Your deliverables, handed over properly.

HOPE Drive is the delivery surface of the LIGHT HOPE ecosystem: the curated files your engagement produced — organized by business module, searchable in Chinese and English, previewable in the browser — reachable with nothing but your email address. No account to create, no app to install, no password to forget.

Request early access Read the security model

How it works

Three steps between your inbox and your files.

There is exactly one source of truth — the LIGHT HOPE working archive. What you see is a curated, one-way snapshot of it. Nothing syncs back; nothing can conflict.

We curate

Your delivery set is hand-curated from the engagement archive: finished deliverables in, working drafts and process debris out. Each file keeps its business module and its original name — the drive mirrors how the work was actually organized.

You verify your email

Open your drive link and enter the one-time code sent to your registered address — that is the whole login. Authentication is handled by Cloudflare Access; HOPE Drive never stores a password because it never asks for one.

You take your files

Browse by module, search in either language, preview PDFs and images inline, and download what you need. Every download link is signed and expires within 5 minutes — a link that leaks is a link that is already dead.

What's inside

Built for the moment a client actually needs a file.

Bilingual search that understands your filenames

Search matches Chinese and English synonyms and falls back gracefully on CJK text, so “合同” finds the contract whether the file was named in either language.

Inline preview, zero installs

PDFs and images open right in the browser before you commit to a download. The whole product is a web page — nothing to install, on desktop or phone.

Organized the way the work was

Files are grouped by business module — governance, finance, contracts, and so on — not dumped in one flat folder. Recent and pinned items stay one keystroke away.

Keyboard-first, if you want it

The entire drive is operable from the keyboard — search, navigate, preview, download — and meets the contrast and focus standards screen readers expect.

Security model

Six invariants, enforced on the server — with their proof status published.

HOPE Drive's security is not a promise paragraph; it is a set of named invariants, each with an automated acceptance gate. In the spirit of the LIGHT HOPE rule — no claim without a receipt — we publish which are proven and which are still open, and we do not round up.

Invariant	What it guarantees	Proof status
INV-1	Tenant identity and role come only from a server-side database lookup — never from anything the browser sends. Escape attempts get a hard 403.	Proven in local gates
INV-2	No home-built identity. Login is Cloudflare Access email verification; there are no passwords anywhere in the system to steal.	Holds by design
INV-3	The audit log is append-only. Database triggers abort any UPDATE or DELETE against it — tested, not assumed.	Proven in local gates
INV-4	Fail closed. Missing, forged, expired, or mis-scoped credentials — and even an unreachable key server — all deny access rather than degrade it.	Proven in local gates
INV-5	The vault — material marked never-to-leave the internal network — must never reach the delivery cloud, under any role.	Open — not yet proven end-to-end
INV-6	Client and engineer views are computed on the server. The client response simply does not contain what clients may not see.	Proven in local gates

What “proven in local gates” means: the guarantee passed its automated acceptance tests in the local development stack, including adversarial variants (forged tokens, cross-tenant keys, path escapes). It does not yet mean production-verified — that distinction is exactly why this table exists.

Two views, one truth

Clients see a whitelist. Engineers see everything — and the audit trail.

Client view

role = client

Only whitelisted deliverables, grouped by module
Preview, download, and bundle capabilities
No storage internals — sizes and upload times aren't sent
Vault content: never, unconditionally

Engineer view

role = engineer

Full listing of the tenant's delivery space
File sizes, upload times, version context
Per-tenant append-only audit log
Vault content: never, unconditionally

The frontend contains no if (role === …). It renders whatever capabilities the server grants — so “hiding” something from a client isn't a UI trick that can be undone in devtools. The data a client may not see is never sent to their browser at all.

Who it's for

Made for engagements that end in a pile of important files.

Clients of LIGHT HOPE

Businesses receiving governance, compliance, financial, or technical deliverables. You get a single, permanent, organized place to retrieve everything — not a trail of email attachments.

Their advisors

Access is granted per email address your organization authorizes, so a lawyer or accountant on your side sees exactly the same whitelisted set you do — and, by design, every retrieval lands in the audit log.

LIGHT HOPE engineers

The people accountable for delivery see the full picture: what's in the tenant space, what's been retrieved, and what the audit trail says — per tenant, never across tenants.

Honest status

Where the product actually is today.

This page describes the product as built and tested, not as imagined. As of August 2026:

Claim	Status
End-to-end retrieval flow (login → list → signed download) works	Yes — in the local stack
First tenant's delivery set curated and pushed to cloud storage	Yes — 185 files, 7 modules
Production deployment at drive.x1000.ai	Not yet
Cross-tenant isolation verified between two live tenants	Not yet
Real customers served	Zero, so far — and we'll say so until it's one

The project's north-star metric is deliberately narrow: the first real client who retrieves a real file through their browser. Not features shipped, not tests passed. Until that number is 1, this page will keep saying it is 0.

Access

Early access is by invitation.

HOPE Drive is in private development and onboarding is not yet open. If you are a LIGHT HOPE client and want your deliverables on the drive when it goes live, tell your engagement contact — tenant setup is part of the delivery service, not a separate signup.

Pricing: Not published. Delivery-drive access is scoped per engagement — ask your LIGHT HOPE contact. No self-serve tier exists yet.
Requirements: A modern browser and the email address on file for your engagement. Nothing else.
Your data: Formal terms of service and a data-processing statement are prerequisites we've set for ourselves before any external onboarding.