git:20260908.e4ef04c to git:20260909.ad3b376

7 added, 2 removed. Audit A to A.

# Contents

- `src/` contains the static `atet.sh` homepage and documentation, inert `/preview` composition, visual system, appearance control, crawler files, favicons, social preview, and machine-readable page bodies.

- `src/negotiate.ts`, `src/negotiate-request.ts`, and `middleware.ts` select HTML or markdown from `Accept` for document routes.

- `scripts/build.ts` renders fingerprinted local assets into `dist/` from an explicit allowlist and bundles the pinned PostHog browser client only for a configured Production build.

- `src/preview.stylex.ts`, `src/preview-renderer.ts`, and `src/preview-foundation.*` own the inert preview's static recipes, sealed HTML producer, and CSS-importing foundation entry. `scripts/build-preview.ts` compiles their public StyleX generation; `scripts/preview-contract.ts` bounds its publication projection.

+ - `src/site-shell.stylex.ts` owns ordinary skip-link, header/navigation, and 404 presentation. `src/site-renderer.ts` produces both complete ordinary documents inside the generation in `scripts/build-site.ts`; `scripts/site-contract.ts` admits their closed public artifact projection. `src/site-foundation.css` keeps shared foundations and the remaining raw marketing/appearance compatibility below the final union.

- The preview browser verifier keeps the Bun HTTP server and Direct-owned Chrome lifecycle in its parent. A separately owned Node 24 worker drives Playwright through a bounded request, phase and result protocol; acceptance follows collection of both process groups and the server.

+ - `scripts/verify-site-shell.ts` and `site-shell-browser-*` require an exact reviewed old-tree manifest and compare ordinary documents in the same pinned native browser. The baseline is an independent input, never inferred from a prior passing claim.

- `site.test.ts`, `package.json`, and `vercel.json` define the content, identity, accessibility, performance, legacy-host, and deployment contracts.

# Guidelines

- Keep the site static and useful without JavaScript. Browser code may load only fingerprinted local assets. The sole runtime request is the reviewed PostHog pageview boundary below.

- - Author `/preview` presentation in product-owned literal StyleX recipes. Use the released `@hraness/ui/stylex-build` generation, Vite and Bun adapters, produced-template seal, and finalizer. Keep the ordinary site's raw-HTML compatibility styles separate; they remain unmigrated and must not be described as compiler-backed.

+ - Author `/preview` and the ordinary skip-link, header/navigation, and 404 shell in product-owned literal StyleX recipes. Use the released `@hraness/ui/stylex-build` generation, Vite and Bun adapters, produced-template seal, and finalizer. Keep the ordinary homepage marketing, copy controls, Ask-AI overrides, and framework-neutral appearance menu explicitly separate and unmigrated; a captured compatibility stylesheet is not a converted component.

+ - Seal both ordinary documents in one SSR graph with the exact UI, design-kit, and footer manifests, one CSS-importing Vite foundation, and one final union. Complete content and asset substitutions before sealing. Publish only the two sealed HTML files, foundation and union CSS, and thirteen identity-checked local WOFF2 files. Do not concatenate package standalone recipe CSS, publish graph JavaScript/evidence, or rewrite sealed HTML/CSS. Preserve the two original shell breakpoints, static navigation and recovery links, native focus, appearance behavior, and strict local-only font/style CSP.

+ - Keep the required design-kit foundation inside `base.hraness-foundation`, finite UA compatibility in the later base layer, and retained product rules in `components.atet-legacy` before the compiler-owned union. UA reversions must not override the appearance trigger's cursor or touch action. The temporary unlayered `site-ask-ai-compatibility.css` must scope every selector to `.atet-ask-ai`; `site-footer-compatibility.css` retains only the footer social link's inherited color. These preserve original presentation while the public static components lack descendant recipe overrides. Do not count either boundary as migrated or broaden it to mask other cascade regressions. Ordinary native evidence must compare those shared surfaces as well as the shell.

- The supported preview compiler profile is Bun 1.3.14 with Vite 8.2.1, production only, no React plugin, source maps, watch mode, or client renderer. The Vite foundation entry is TypeScript importing CSS, never a CSS-only bundler input. Capture its single empty JavaScript entry as private graph evidence, then publish only the sealed HTML, final StyleX union, captured foundation CSS, and all thirteen identity-checked installed WOFF2 files. Never publish graph JavaScript, source, receipts, manifests, or source maps. Keep fonts local and the preview's existing `style-src 'self'` and `font-src 'self'` CSP unchanged.

- The preview's final CSS URL is addressed by the complete captured source, lockfile, toolchain, and package-input fingerprint because the public generation API binds its URL before compilation. The finalized completion record separately binds the emitted CSS bytes. Preserve private generation evidence on success and failure; do not copy it into `dist/` or rewrite sealed HTML/CSS to rename assets.

- Use the framework-neutral `@hraness/design-kit` appearance menu as the final action in every ordinary HTML header. Keep exactly one Light, Dark, and System icon-menu control per page, default to System, and never place it inside navigation or a footer.

- Keep `apps/web` independently installable from its Vercel Root Directory: pin every dependency exactly in this package and commit its local `bun.lock`. Verify an isolated `bun install --frozen-lockfile --ignore-scripts`; do not depend on the parent workspace catalog or lockfile.

- Describe the released SDK, local host, and desktop capture shell as one Atet system. Do not introduce a hosted account, billing, authentication, or generation service.

- Keep generation credentials in local SDK or CLI processes. The browser must never accept, store, forward, or render an AI Gateway credential.

- Preserve the four public output families: images, diagrams, animated loops, and video. Treat audio and captions as composable project inputs rather than another project model.

- Use Atet, Ra's solar barque, respectfully as an abstract metaphor for passage and transformation. Do not imitate sacred figures, hieroglyphs, or archaeological objects.

- Keep every page semantic, keyboard-operable, readable at 200% zoom, and free of remote fonts and client frameworks. Analytics may emit one anonymous cookieless `$pageview` from `https://atet.sh/` to `https://us.i.posthog.com`, tagged with `site_id=atet` and `analytics_schema_version=1`. Keep persons, persistence, autocapture, replay, flags, surveys, heatmaps, pageleave, web vitals, referrer, URL, query, hash, page text, content, and custom events disabled. Do not initialize analytics on built-in Preview deployments, alternate hosts, or `404.html`.

- Organize `/docs` by user intent: guided learning, goal-oriented how-to, factual reference, and conceptual explanation. Do not mix those modes into one undifferentiated command catalog.

- Render the canonical `@hraness/site-footer` markup and styles on every ordinary HTML page. Keep product links and disclosures outside the footer. The noindex `/preview` composition is the sole exception: keep it free of scripts, analytics, actions, authentication, user data, and crawler discovery.

- The reading collection is intentionally empty. Before adding a route, score the proposed page from 0–2 on reader utility, original evidence, factual confidence, Atet fit, voice integrity, and maintenance. Publish only at 9/12 or higher with no zero; revise or consolidate at 6–8; reject at 5 or lower. Record the reader job, three nearest existing URLs and merge rationale, evidence owner, refresh trigger, and a 28–56 day reassessment date in the same change.

- A reading must add first-party evidence or a genuinely Atet-specific conclusion beyond summarizing another Hraness note. Do not invent first-person experience, pad a page to satisfy length or heading quotas, manufacture an “X, not Y” frame, or create a sibling-link web to make a thin collection appear substantial.

- Keep editorial discovery selective. Do not generate art before the page clears editorial admission, add generic “Ask AI about this” chrome to editorial pages, or treat keyword coverage, article count, image count, internal-link volume, or word count as evidence of value.

- If a reading is admitted, publish crawlable HTML with a matching markdown mirror and keep visible figures, captions, responsive image delivery, social metadata, schema, feeds, and sitemaps synchronized through the `editorial-image-seo` skill. Retain reviewed image provenance without exposing internal paths publicly.

- Publish `/llms.txt` as `text/plain` with an H1, summary, and a when-to-use section. Publish `/sitemap.md` and `/index.md` as markdown. Honor `Accept: text/markdown` on the homepage with `Content-Type: text/markdown; charset=utf-8` and `Vary: Accept`. Return `406` when the request rejects every produced type. Keep unknown routes as real `404` or `410` responses, and give markdown 404s recovery links to the home page, `llms.txt`, and sitemaps.

- Do not add a public API, OAuth, GraphQL, MCP, account, or commerce surface to the website.

- Preserve permanent production redirects for every reviewed predecessor host without redirecting canonical Atet hosts. Do not create a durable Preview hostname as a compatibility target.

- Run `bun run check` in this directory after a site change.

- - `bun test ./scripts/preview-contract.test.ts` is a pure, process-free edit loop. `typecheck:preview` checks the new compiler boundary independently of the root SDK configuration. `site.test.ts` performs real compilation and `verify:preview` runs native Chromium; the integration owner runs those through the required host/repository admission, including an isolated frozen install and native preview evidence before delivery.

+ - Before ordinary-shell delivery, also run `bun run verify:shell --baseline-directory <absolute baseline apps/web> --baseline-manifest <absolute reviewed JSON>` under exclusive browser admission. Bind the baseline's actual checkout revision, the reviewed merged revision/tree, all source/config inputs and its complete built artifact inventory. Keep every declared paired case, focus and appearance action, computed-style negative control, exact restore and native resource collection. Reflow-equivalent viewport evidence is not genuine browser-zoom evidence.

+ - `bun test ./scripts/preview-contract.test.ts ./scripts/site-contract.test.ts ./scripts/site-template.test.ts` is a pure, process-free edit loop. `typecheck:preview` checks both static compiler boundaries independently of the root SDK configuration. `site.test.ts` performs real compilation and `verify:preview` runs native Chromium; the integration owner runs those through the required host/repository admission, including an isolated frozen install and native ordinary-shell and preview evidence before delivery. Changes to the retained `styles.css` also change preview's captured input fingerprint and require fresh preview evidence.

- Set `NODE_EXECUTABLE_PATH` to the explicit Node 24 executable for preview browser verification. CI pins Node 24.18.1. Keep Playwright in the genuine Node worker, preserve the ten-second attachment deadline, and never accept a worker result before input revalidation, cancellation settlement, stream closure and positive owned-process absence.

- Use the Chromium revision selected by this app's pinned `playwright-core` for native preview evidence. After the frozen, scripts-disabled install, reproduce the site job's shell block in `.github/workflows/ci.yml` from the repository root, using the explicit Node 24 executable and a fresh task-owned temporary directory for `PLAYWRIGHT_BROWSERS_PATH` in place of CI's `RUNNER_TEMP`. The block resolves the CLI from the app's exported package manifest and declared binary, runs `install --no-shell chromium`, then resolves and checks `ATET_CHROME_PATH` through that same package's `chromium.executablePath()`. Keep the browser path exported for both operations. Route the installation and unchanged `bun run check:web` through the required local admission. Retain the browser revision, executable identity and verifier evidence; do not substitute an ambient browser or treat browser selection as proof of a prior failure's cause.