diff --git a/.claude/settings.json b/.claude/settings.json
index 9c9b8eb..4b432b5 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -22,8 +22,7 @@
       "Bash(grep *)",
       "Bash(rg *)",
       "Read(**)",
-      "Edit(**)",
-      "Write(**)"
+      "Edit(**)"
     ],
     "deny": [
       "Bash(cargo publish*)",
diff --git a/.derived/codebase-index/by-package/stagecraft-ing.json b/.derived/codebase-index/by-package/stagecraft-ing.json
index 56ea398..3135379 100644
--- a/.derived/codebase-index/by-package/stagecraft-ing.json
+++ b/.derived/codebase-index/by-package/stagecraft-ing.json
@@ -5,5 +5,5 @@
     "path": ""
   },
   "schemaVersion": "1.1.0",
-  "shardHash": "6d1c8392a8d1d98ca723542d04780476c5faf043204703d79f42cb41a229beee"
+  "shardHash": "332c69f0508aa2a0fad69e29fff540bb2ba48a94b8518069eb9f0d11a2b69b91"
 }
diff --git a/.derived/codebase-index/by-spec/000-bootstrap.json b/.derived/codebase-index/by-spec/000-bootstrap.json
index 6f5d04f..226dcd4 100644
--- a/.derived/codebase-index/by-spec/000-bootstrap.json
+++ b/.derived/codebase-index/by-spec/000-bootstrap.json
@@ -42,5 +42,5 @@
     "specStatus": "approved"
   },
   "schemaVersion": "1.1.0",
-  "shardHash": "2bec351256eae4bc6941a9550bfffcd304cb6604640d97b85f6bf22cb37697b6"
+  "shardHash": "3e2458441b3b86df587e96c7d73ee9a2e5f88d4018edd7313ceb078e392d9f56"
 }
diff --git a/.derived/codebase-index/by-spec/001-site-scaffold.json b/.derived/codebase-index/by-spec/001-site-scaffold.json
index 9e8b05b..4e3f292 100644
--- a/.derived/codebase-index/by-spec/001-site-scaffold.json
+++ b/.derived/codebase-index/by-spec/001-site-scaffold.json
@@ -130,5 +130,5 @@
     "specStatus": "approved"
   },
   "schemaVersion": "1.1.0",
-  "shardHash": "a59ba7df3d5e808be8ba7da7af07cf850187cb11700e942ebe6a2a2988818926"
+  "shardHash": "56b49c1558488eab3f5cb972d30096fed9b7246bc09971f4166dbad291128d44"
 }
diff --git a/.derived/codebase-index/by-spec/002-launch-content.json b/.derived/codebase-index/by-spec/002-launch-content.json
index 1194314..8071c30 100644
--- a/.derived/codebase-index/by-spec/002-launch-content.json
+++ b/.derived/codebase-index/by-spec/002-launch-content.json
@@ -96,5 +96,5 @@
     "specStatus": "approved"
   },
   "schemaVersion": "1.1.0",
-  "shardHash": "b89aa769c2379525b9536a49fe574bfcb8244e05beca67bf76c014551f112e07"
+  "shardHash": "8d4aaf89704833f99fdae50f620b20d2c915db16625ee74fd548c31255c3f73e"
 }
diff --git a/.derived/spec-registry/by-spec/002-launch-content.json b/.derived/spec-registry/by-spec/002-launch-content.json
index 3bdce1f..e980130 100644
--- a/.derived/spec-registry/by-spec/002-launch-content.json
+++ b/.derived/spec-registry/by-spec/002-launch-content.json
@@ -43,6 +43,6 @@
     "summary": "The words on the site at launch. One index page that states what Stagecraft is in the builder's own register (creator-led, OSS-credible, no startup theater), a product-family section mapping the four repos and their licenses, and an honest status section tied to the public milestone ladder. The positioning facts are inlined here so the implementing session needs no external archive.\n",
     "title": "Launch content: positioning, product family, honest status"
   },
-  "shardHash": "7b9884fbd42e2bae5bd569294aeb0c596cbb29e0efa1290cd3777ece462cd6b3",
+  "shardHash": "f36fb21c54684c5b6c72484889ad5cfcc6f660be6962d8e1fb62625012f8aaf1",
   "specVersion": "1.1.0"
 }
diff --git a/README.md b/README.md
index fb54363..2425232 100644
--- a/README.md
+++ b/README.md
@@ -11,6 +11,23 @@ the governed agentic delivery control plane, and its product family:
   CLI + MCP server (Apache-2.0)
 - [spec-spine](https://github.com/stagecraft-ing/spec-spine): the
   spec-governance toolchain everything above is governed by
+- [tenant-emit](https://github.com/stagecraft-ing/tenant-emit): the tenant
+  certificate emitter, signing a produced app's governance certificate (Apache-2.0)
+- [tenant-tail](https://github.com/stagecraft-ing/tenant-tail): the tenant
+  certificate verifier, re-checking the factory's paperwork with no trust in
+  the producer (Apache-2.0)
+- [action-gate](https://github.com/stagecraft-ing/action-gate): a pure,
+  deterministic decision gate, evaluate(context, checks) returning Allow, Deny,
+  or Degrade (Apache-2.0)
+- [attest-ledger](https://github.com/stagecraft-ing/attest-ledger): a
+  tamper-evident record ledger, append-only, hash-linked, Ed25519-signed, with
+  an independent verifier (Apache-2.0)
+- [canonical-keysort-json](https://github.com/stagecraft-ing/canonical-keysort-json):
+  deterministic canonical JSON, a lexicographic key sort at the serialization
+  boundary so record hashes agree (Apache-2.0)
+- [trust-window](https://github.com/stagecraft-ing/trust-window): a
+  rolling-window trust scorer, weighted samples mapping to a graduated privilege
+  level (Apache-2.0)
 
 Site content and stack land here later; this placeholder marks the repo's
 role (the dotted-name convention: this repo is the website).
diff --git a/app/lib/product-family.ts b/app/lib/product-family.ts
index 60c8211..f3038e4 100644
--- a/app/lib/product-family.ts
+++ b/app/lib/product-family.ts
@@ -49,6 +49,48 @@ export const REPO_META: Record<string, RepoMeta> = {
     role: "the spec-governance toolchain everything above is governed by",
     url: `${ORG_URL}/spec-spine`,
   },
+  "tenant-emit": {
+    repo: "tenant-emit",
+    name: "tenant-emit",
+    license: "Apache-2.0",
+    role: "the tenant certificate emitter: signs a produced app's governance certificate",
+    url: `${ORG_URL}/tenant-emit`,
+  },
+  "tenant-tail": {
+    repo: "tenant-tail",
+    name: "tenant-tail",
+    license: "Apache-2.0",
+    role: "the tenant certificate verifier: re-checks the factory's paperwork, no trust in the producer",
+    url: `${ORG_URL}/tenant-tail`,
+  },
+  "action-gate": {
+    repo: "action-gate",
+    name: "action-gate",
+    license: "Apache-2.0",
+    role: "a pure, deterministic decision gate: evaluate(context, checks) returns Allow, Deny, or Degrade",
+    url: `${ORG_URL}/action-gate`,
+  },
+  "attest-ledger": {
+    repo: "attest-ledger",
+    name: "attest-ledger",
+    license: "Apache-2.0",
+    role: "a tamper-evident record ledger: append-only, hash-linked, Ed25519-signed, with an independent verifier",
+    url: `${ORG_URL}/attest-ledger`,
+  },
+  "canonical-keysort-json": {
+    repo: "canonical-keysort-json",
+    name: "canonical-keysort-json",
+    license: "Apache-2.0",
+    role: "deterministic canonical JSON: a lexicographic key sort at the serialization boundary, so record hashes agree",
+    url: `${ORG_URL}/canonical-keysort-json`,
+  },
+  "trust-window": {
+    repo: "trust-window",
+    name: "trust-window",
+    license: "Apache-2.0",
+    role: "a rolling-window trust scorer: weighted samples map to a graduated privilege level",
+    url: `${ORG_URL}/trust-window`,
+  },
   "stagecraft.ing": {
     repo: "stagecraft.ing",
     name: "stagecraft.ing",
@@ -58,12 +100,18 @@ export const REPO_META: Record<string, RepoMeta> = {
   },
 };
 
-// The four repos shown as the product family in the footer (README order).
+// The repos shown as the product family in the footer (README order).
 export const PRODUCT_FAMILY: RepoMeta[] = [
   REPO_META["stagecraft"],
   REPO_META["enrahitu"],
   REPO_META["stagecraft-cli"],
   REPO_META["spec-spine"],
+  REPO_META["tenant-emit"],
+  REPO_META["tenant-tail"],
+  REPO_META["action-gate"],
+  REPO_META["attest-ledger"],
+  REPO_META["canonical-keysort-json"],
+  REPO_META["trust-window"],
 ];
 
 export function repoMeta(repo: string): RepoMeta | undefined {
diff --git a/specs/002-launch-content/spec.md b/specs/002-launch-content/spec.md
index 9eaa046..5e11350 100644
--- a/specs/002-launch-content/spec.md
+++ b/specs/002-launch-content/spec.md
@@ -75,8 +75,17 @@ reads naturally (a single creator builds this in the open).
 - **Product family table**: stagecraft (control plane, AGPL-3.0),
   enrahitu (template chassis, Apache-2.0), stagecraft-cli (CLI + MCP
   server, Apache-2.0), spec-spine (governance toolchain, its own
-  repo). Each row: one-line role + repo link + license, and the note
-  that stamped apps belong to their owners.
+  repo), and (added 2026-07-15) six more public repos, all Apache-2.0:
+  the vended tenant tools tenant-emit (the certificate emitter) and
+  tenant-tail (the certificate verifier), plus the extracted primitives
+  action-gate (the deterministic decision gate), attest-ledger (the
+  tamper-evident record ledger), canonical-keysort-json (canonical JSON
+  at the hash boundary), and trust-window (the rolling-window trust
+  scorer). Each row: one-line role + repo link + license, and the note
+  that stamped apps belong to their owners. Like spec-spine, these
+  repos appear in this family list but are not baked into the
+  `/registry` viewer: §1 (spec 001) leaves the bake set unchanged, so
+  they are named and linked, not rendered as spec corpora.
 - **For agents**: a short section stating the MCP face: coding agents
   operate under the same governance as humans (same verbs, same
   guards, explicit posture, no side doors).