Establish an exact public documentation allowlist

[woksin]

Summary

Replace unrestricted cratis.io publication with an exact, hash-pinned eight-route public surface sourced from owning product repositories and six Approved claims.

This is a draft major-impact PR. It removes current unapproved site-level pages and machine/search exports from the deployable source. It must remain unmerged until every dependency and GitHub Pages effect below is reviewed against current product main.

Dependency order

1. Human review/merge Arc#2603.
2. Human review/merge cli#107.
3. Human review/merge Chronicle#3828.
4. Merge Components#180 into feat/react-aria-foundation, then authorized human-final-merge major Components#177.
5. Refresh manifest revisions/hashes only if the merged source bytes differ.
6. Run this PR from clean product main checkouts and require the complete route/artifact/sitemap gate.
7. Authorized human performs the final merge of this major PR against its reviewed current head.

Declared merge/deploy effects

A merge to main automatically builds and deploys GitHub Pages through .github/workflows/docs-site.yml.

The deployed artifact will contain only:

• /
• /404.html
• /chronicle/
• /chronicle/architecture/
• /chronicle/workbench/
• /arc/
• /components/
• /cli/
• exact favicon files, sitemap files, and narrowly typed Astro assets

The deployment removes currently published site-level roadmap, Studio, AI, compatibility, security, commercial/help, scenario, showcase, and other unapproved pages. Pagefind, llms.txt, llms-full.txt, page actions, raw Markdown mirrors, Storybooks, and generated API sites remain disabled and absent.

No package, image, product release, customer-data, support, or production-runtime effect is declared. GitHub Pages retains the previous successful artifact if the build/deploy gate fails.

Added

• Exact public-surface.json route/source/revision/hash/claim/static-artifact manifest.
• Fail-closed source materializer with realpath containment, YAML Draft detection, CLM-010 matrix denial, and exact route policy.
• Bidirectional HTML, static, generated-asset, sitemap, canonical-metadata, Approved-wording, and machine-output validation.
• Repository-local dependency lock and npm ci workflow.
• Claim-contained site-owned home and 404 sources.

Changed

• Build only reviewed Arc, Components, CLI, and Chronicle entry pages from exact owning revisions.
• Generate navigation from the same manifest.
• Limit PR permissions to read-only and Pages/OIDC permissions to the main-only deploy job.
• Validate reviewed branch revisions on PRs while main deployment requires matching product main bytes.

Removed

• Unrestricted tracked site-level public pages.
• Broad product synchronization from the deploy path.
• Pagefind, LLM exports, Markdown mirrors, page actions, Storybook/API publication, and arbitrary static artifact copying.

Reviewed product source revisions

• Chronicle de98cf9bde7210d38bb87af35fc1727d1d061ea4
• Arc 953dff585a9d9db9f51233e9b22c22e4a6b0f7e9
• Components d2ffdc0fd9518ade92eceafa9c387697c92e72e0 (latest reviewed #180 candidate; admitted MDX hash unchanged; still must enter #177/main in dependency order)
• CLI 5e8b987e08af1fc6d26faa15b25df95f2b3cee95

PR validation may fetch these exact revisions. Main deployment still checks product main and fails closed until the same reviewed bytes arrive there.

Verification

Current candidate head: 93cd6e63d77fb0b2eb527a44ee54727569690693, after the cross-PR review, exact revision/hash rebinding, and a true merge of current Documentation main.

• Clean npm ci && npm run check passed against the four exact reviewed product revisions above at current head 93cd6e63d77fb0b2eb527a44ee54727569690693.
• Checkout, Node setup, Pages artifact upload, and Pages deployment actions are pinned to exact commit SHAs; YAML/action security diagnostics passed.
• TopicHero, SimpleCard, and the architecture page's YouWillLearn component are exact SHA-256 render dependencies; reduced-motion mode suppresses card lift/transitions.
• Astro built exactly eight routes; the artifact/sitemap/machine-output gate passed; 197 rendered local links had 0 broken links; documentation and Markdown lint had 0 issues.
• All eight routes were reviewed in light and dark. /, /404.html, /chronicle/, /arc/, /components/, and /cli/ were also reviewed at 390 px. The concurrent Components hardening and Documentation-main merge did not change admitted page hashes/rendered bytes; the final exact build still passed.
• Browser QA found HTTP 200 for every admitted route, exactly one visible H1 per page, no heading skips, visible keyboard focus, no document/table/code/SVG overflow, no broken images, no runtime errors, no reduced-motion animation, and useful H1/content/links without JavaScript.
• The Chronicle architecture Mermaid diagram was present as build-time SVG; cold-load cumulative layout shift measured 0.0000 on every route. Manual review found no light/dark or mobile contrast/layout blocker.
• Vale and lychee are not installed in this checkout, so their advisory wrappers reported skips. Astro MDX parsing, rendered internal links, route/artifact/sitemap assertions, and the repository's required npm run check still exited 0.
• Clean install reported 6 existing npm audit findings (1 low, 3 moderate, 2 high); no dependency manifest or lockfile change is included in this PR.

This is PR-revision evidence, not publication evidence. After the product PRs merge in the required order, rebind the manifest to matching product main bytes if needed and rerun the complete gate before authorized human final merge.

[woksin]

Superseded by #68, which preserves the full documentation site while correcting the home page, canonical host, and robots/sitemap behavior. The eight-route removal candidate should not be merged.