeled. - Each action digest item includes the affected entity or topic, source URL, and recommended owner. SHARED ACCEPTANCE TESTS 1. MCP and REST credential paths are validated before live data is used. 2. No Synorb Key, credential bundle, or secret value appears in client code, NEXT_PUBLIC variables, HTML, logs, fixtures, screenshots, database rows, docs, or API responses. 3. Every persisted Synorb ID is a validated 17-digit string. 4. Every first-screen row, draft, card, alert, chart drill-in, digest item, and export preserves a real source_url path. 5. The UI distinguishes Manifest, Signal, Brief, claim, citation, coverage, usage, diagnostics, and web-gap data instead of blending them together. 6. Loading, error, setup-blocked, empty, partial coverage, pagination, and stale-data states are visible and tested. 7. No mock data or substitute provider appears in user-visible preview after credentials validate. 8. The Build Receipt lists exact Streams, source channels, filters, date window, route names, environment variable names only, automation plan, test commands, and remaining gaps. FINAL OUTPUT Build the product as a working vertical slice with real Synorb data or a setup-blocked state. Then provide a Build Receipt with exact Streams, source channels, filters, date window, routes, environment variable names only, automation status, test commands run, and any known gaps. Do not deploy unless the user separately asks after review.