Al Otaiba Enterprises — project context
Two single-file HTML deliverables for **Al Otaiba Enterprises LLC** (AOE), an Abu Dhabi
holding company, plus a proxy that lets their live AI features run when hosted.
| File | What it is |
|---|---|
| `aoe-platform.html` | Public-facing cinematic platform. **This is the one shown to the client.** |
| `aoe-backoffice.html` | Role-based operations back office (15 views, 7 companies). |
| `server.js` | Node proxy + static host. Injects `window.AOE_AI_ENDPOINT`. |
| `worker.js` | Cloudflare Worker equivalent. |
| `test-backoffice.js` | 53 assertions. |
| `test-proxy.js` | 41 assertions, upstream stubbed. |
| `mutation-test.py` | Injects 11 known bugs; all must be caught. |
```bash
npm start # ANTHROPIC_API_KEY=<redacted> npm start
npm test # all three suites
```
---
⚠ Data integrity — read before changing any content
This project was corrected twice for stating things that were not true. Do not
reintroduce them.
**1. The Guinness World Record is NOT for accommodation size.**
It is for the **largest picture made of coffee cups**: 16,790 Arabic coffee cups,
one for every day of the UAE Union since 1971, forming a portrait of the late
Sheikh Zayed bin Sultan Al Nahyan. Assembled at Labotel on the 46th National Day,
breaking a Hong Kong record of 8,888 cups. The company also donated 4,600 blankets
to the Emirates Red Crescent. Coffee was chosen as the Arab symbol of generosity.
**2. Never name a real client, partner, or counterparty.**
Every client name in the back office is a generic label ("Energy Contractor B",
"Major Property Developer", "Global Airline — Preferred Partner"). Earlier versions
invented NPCC, Aldar, Etihad, Cleveland Clinic and others and attached them to a real
company. That is a reputational and legal liability. The airline that made Laundristic
a "Preferred Service Partner" is **not publicly named** — keep it unnamed.
**3. Only claim awards that are verified.**
Guinness 2018 (coffee cups) · Best Worker City 2nd place 2018 · 1st Tolerance Cricket
Cup (winners honoured by HH Sheikh Nahyan bin Mubarak Al Nahyan) · Arabia CSR 1st
runner-up 2023 (Small Business) · Global ESG Golden Winner 2024 & 2025 · Arabia CSR
Winner 2025. *Previously claimed and removed as unverifiable: "Emirates Labour Market
Award 2024" and "FM ME Best Facility Manager".*
**4. No overclaiming in the headline.**
The hero once read "Building the foundations the Emirates runs on." It now reads
"Industrial real estate, built around people," which tracks their actual stated
vision: *to be the market leader in industrial real estate projects in the UAE.*
**5. Operational figures are illustrative, and say so.**
Headcount, cash, occupancy, capacities, contract values and approval limits are
placeholders. The back office carries a persistent demo ribbon stating this. Verified
figures (from labotel.ae's own counters): 17,982+ beds, 10 blocks, 53 clients,
24 nationalities, 4-star ZonesCorp.
**6. Contact details, verified.**
Abu Dhabi · P.O. Box 6952 · +971 2 633 1333 · info@alotaiba.com · Labotel hotline
800 1 333. *A previous "824 Sultan Bin Zayed The First St" was fabricated — removed.*
---
The company
Founded 2000, 100% UAE-owned, 150+ years of Al Otaiba family enterprise in Abu Dhabi.
**Silver Jubilee 2025.**
- **Founder & Chairman** — Otaiba Bin Saeed Al Otaiba. Fifth-generation businessman;
former Chairman of Abu Dhabi Holding Company PJSC and of the Abu Dhabi Chamber's
Real Estate Committee. His late father, **Saeed bin Ahmed Al Otaiba** (former head of
the Abu Dhabi Chamber of Commerce), encouraged the founding.
- **CEO** — Jinendra Sancheti. Four decades across ~40 countries; ex-Unilever;
Chartered Accountant; Warwick Business School.
**Seven companies, one ecosystem centred on Labotel:**
1. **Labotel** — flagship workers' residential city, Al Mafraq Workers City 2
(F2C3-1 & F2C3-6). Amenities: clinic, self-cook kitchens, supermarket, gyms,
prayer halls, ATM. Six core services: 24/7 helpdesk, maintenance, laundry,
security, housekeeping, health & safety. GM Ahmed Abouelyazed.
2. **Laundristic** — industrial laundry. Two Carbonell tunnel washers, RFID,
50+ tons/day, 2–3 L water per kg. Preferred Service Partner of a global airline.
3. **CleanPro** — ISO-certified cleaning + Total Facilities Management (rope access,
disinfection, pool cleaning, pest control).
4. **BuildAlot** — industrial, commercial, residential and hospitality construction.
5. **Alessia Couture** — luxury garment care, Dubai & Abu Dhabi (ICAD Musaffah,
+9712 555 2088, WhatsApp pickup): bridal preservation, fine dry cleaning,
leather & suede, luxury shoes, kids garments.
6. **KitchenCo** — pioneering catering / central kitchens, no direct competitor in
Abu Dhabi. HACCP & ISO 22000.
7. **Gulf Vision** — one of the first subsidiaries. Outdoor mobile advertising trucks
(rotating, elevating, illuminated hoardings; glass showcase trucks).
Labotel houses the workforce → KitchenCo feeds them → Laundristic launders →
CleanPro maintains → BuildAlot builds the assets → Gulf Vision markets →
Alessia extends the standard to the luxury consumer.
---
Architecture
Both HTML files are **deliberately single-file**: no build step, portable, emailable,
openable from a USB stick in a boardroom. Do not split them into a bundler without a
reason that outweighs that.
**AI endpoint resolution** (identical in both files):
```js
const AI_ENDPOINT = (typeof window !== 'undefined' && window.AOE_AI_ENDPOINT)
|| 'https://api.anthropic.com/v1/messages';
```
- Hosted behind `server.js` → the server injects `window.AOE_AI_ENDPOINT="/api/chat"`.
- Inside claude.ai → falls through to the direct call, which is proxied for us.
- Neither available → both files fall back to a **built-in offline knowledge base**
and label the answer as such. The demo must never fail in front of a client.
`server.js` is **not an open relay**: origin allow-list, model allow-list, per-IP token
bucket, 128 KB body cap, `max_tokens` clamp, upstream timeout, sanitised errors, and
`sk-ant-…` redaction in logs. The request is rebuilt from scratch, so `tools`,
`mcp_servers`, `stream` and `metadata` can never be injected by a client.
Back office governance model
Authority is enforced in `decide()` — **never rely on a disabled button**. An earlier
version could be bypassed from the console. `authorise(approval)` is the single source
of truth and returns `{ok, code, msg}`:
- `type` — role may not act on this request type (`PERM`)
- `sod` — segregation of duties: cannot approve a request your own function raised
- `limit` — exceeds the role's AED ceiling (`LIMITS`)
- `dup` — you already approved; a second, distinct approver is required
Values ≥ `DUAL_THRESHOLD` need two approvers. Returning a request **requires a written
reason**. Denied attempts are written to the audit trail. The audit trail and the
governance panel are gated to `chair` / `ceo` (+ `legal` for audit).
**These thresholds are invented.** They are editable in-app under
*Governance → Delegation of Authority*, which carries a standing warning and a
"source of truth" field. Replace them with AOE's approved matrix before this governs
a single real decision.
---
Testing
```bash
node test-backoffice.js # governance, persistence, access control, data integrity
node test-proxy.js # proxy hardening; upstream stubbed, no network
python3 mutation-test.py # breaks each control, asserts the suite notices
```
**`mutation-test.py` is the one that matters.** A suite that always passes proves
nothing. It has already caught two blind spots in the tests themselves:
- the escalation assertion passed for the wrong reason (dual approval masked a missing
authority check), and
- the mandatory-reason control was never exercised because the test always supplied a
reason.
**A "reload" in tests must be a fresh execution context sharing only `sessionStorage`.**
Mutating globals and calling `loadSession()` in the same context produced false
failures — `resetGovernance()` legitimately persists and clobbered the snapshot.
Twice now, a bad test nearly sent us to "fix" working code. Verify the test before
changing the source.
---
Open items
- [ ] Confirm the block register — the occupancy board models **10 residential blocks**;
public sources also describe **8 residential + 2 central commercial buildings**.
Flagged in the Labotel view.
- [ ] Replace the delegation-of-authority matrix with AOE's approved figures.
- [ ] Imagery is **hotlinked from labotel.ae** for presentation. Get written permission
or self-host before publishing.
- [ ] Replace illustrative operational data with real figures, if AOE provides them.
- [ ] Optional: real drag-and-drop on the Labotel helpdesk kanban; saved views/filters.
Style
Direct, high standard. Each iteration should be a meaningful leap, not a tweak.
Deep research before building — no generic placeholders where a real fact exists.
Bilingual EN/AR with proper RTL throughout; every string goes through `L(en, ar)`.
Platform palette: architectural night-navy, limestone, Abu Dhabi amber, Marcellus +
Space Mono. Back office: distinct green-tinted system palette.