feat(004): restore rich marketing surfaces (products, whitepaper, get-started, sign-in)#6
Merged
Merged
Conversation
…-started, sign-in) Harvest the OAP-era stagecraft web app's richer public experience onto the static apex, re-authored to be checkable against the real product family. - Products/architecture page: the family as layers (governance, substrate, control plane, interface, verification primitives) with a governed delivery flow whose maturity chips roll up from the baked registry, and a repo catalog derived from the spec-003 roster (no drift). - Papers + a full whitepaper reader (sticky TOC, reading-progress, scroll-spy, inline references, comparison table) with an interactive clickable-SVG architecture explorer. The flagship paper is re-authored around spec-spine, enrahitu, the attestation primitives, and live Rauthy; no fabricated hashes, spec counts, signatures, or dead subsystems. - Get started: an honest split between what runs today (spec-spine, the enrahitu substrate) and what is on the ladder, each step linking to its governing spec. - Chrome: Products, Papers, Get Started in the nav, and a Sign in link that hands off to the control plane's Rauthy OIDC kickoff at app.stagecraft.ing/auth/rauthy. The static site runs no auth flow. Rename is total: Open Agentic Platform becomes Stagecraft; factory-encore and template-encore become enrahitu. Icons are inline SVG (no new deps); every new route is prerendered; zero runtime off-origin requests. Spec 004 owns the new files and extends spec 001 on the route table, prerender list, and chrome.
Acceptance holds end to end (build, prerender, spine gates, and the coupling gate all green; content re-authored and reconciled against the baked registry). Records what shipped and the sign-in infra caveat. Deploy remains gated by human approval; the change ships in the open PR.
bartekus
added a commit
that referenced
this pull request
Jul 21, 2026
…y path (#7) The sign-in link and spec 004 §3.2 pointed at https://app.statecraft.ing/auth/rauthy, described as the OIDC kickoff path. On the live control plane that path is the rauthy proxy passthrough, not a login route, and a top-level navigation to it is refused by rauthy's own CSRF guard with a BadRequest / "cross-origin request forbidden for this resource". The correct target is /api/v1/auth/login, the control plane's driver-agnostic login initiator: it 302s to the active auth driver's OIDC kickoff (rauthy today), so it also survives a driver change without an edit here. Verified live: the old path returns the CSRF refusal, the new one 302s through to /oidc/authorize with the PKCE + groups-scope authorize request. Updates the component, its comment, and all four spec references (summary, §3.2 rationale with the correction noted, and two acceptance/summary lines). Also brings the committed .derived current. It was already stale on main independent of this change (PR #6 merged with the govern check red): the by-package shard was still named stagecraft-ing while package.json is statecrafting, and the 001-003 registry shards had drifted. Regenerating under the CI-pinned spec-spine v0.10.0 makes index check fresh again.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Restores the richer public experience the OAP-era stagecraft web app carried, ported onto the static apex and re-authored to be checkable against the real product family. Governed by the new spec 004 (
specs/004-marketing-surfaces/spec.md).New surfaces:
/products): the family as layers (governance toolchain, substrate, control plane, interface, verification primitives), a governed delivery flow whose maturity chips roll up from the baked registry, and a repo catalog derived from the spec-003 roster so it cannot drift./papers,/papers/:slug): sticky TOC, reading-progress, scroll-spy, inline[ref:N]references, a positioning table, and an interactive clickable-SVG architecture explorer. The flagship paper is re-authored around spec-spine, enrahitu, the attestation primitives (attest-ledger, tenant-emit, tenant-tail, canonical-keysort-json), action-gate/trust-window, and live Rauthy./get-started): an honest split between what runs today (spec-spine, the enrahitu substrate) and what is on the ladder, each step linking to its governing spec.Honesty
Per this repo's rule (spec 002 section 1, CLAUDE.md), every published claim is checkable or marked forward-looking. No fabricated hashes, spec counts, signatures, OWASP "full coverage", or dead subsystems. The rename is total: "Open Agentic Platform"/"OAP" becomes Stagecraft;
factory-encoreandtemplate-encorebecomeenrahitu. Maturity is never hand-asserted where it could drift: the products delivery flow and the get-started/whitepaper framing are reconciled against the baked registry (Operate/fleet shows shipped becausestagecraft/006-fleetis complete; the stamp and self-host steps link to genuinely in-progress specs).Sign-in
The static apex runs no auth flow. Sign in is a plain outbound link to
https://app.stagecraft.ing/auth/rauthy: the same/auth/rauthyOIDC kickoff path the app used before the apex cutover, now on the control-plane host.Important
Pre-merge infra dependency:
app.stagecraft.ingcurrently serves a self-signed K8s ingress cert and/auth/rauthy404s (the control-plane deploy,stagecraft/009-control-plane-deploy, is in progress). Until that host has a valid cert and a landing/status page, clicking Sign in yields a browser TLS interstitial rather than a graceful hand-off.auth.stagecraft.ing(the Rauthy signer cited in the copy) is live with a valid cert.Static / deps
Icons are inline SVG (no new dependency); every new route is prerendered; the built output makes zero runtime off-origin requests.
Gates
npm run typecheck: cleannpm run build: prerenders/products,/papers,/papers/stagecraft-ecosystem,/get-startedand all existing routesspec-spine compile/index/lint --fail-on-warn/index check: greenspec-spine couple --base origin/main: 17 paths checked, no drift, no waiverNot merging: main auto-deploys to the live apex, so this awaits explicit approval.