From 3abec789cf86ccb637bc275da779aa55f878c86b Mon Sep 17 00:00:00 2001
From: vigneshrajsb <vignesh.raj47@gmail.com>
Date: Tue, 15 Sep 2026 13:31:05 -0700
Subject: [PATCH 1/9] docs(sites): document private sites and owner access

---
 documentation-metadata.json                   |  20 ++
 public/llms.txt                               |  16 +-
 .../docs/api-authentication/api-keys.mdx      |  30 ++-
 src/pages/docs/features/cli.mdx               |  27 ++-
 src/pages/docs/features/mcp-server.mdx        |  15 +-
 src/pages/docs/features/sites.mdx             | 199 ++++++++++++------
 src/pages/docs/operations/configuration.mdx   | 157 +++++++++++++-
 src/pages/docs/operations/security.mdx        |  39 +++-
 src/pages/docs/releases/compatibility.mdx     |  74 ++++++-
 src/pages/docs/setup/install-lifecycle.mdx    |  14 +-
 10 files changed, 503 insertions(+), 88 deletions(-)

diff --git a/documentation-metadata.json b/documentation-metadata.json
index 891dea8..39a851d 100644
--- a/documentation-metadata.json
+++ b/documentation-metadata.json
@@ -53,6 +53,26 @@
         "helm-charts": "78b680595d4beda3184124312d61d86ce0cc51e7",
         "lifecycle-opentofu": "b14865912608096379c28ef648f7ed99538b5600"
       }
+    },
+    "2026-09-14-sites-pending-release": {
+      "verifiedOn": "2026-09-14",
+      "sources": {
+        "lifecycle": "3e313fae532c4997c595e676e551a4f590dcc691",
+        "lifecycle-ui": "ab98c292aa2155ca0a08e62d6a9823507feeecd6",
+        "lifecycle-cli": "14552f966cc0eff3e4bb067a1f072f2d0b9dd57a",
+        "helm-charts": "992cfe38aa1175ea2acef517932a38f9dd974fef"
+      },
+      "notes": "These commits identify baseline checkouts only. Sites access-control behavior was reviewed in uncommitted working trees and is pending release. The implementation tracker records the exact file SHA256 manifest. Replace this baseline with implementing commit revisions before publication."
+    },
+    "2026-09-15-sites-rollout-pending-release": {
+      "verifiedOn": "2026-09-15",
+      "sources": {
+        "lifecycle": "3e313fae532c4997c595e676e551a4f590dcc691",
+        "lifecycle-ui": "ab98c292aa2155ca0a08e62d6a9823507feeecd6",
+        "lifecycle-cli": "14552f966cc0eff3e4bb067a1f072f2d0b9dd57a",
+        "helm-charts": "992cfe38aa1175ea2acef517932a38f9dd974fef"
+      },
+      "notes": "These commits identify baseline checkouts only. Rollout and directory configuration refer to uncommitted Sites access-control working trees, pending release. Restricted Keycloak 26.4.7 directory roles and token introspection were exercised in disposable realms. Current viewer source retains the exact authorizing token encrypted with a purpose-separated key derived from the existing bridge Secret, caps each record to 15 minutes and token/login expiry, and introspects that token on private reads. No session-list fallback or new configuration is used. This does not establish a supported released version set, production rollout, or final application acceptance. Replace with implementing commit revisions before publication."
     }
   }
 }
diff --git a/public/llms.txt b/public/llms.txt
index a54e48a..a8925ea 100644
--- a/public/llms.txt
+++ b/public/llms.txt
@@ -32,22 +32,22 @@ This index is generated from the human documentation. Follow the linked page for
 - [Cloud secrets](https://uselifecycle.com/docs/features/secrets.md): Reference External Secrets Operator values from Lifecycle Services and native Helm deployments. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Environment expiration and cleanup](https://uselifecycle.com/docs/features/environment-ttl.md): Understand how Lifecycle cleans up pull-request environments and expires API-created environments. _(audience: application-developer, platform-operator, administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [API-created Environments](https://uselifecycle.com/docs/features/api-environments.md): Create branch-based Lifecycle Environments without a pull request. Then, track, extend, redeploy, or tear them down. _(audience: api-user, application-developer; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Sites](https://uselifecycle.com/docs/features/sites.md): Upload and manage static HTML sites through Lifecycle's UI, CLI, or authenticated v2 API. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
+- [Sites](https://uselifecycle.com/docs/features/sites.md): Upload and manage static HTML sites through Lifecycle's UI, CLI, or authenticated v2 API. _(audience: application-developer, platform-operator; last verified: 2026-09-15; baseline: 2026-09-15-sites-rollout-pending-release)_
 - [Lifecycle Agent](https://uselifecycle.com/docs/features/ai-agent.md): Investigate a Lifecycle Environment, examine evidence, and do approved recovery tasks from the Environment details page. _(audience: agent-user; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Configure Lifecycle Agent](https://uselifecycle.com/docs/features/ai-agent-configuration.md): Configure models, instructions, tools, approvals, and repository overrides for Lifecycle Agent from Settings. _(audience: administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Agent Sessions](https://uselifecycle.com/docs/features/agent-sessions.md): Start, examine, and continue repository work with Lifecycle Agent in an isolated workspace. _(audience: agent-user; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Agent administration](https://uselifecycle.com/docs/features/agent-administration.md): Administer Lifecycle Agent availability, models, instructions, permissions, tools, workspaces, and session audit. _(audience: administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Agent workspace backends](https://uselifecycle.com/docs/features/workspace-backends.md): Compare and safely activate the runtime backend used for new Lifecycle Agent workspaces. _(audience: administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Connect external MCP servers](https://uselifecycle.com/docs/features/mcp-integration.md): Add administrator-approved Model Context Protocol servers and complete authentication for each Lifecycle Agent user. _(audience: agent-user, administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Lifecycle MCP](https://uselifecycle.com/docs/features/mcp-server.md): Enable Lifecycle MCP, connect an OAuth client, and use Lifecycle tools with existing user permissions. _(audience: agent-user, administrator, platform-operator; last verified: 2026-08-01; baseline: 2026-08-01-lifecycle-mcp-preparation)_
-- [CLI (lfc)](https://uselifecycle.com/docs/features/cli.md): Install and use the Lifecycle CLI to examine Environments, manage Services, stream logs, and validate configuration. _(audience: application-developer, platform-operator; last verified: 2026-08-01; baseline: 2026-08-01-configuration-schema-fix)_
+- [Lifecycle MCP](https://uselifecycle.com/docs/features/mcp-server.md): Enable Lifecycle MCP, connect an OAuth client, and use Lifecycle tools with existing user permissions. _(audience: agent-user, administrator, platform-operator; last verified: 2026-09-14; baseline: 2026-09-14-sites-pending-release)_
+- [CLI (lfc)](https://uselifecycle.com/docs/features/cli.md): Install and use the Lifecycle CLI to examine Environments, manage Services, stream logs, and validate configuration. _(audience: application-developer, platform-operator; last verified: 2026-09-14; baseline: 2026-09-14-sites-pending-release)_
 - [Lifecycle CLI telemetry](https://uselifecycle.com/docs/features/cli-telemetry.md): Understand the pseudonymous command-usage event sent by lfc, its destination, and how to opt out. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Use the Lifecycle UI](https://uselifecycle.com/docs/features/lifecycle-ui.md): Use the web UI to find Environments, examine Services and logs, run actions, and examine webhooks. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 
 ## API authentication
 
 - [API authentication](https://uselifecycle.com/docs/api-authentication/overview.md): Select a supported authentication method for Lifecycle v2 API requests and understand typical authorization failures. _(audience: api-user, administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [API keys](https://uselifecycle.com/docs/api-authentication/api-keys.md): Create, scope, use, rotate, and revoke personal or service API keys for authenticated Lifecycle v2 requests. _(audience: api-user, administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
+- [API keys](https://uselifecycle.com/docs/api-authentication/api-keys.md): Create, scope, use, rotate, and revoke personal or service API keys for authenticated Lifecycle v2 requests. _(audience: api-user, administrator; last verified: 2026-09-15; baseline: 2026-09-15-sites-rollout-pending-release)_
 
 ## HTTP API
 
@@ -74,22 +74,22 @@ This index is generated from the human documentation. Follow the linked page for
 
 - [Starter infrastructure prerequisites](https://uselifecycle.com/docs/setup/prerequisites.md): Prepare cloud, DNS, domain, and command-line access for the starter OpenTofu evaluation path. _(audience: evaluator, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Set up an evaluation cluster](https://uselifecycle.com/docs/setup/setup-infra.md): Provision starter GKE or EKS infrastructure, DNS, dependencies, and Lifecycle for evaluation. _(audience: evaluator, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Install Lifecycle](https://uselifecycle.com/docs/setup/install-lifecycle.md): Select the OpenTofu-managed or standalone Helm installation path. Make sure that the API, UI, identity, and cluster are healthy. _(audience: evaluator, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
+- [Install Lifecycle](https://uselifecycle.com/docs/setup/install-lifecycle.md): Select the OpenTofu-managed or standalone Helm installation path. Make sure that the API, UI, identity, and cluster are healthy. _(audience: evaluator, platform-operator; last verified: 2026-09-15; baseline: 2026-09-15-sites-rollout-pending-release)_
 - [Create the GitHub App](https://uselifecycle.com/docs/setup/create-github-app.md): Create and connect a private GitHub App for Lifecycle. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Optional configuration](https://uselifecycle.com/docs/setup/configure-lifecycle.md): Apply optional installation-wide settings safely after Lifecycle is running. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 
 ## Operations
 
 - [Lifecycle architecture](https://uselifecycle.com/docs/operations/architecture.md): Understand how requests become Lifecycle Environments and plan dependencies, security controls, availability, and recovery. _(audience: evaluator, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Runtime configuration surfaces](https://uselifecycle.com/docs/operations/configuration.md): Select a supported UI, API, Helm, or repository configuration surface and verify each change. _(audience: platform-operator, administrator; last verified: 2026-08-01; baseline: 2026-08-01-lifecycle-mcp-preparation)_
-- [Security boundaries](https://uselifecycle.com/docs/operations/security.md): Understand Lifecycle authentication, network, Kubernetes, secret, and Agent boundaries before other networks can reach a deployment. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
+- [Runtime configuration surfaces](https://uselifecycle.com/docs/operations/configuration.md): Select a supported UI, API, Helm, or repository configuration surface and verify each change. _(audience: platform-operator, administrator; last verified: 2026-09-15; baseline: 2026-09-15-sites-rollout-pending-release)_
+- [Security boundaries](https://uselifecycle.com/docs/operations/security.md): Understand Lifecycle authentication, network, Kubernetes, secret, and Agent boundaries before other networks can reach a deployment. _(audience: platform-operator; last verified: 2026-09-15; baseline: 2026-09-15-sites-rollout-pending-release)_
 - [Monitor Lifecycle](https://uselifecycle.com/docs/operations/monitoring.md): Interpret health endpoints, verify end-to-end operation, and collect safe diagnostic data for stuck work. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Day-two operations](https://uselifecycle.com/docs/operations/day-two.md): Plan Lifecycle upgrades, backups, rollback decisions, recovery validation, and uninstall. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 
 ## Releases and compatibility
 
 - [Releases](https://uselifecycle.com/docs/releases.md): Find your installed Lifecycle versions and the release information for an upgrade. _(audience: platform-operator, application-developer; last verified: 2026-08-01; baseline: 2026-08-01-adopt-lifecycle-mcp-browser-validation)_
-- [Compatibility and deprecation policy](https://uselifecycle.com/docs/releases/compatibility.md): Select compatible Lifecycle components and prepare a safe upgrade or rollback. _(audience: platform-operator, application-developer; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
+- [Compatibility and deprecation policy](https://uselifecycle.com/docs/releases/compatibility.md): Select compatible Lifecycle components and prepare a safe upgrade or rollback. _(audience: platform-operator, application-developer; last verified: 2026-09-15; baseline: 2026-09-15-sites-rollout-pending-release)_
 
 ## Troubleshooting
 
diff --git a/src/pages/docs/api-authentication/api-keys.mdx b/src/pages/docs/api-authentication/api-keys.mdx
index 0f0a4aa..806a4cf 100644
--- a/src/pages/docs/api-authentication/api-keys.mdx
+++ b/src/pages/docs/api-authentication/api-keys.mdx
@@ -4,8 +4,8 @@ description: Create, scope, use, rotate, and revoke personal or service API keys
 audience:
   - api-user
   - administrator
-lastVerified: "2026-07-24"
-verificationBaseline: "2026-07-24-comprehensive-audit"
+lastVerified: "2026-09-15"
+verificationBaseline: "2026-09-15-sites-rollout-pending-release"
 contentProfile: asd-ste100
 tags:
   - api
@@ -76,6 +76,32 @@ grant `sites:read`.
   repositories.
 </Callout>
 
+## Sites access with API keys
+
+<Callout type="warning">
+  The following Sites access controls are pending release.
+</Callout>
+
+`sites:read` permits public reads and reads of sites owned by the caller.
+`sites:write` also permits creation and changes to owned sites, including visibility changes.
+Scopes do not grant access to another user's private site.
+Administrator status does not override ownership.
+
+A personal key uses its user's ownership and defaults to private uploads.
+After migration, older personal keys without the required identity binding cannot access Sites.
+Create replacement personal keys through your signed-in account.
+
+Service keys create public sites only.
+Each service key owns only the sites created with that exact key.
+A replacement service key does not inherit site ownership.
+Before you retire a service key that owns sites, contact your platform operator.
+Revoked or expired keys cannot manage their sites.
+For sites with retired keys, see [Sites ownership limitations](/docs/features/sites#choose-who-can-access-a-site).
+
+Keep API keys in authorization headers.
+Do not put API keys in site content or URLs.
+For request details, see [Sites](/docs/features/sites#api-access).
+
 ## Select an expiration
 
 The personal-key policy defaults to a 168-hour (7-day) selection and caps finite
diff --git a/src/pages/docs/features/cli.mdx b/src/pages/docs/features/cli.mdx
index 40a6f38..b1a6c83 100644
--- a/src/pages/docs/features/cli.mdx
+++ b/src/pages/docs/features/cli.mdx
@@ -4,8 +4,8 @@ description: Install and use the Lifecycle CLI to examine Environments, manage S
 audience:
   - application-developer
   - platform-operator
-lastVerified: "2026-08-01"
-verificationBaseline: "2026-08-01-configuration-schema-fix"
+lastVerified: "2026-09-14"
+verificationBaseline: "2026-09-14-sites-pending-release"
 contentProfile: asd-ste100
 tags:
   - cli
@@ -222,15 +222,32 @@ each field. Exit code `3` means that the CLI did not find a configuration file.
 
 ### Static sites
 
+<Callout type="warning">
+  Sites visibility controls are pending release and require compatible server
+  and CLI versions.
+</Callout>
+
+User uploads default to private.
+Public uploads require confirmation when you specify `--visibility public`.
+Only the owner can change a site.
+`--mine` selects ownership, and `--public` selects public sites.
+These filters cannot be combined.
+
 ```sh
-lfc sites create <file-or-dir> [--name <label>]   # returns a stable URL
-lfc sites list [--mine]
+lfc sites create <file-or-dir> [--name <label>] [--visibility private|public] [--yes]
+lfc sites list [--mine | --public] [--search <text>]
 lfc sites get <id>
 lfc sites update <id> <file-or-dir>
-lfc sites extend <id>                             # push out the expiry
+lfc sites visibility <id> private|public [--yes]
+lfc sites extend <id>                             # extend expiration
 lfc sites delete <id> --yes
 ```
 
+The CLI prints the site's `openUrl`.
+Making a public site private retires the previous content URL.
+If a change returns `409`, fetch the site again before you retry.
+See [Sites](/docs/features/sites) for access rules and API details.
+
 ### Diagnostics & agent instructions
 
 ```sh
diff --git a/src/pages/docs/features/mcp-server.mdx b/src/pages/docs/features/mcp-server.mdx
index d2bb352..782d7de 100644
--- a/src/pages/docs/features/mcp-server.mdx
+++ b/src/pages/docs/features/mcp-server.mdx
@@ -5,8 +5,8 @@ audience:
   - agent-user
   - administrator
   - platform-operator
-lastVerified: "2026-08-01"
-verificationBaseline: "2026-08-01-lifecycle-mcp-preparation"
+lastVerified: "2026-09-14"
+verificationBaseline: "2026-09-14-sites-pending-release"
 contentProfile: asd-ste100
 tags:
   - mcp
@@ -90,6 +90,17 @@ When Sites is enabled, these tools are available:
 | `list_sites` | Lists visible Sites   |
 | `get_site`   | Gets one visible Site |
 
+<Callout type="info">
+  Sites access control is pending release. With compatible components, these
+  tools return the user's private sites and public sites. `mineOnly` selects
+  ownership rather than creator or updater email. Sites tools provide read
+  access only.
+</Callout>
+
+Results include visibility and `openUrl`.
+A private site's URL does not grant access to another user.
+The tools do not publish sites or send email invitations.
+
 An administrator can turn off all change tools. When change tools are off,
 clients do not discover them, and Lifecycle rejects their invocation.
 
diff --git a/src/pages/docs/features/sites.mdx b/src/pages/docs/features/sites.mdx
index 3bc89b6..85457a9 100644
--- a/src/pages/docs/features/sites.mdx
+++ b/src/pages/docs/features/sites.mdx
@@ -4,8 +4,8 @@ description: Upload and manage static HTML sites through Lifecycle's UI, CLI, or
 audience:
   - application-developer
   - platform-operator
-lastVerified: "2026-07-24"
-verificationBaseline: "2026-07-24-comprehensive-audit"
+lastVerified: "2026-09-15"
+verificationBaseline: "2026-09-15-sites-rollout-pending-release"
 contentProfile: asd-ste100
 tags:
   - sites
@@ -16,101 +16,174 @@ tags:
 
 import { Callout } from "nextra/components";
 
-Sites publishes a static HTML file or ZIP archive at a stable Lifecycle URL. It
-is useful for generated reports, prototypes, and documentation previews. A
-server-side application is not necessary.
+Sites hosts static HTML files and ZIP archives for reports, prototypes, and documentation previews.
+A server-side application is not necessary.
 
 <Callout type="warning">
-  Sites requires storage, gateway, DNS, and authentication configuration. If
-  **Sites** is not available, contact your deployment owner.
+  Private Sites and the access controls on this page are pending release.
+  Compatible API, gateway, UI, CLI, and chart versions are required. Existing
+  releases do not provide these access controls.
 </Callout>
 
+For upgrade requirements, see [Sites compatibility](/docs/releases/compatibility#sites-access-control-pending-release).
+Sites requires storage, gateway, DNS, TLS, and authentication configuration.
+If **Sites** is unavailable, contact your deployment owner.
+
+## Choose who can access a site
+
+New sites from your user account are private by default.
+Only the owner can view a private site.
+The owner can replace content, extend expiration, delete the site, or change visibility.
+Administrator access does not give ownership rights.
+
+A public site lets anyone with its URL read its content without signing in.
+Other users cannot change it.
+Public content can contain copies that remain outside Lifecycle after you make the site private.
+Email invitations and viewer or editor roles are not available in this release.
+
+During migration, existing sites remain public.
+These sites have no assigned owner and are read-only through normal user controls.
+For an unassigned site or a site owned by a retired service key, contact your platform operator.
+This release has no ownership transfer or recovery UI or API.
+
 ## Upload from the UI
 
 1. Open **Sites**.
 2. Select **Add site**.
-3. Select one HTML file or a ZIP archive with the entry point that your
-   deployment's upload policy requires.
+3. Select an HTML file or ZIP archive with the required entry file.
 4. Add an optional display name.
-5. Examine the file.
-6. Upload the file.
-7. Open the returned URL.
-8. Make sure that its content is correct.
-
-Use search plus **All sites** or **My sites** to find an upload. From a site's
-actions menu you can replace its content or delete it.
-
-<Callout type="info">
-  **My sites** is a convenience filter based on creator or updater identity. It
-  does not make a site private. A caller with `sites:read` can list active
-  sites.
-</Callout>
+5. Select **Private** or **Public**.
+6. Examine the visibility and file.
+7. Select **Upload private site** or **Publish site**.
+8. Open the returned URL.
+9. Make sure that the content and assets are correct.
+
+**My sites** shows sites that you own.
+**Public** shows public sites.
+**All accessible** shows your sites and public sites.
+Search matches the site name or ID.
+Search and pagination do not expose other users' private sites.
+
+From an owned site's actions menu, you can replace content, change visibility, or delete it.
+The visibility dialog requires confirmation before publication.
+When you make a public site private, Lifecycle retires its previous content URL.
+Use the returned opening URL for access to the current site.
 
 ## Upload a directory with the CLI
 
-The CLI can upload a ZIP, one HTML file, or a directory:
+The CLI accepts a ZIP, HTML file, or directory:
 
 ```bash
 lfc sites create ./dist --name "performance report"
+lfc sites create ./dist --visibility public --yes
 lfc sites list --mine
+lfc sites list --public --search report
 lfc sites get a1b2c3d4e5
 lfc sites update a1b2c3d4e5 ./dist
+lfc sites visibility a1b2c3d4e5 private --yes
 lfc sites extend a1b2c3d4e5
 lfc sites delete a1b2c3d4e5 --yes
 ```
 
-For a directory, `lfc` builds the ZIP locally. It applies built-in ignores such
-as `.git`, `node_modules`, cache directories, and coverage output. Add an
-`.lfcsiteignore` file for patterns in the repository.
+Omitting `--visibility` uses the server's default for your credentials.
+With user sign-in, that default is private.
+An explicit public upload requires confirmation or `--yes`.
+The CLI uses user sign-in and has no dedicated API-key input.
 
-Before creating or updating a site, the CLI fetches the deployment's upload
-policy and checks allowed extensions, file count, extracted size, and upload
-size.
+For a directory, `lfc` creates a ZIP locally.
+It excludes `.git`, `node_modules`, cache directories, and coverage output.
+Use `.lfcsiteignore` for additional exclusion patterns.
+Before an upload, the CLI checks the deployment's upload policy and allowed visibility.
 
-## Prepare static content
+## Prepare and replace content
 
-- Build the site locally. Lifecycle does not run a server-side build command.
-- When the site generator supports relative asset URLs, use them.
-- Include the entry file that your deployment's Sites policy specifies.
-- Remove source maps, credentials, and internal data. Remove output that is not
-  necessary.
-- Open the published URL.
-- Before you share the URL, check its navigation and assets.
+- Build the site locally.
+- When your site generator supports relative asset URLs, use them.
+- Include the entry file that the upload policy requires.
+- Remove credentials, internal data, source maps, and unnecessary output.
+- Before publication, check navigation and assets.
 
-When you replace content, the site keeps its URL. When you delete a site, its
-URL stops working. You cannot undo the deletion.
+A content replacement preserves the current content URL.
+A public-to-private change creates a fresh content URL.
+The API's `openUrl` opens the current site through Lifecycle.
+The `contentUrl` identifies the current content host.
+Neither URL grants access to a private site.
 
-## Expiration
+Deletion or expiration stops new content requests.
+Deletion cannot be undone.
+Content already downloaded or displayed can remain on a user's device.
 
-When the operator enables Sites TTL, a new site receives the deployment's
-configured expiration. **Extend** pushes the expiry out by the configured
-increment. When the operator disables TTL, a site can have no expiry.
+## Private content compatibility
 
-Use the expiry displayed by the UI or CLI. Do not use a fixed number of days.
-Get cleanup and previous-version retention information from the deployment
-owner.
+Private sites block Web Workers, SharedWorkers, and service workers.
+Features that require these workers, including some offline features, do not work.
+Use a site build that works without browser workers.
+Private sites also block display inside an iframe.
+
+## Expiration
+
+When the operator enables Sites TTL, new sites receive the configured expiration.
+The owner can extend expiration through the CLI or API.
+When TTL is disabled, a site can have no expiration.
+Use the displayed expiration instead of assuming a fixed number of days.
 
 ## API access
 
-Sites uses authenticated v2 routes:
+Management routes require authentication and the applicable scope.
+A scope permits an operation only when the caller also has the required ownership.
+
+| Task              | Route                                 | Scope         |
+| ----------------- | ------------------------------------- | ------------- |
+| Read capabilities | `GET /api/v2/sites/capabilities`      | `sites:read`  |
+| List sites        | `GET /api/v2/sites`                   | `sites:read`  |
+| Create a site     | `POST /api/v2/sites`                  | `sites:write` |
+| Get a site        | `GET /api/v2/sites/{siteId}`          | `sites:read`  |
+| Delete a site     | `DELETE /api/v2/sites/{siteId}`       | `sites:write` |
+| Replace content   | `PUT /api/v2/sites/{siteId}/content`  | `sites:write` |
+| Extend expiration | `POST /api/v2/sites/{siteId}/extend`  | `sites:write` |
+| Change visibility | `PATCH /api/v2/sites/{siteId}/access` | `sites:write` |
+
+Capabilities contain `enabled`, `upload`, `defaultVisibility`, `allowedVisibilities`, and `canCreate`.
+Capabilities do not expose administrator configuration or storage credentials.
+List requests accept `view=mine|public|all`, `q`, `page`, and `limit`.
+Results use the pagination fields `items`, `total`, `current`, and `limit`.
+
+Create and content-replacement requests use `multipart/form-data`.
+Creation accepts optional `visibility`.
+A personal API key defaults to private sites.
+A service API key can create only public sites and defaults to public.
+The service key owns its sites through that exact key identity.
+
+Use an existing API key with `sites:write` in `LIFECYCLE_API_KEY`.
+Set `LIFECYCLE_URL` to your Lifecycle API origin.
+To upload an HTML file with the key's default visibility, run:
+
+```bash
+curl --fail --silent --show-error \
+  --header "Authorization: Bearer ${LIFECYCLE_API_KEY}" \
+  --form "file=@./report.html" \
+  "${LIFECYCLE_URL}/api/v2/sites"
+```
+
+Visibility changes require JSON fields `visibility` and `expectedAccessRevision`.
+For replacement, send `expectedAccessRevision` and `expectedContentRevision` as multipart fields.
+Delete and extend requests accept `expectedAccessRevision` as a query parameter.
+Older replacement clients can also receive `409` after a concurrent change.
 
-| Task            | Route                                    | Scope                         |
-| --------------- | ---------------------------------------- | ----------------------------- |
-| List or create  | `GET` or `POST /api/v2/sites`            | `sites:read` or `sites:write` |
-| Get or delete   | `GET` or `DELETE /api/v2/sites/{siteId}` | `sites:read` or `sites:write` |
-| Replace content | `PUT /api/v2/sites/{siteId}/content`     | `sites:write`                 |
-| Extend expiry   | `POST /api/v2/sites/{siteId}/extend`     | `sites:write`                 |
+For `409`, fetch the site again before you decide whether to retry.
+Do not automatically overwrite another change.
+Use `permissions` to show available actions and `currentRole` to identify ownership.
+Public results hide unrelated creator and updater identities.
 
-Uploads use `multipart/form-data`. Use the deployment-local generated API
-reference for the current limits and schema. See [API
-overview](/docs/api/overview) and [API
-keys](/docs/api-authentication/api-keys).
+See [API overview](/docs/api/overview) and [API keys](/docs/api-authentication/api-keys).
 
 ## Troubleshooting
 
-- **Sites is disabled or missing:** contact the deployment owner.
-- **The upload is rejected:** compare the file type, entry point, count, and
-  sizes with the policy returned by the deployment.
-- **Assets return 404:** rebuild with relative paths or the published base URL.
-- **A URL stopped working:** Lifecycle can expire a site, or a user can delete
-  it. Before you upload a replacement, examine the Sites list.
+| Symptom                       | Action                                                                                 |
+| ----------------------------- | -------------------------------------------------------------------------------------- |
+| Private upload is unavailable | Ask the operator to check private Sites readiness.                                     |
+| Upload is rejected            | Compare the entry file, extensions, counts, and sizes with the returned upload policy. |
+| A private URL does not open   | Sign in as the owner through the site's opening URL.                                   |
+| A site returns 404            | Check its current URL, visibility, and expiration through an authorized account.       |
+| Assets return 404             | Rebuild with relative paths or the current content base URL.                           |
+| A change returns 409          | Fetch current site details before you retry the intended change.                       |
diff --git a/src/pages/docs/operations/configuration.mdx b/src/pages/docs/operations/configuration.mdx
index af46b1f..8420590 100644
--- a/src/pages/docs/operations/configuration.mdx
+++ b/src/pages/docs/operations/configuration.mdx
@@ -4,8 +4,8 @@ description: Select a supported UI, API, Helm, or repository configuration surfa
 audience:
   - platform-operator
   - administrator
-lastVerified: "2026-08-01"
-verificationBaseline: "2026-08-01-lifecycle-mcp-preparation"
+lastVerified: "2026-09-15"
+verificationBaseline: "2026-09-15-sites-rollout-pending-release"
 contentProfile: asd-ste100
 tags:
   - operator
@@ -49,6 +49,159 @@ For a supported change:
 Do not restart all components unless the applicable procedure tells you to do
 so.
 
+## Sites configuration pending release
+
+Private Sites requires compatible components and additional operator configuration.
+The currently documented installation pin does not establish support for this feature.
+See [Sites upgrade requirements](/docs/releases/compatibility#sites-access-control-pending-release).
+
+Administrators manage upload limits through `GET /api/v2/config/sites` and `PUT /api/v2/config/sites`.
+Ordinary Sites clients use `GET /api/v2/sites/capabilities` for upload limits and allowed visibility.
+The legacy configuration-cache endpoint requires administrator authentication and is not a Sites client interface.
+
+The upcoming core chart uses these `sitesPrivate` values:
+
+| Value                                            | Purpose                                                                                              |
+| ------------------------------------------------ | ---------------------------------------------------------------------------------------------------- |
+| `enabled`                                        | Permit private Sites. Defaults to `false`. Use the coordinated enablement procedure.                 |
+| `uiOAuthClientId`                                | Match the UI `NEXT_PUBLIC_KEYCLOAK_CLIENT_ID`.                                                       |
+| `uiOrigin`                                       | Exact HTTPS origin of the Lifecycle UI.                                                              |
+| `bridgeSecret.name` and `bridgeSecret.key`       | Reference an externally provisioned bridge Secret.                                                   |
+| `directory.clientId`                             | Identify the dedicated Keycloak directory client.                                                    |
+| `directory.secretName` and `directory.secretKey` | Reference that client's Secret.                                                                      |
+| `trustedProxyAddresses`                          | Comma-separated IP string, for example `"192.0.2.10,192.0.2.11"`. Empty ignores forwarded addresses. |
+
+The UI chart also needs `sitesPrivate.enabled`, `uiOrigin`, and the same bridge Secret value.
+Its optional `sitesPrivate.apiInternalUrl` selects the internal API connection.
+Use the web Service DNS name and `components.web.service.port`, which defaults to `80`.
+For an umbrella installation, configure the UI chart under `ui.sitesPrivate`.
+
+Use a random bridge Secret with at least 32 bytes.
+Do not reuse the NextAuth secret or another signing secret.
+Before replacing existing workloads, complete the [directory release prerequisite](#sites-directory-release-prerequisite).
+Do not reuse management or worker synchronization credentials.
+
+Even when private creation is disabled, human Sites management requires directory access and the matching UI OAuth client ID.
+
+The gateway component must remain enabled.
+Disabling private Sites stops private access and all human uploads, including explicitly public uploads.
+Service-key public uploads remain available when Sites is enabled.
+It does not make private sites public.
+Keep bridge and directory credentials configured for logout and public-site management.
+
+Private viewer access also depends on Redis and the existing bridge Secret.
+Missing or corrupt authorization records prevent private access.
+Changing or losing the bridge Secret makes existing encrypted records unusable.
+
+During Secret rotation, configure the same replacement value on core web, gateway, and UI workloads.
+After rotation, ask users to sign in again.
+Ask users to reopen the stable Site link.
+After normal viewer expiry, reopen the stable Site link.
+If Redis or token checks are unavailable, restore those dependencies before retrying private access.
+Do not disable authorization to restore access.
+
+## Sites directory release prerequisite
+
+Use a dedicated confidential OpenID Connect client in the Lifecycle realm.
+The following procedure applies to Keycloak `26.4.7` with its built-in `realm-management` roles.
+Complete these checks again for another Keycloak version or a customized permission model.
+Do not replace existing Lifecycle workloads until the directory checks and isolated Sites tests pass.
+
+An identity administrator provisions the client through the Keycloak Admin REST API.
+In the paths below, `ADMIN` means the Keycloak base URL plus `/admin/realms/REALM`.
+`CLIENT_ID`, `SERVICE_USER_ID`, and `ROLE_CLIENT_ID` are internal IDs from the API responses.
+Keep administrative credentials separate from the resulting directory credential.
+
+1. Create the client with `POST ADMIN/clients` and this representation:
+
+   ```json
+   {
+     "clientId": "lifecycle-sites-directory",
+     "enabled": true,
+     "protocol": "openid-connect",
+     "publicClient": false,
+     "serviceAccountsEnabled": true,
+     "standardFlowEnabled": false,
+     "directAccessGrantsEnabled": false,
+     "fullScopeAllowed": false,
+     "defaultClientScopes": ["roles"]
+   }
+   ```
+
+2. Obtain `CLIENT_ID` with `GET ADMIN/clients?clientId=lifecycle-sites-directory`.
+3. Obtain `SERVICE_USER_ID` with `GET ADMIN/clients/CLIENT_ID/service-account-user`.
+4. Obtain `ROLE_CLIENT_ID` with `GET ADMIN/clients?clientId=realm-management`.
+5. Obtain the role representation with `GET ADMIN/clients/ROLE_CLIENT_ID/roles/view-users`.
+6. Put that unchanged role representation in a JSON array.
+7. Assign it with `POST ADMIN/users/SERVICE_USER_ID/role-mappings/clients/ROLE_CLIENT_ID`.
+8. Apply the same array with `POST ADMIN/clients/CLIENT_ID/scope-mappings/clients/ROLE_CLIENT_ID`.
+9. Store the client credential from `GET ADMIN/clients/CLIENT_ID/client-secret` through your approved Secret provider.
+10. Configure `sitesPrivate.directory` with the client ID and Secret reference.
+
+The `view-users` composite includes `query-users` and `query-groups` in this version.
+It permits realm-wide user, group, role-mapping, and session reads.
+This permission exceeds an enabled-status check.
+Do not assign user-management, client-management, or realm-management write roles to this client.
+Do not grant `view-clients`: it also permits access to client secrets in this version.
+Restrict the credential to core web and gateway workloads.
+
+### Verify directory access
+
+Obtain a token with the directory client's credentials and `grant_type=client_credentials` at `/realms/REALM/protocol/openid-connect/token`.
+Keep the token in memory or approved secret tooling.
+Do not print it in logs or reports.
+
+Using that token, verify these requests return `200`:
+
+| Request                                                           | Expected result                              |
+| ----------------------------------------------------------------- | -------------------------------------------- |
+| `GET ADMIN/users/USER_ID`                                         | The correct enabled or disabled state.       |
+| `GET ADMIN/users/USER_ID/role-mappings/realm/composite`           | Expanded realm roles for the selected user.  |
+| `GET ADMIN/users/USER_ID/groups?briefRepresentation=true&max=100` | The user's group memberships.                |
+| `GET ADMIN/groups/GROUP_ID/role-mappings/realm/composite`         | Expanded realm roles for the selected group. |
+
+Use separate disposable users for direct roles, composite roles, group-derived roles, no Lifecycle role, and disabled status.
+For group testing, assign a composite containing `user` to a top-level group.
+Give its test user no directly assigned Lifecycle role.
+Verify the group role response includes `user`.
+
+### Verify token status
+
+Use the same directory client to authenticate requests to `/realms/REALM/protocol/openid-connect/token/introspect`.
+Send a form-encoded `POST` with `client_id`, `client_secret`, `token`, and `token_type_hint=access_token`.
+Keep all credentials and token values out of reports and command history.
+No client-search permission or client UUID mapping is required.
+
+In an isolated realm, verify these results:
+
+1. Submit an eligible user's current token.
+2. Verify `active: true`.
+3. Terminate its online session.
+4. Resubmit that unexpired online token.
+5. Verify `active: false`.
+6. After its online session ends, verify that a CLI offline token remains active.
+7. Revoke that offline grant.
+8. Verify its unexpired token returns `active: false`.
+9. Repeat the offline checks with a dynamically registered MCP client.
+10. Disable a disposable user with an active token.
+11. Verify that token returns `active: false`.
+
+Offline grants can remain valid after identity-provider SSO logout.
+Revoke the offline grant to terminate that client's offline access.
+An unavailable token-status service must prevent protected Sites access.
+
+### Verify Sites access
+
+In the isolated Lifecycle deployment, verify successful Sites reads for eligible direct-role and group-role users.
+Disable a disposable owner after sign-in and verify that Sites management and private content deny access.
+Terminate another disposable browser login and verify that its existing credentials cannot access private content.
+Revoke a disposable CLI offline grant and verify that its existing credentials cannot access private content.
+Revoke a disposable owner's authorizing OAuth token while the account remains enabled.
+Verify that its existing private viewer cookie no longer grants access.
+
+If any required read fails, keep production unchanged and correct the permission configuration.
+Do not substitute a management credential.
+
 ## Secret handling
 
 Keep credentials in Kubernetes Secrets, an external secret provider, or the
diff --git a/src/pages/docs/operations/security.mdx b/src/pages/docs/operations/security.mdx
index 429ed0f..35201f3 100644
--- a/src/pages/docs/operations/security.mdx
+++ b/src/pages/docs/operations/security.mdx
@@ -3,8 +3,8 @@ title: Security boundaries
 description: Understand Lifecycle authentication, network, Kubernetes, secret, and Agent boundaries before other networks can reach a deployment.
 audience:
   - platform-operator
-lastVerified: "2026-07-24"
-verificationBaseline: "2026-07-24-comprehensive-audit"
+lastVerified: "2026-09-15"
+verificationBaseline: "2026-09-15-sites-rollout-pending-release"
 contentProfile: asd-ste100
 tags:
   - operator
@@ -49,6 +49,41 @@ and user synchronization.
 | Agents and MCP  | Tool permissions, approvals, external connections, workspace egress, and session review expand the trust boundary. |
 | Backups         | Recovery must include database, key material, and object storage together.                                         |
 
+## Private Sites pending release
+
+Sites access controls require the compatible release described in [Sites compatibility](/docs/releases/compatibility#sites-access-control-pending-release).
+Sites management requires authentication even on an authentication-disabled deployment.
+Disabling authentication does not expose private site content.
+Public site content remains readable without signing in.
+
+Use HTTPS for both the Lifecycle UI and Sites content.
+The content domain must have a different registrable domain from the UI.
+For example, `ui.example.com` and `report.example.net` meet this separation requirement.
+Sibling hosts such as `ui.example.com` and `report.example.com` do not.
+
+Keep object storage private and inaccessible through public bucket URLs.
+Route every content request through the authorization-capable gateway.
+Do not cache private content or serve it through an older gateway.
+A private site's content requires its owner and a valid browser session.
+A copied URL, administrator role, or unrelated API key does not grant access.
+
+Each private content request checks the OAuth token that authorized its browser access.
+Keycloak must still consider that exact token active.
+Lifecycle retains that token encrypted in Redis.
+Each record lasts at most 15 minutes.
+The record expires earlier if the token or application login expires.
+Content cookies and Site responses contain no retained OAuth token or ciphertext.
+
+Protect Redis access and the bridge Secret.
+See [Sites configuration](/docs/operations/configuration#sites-configuration-pending-release) for dependency failures and Secret rotation.
+
+Private content blocks Web Workers, SharedWorkers, service workers, and display inside an iframe.
+Applications that require these features need a compatible site build.
+
+After logout, verify that another private content request requires sign-in.
+Previously displayed or downloaded content can remain on the device.
+Making a public site private cannot remove copies that other users already obtained.
+
 ## Vulnerability reporting
 
 No private vulnerability-reporting channel is published. Do not post suspected
diff --git a/src/pages/docs/releases/compatibility.mdx b/src/pages/docs/releases/compatibility.mdx
index 282ae1d..3ca34c0 100644
--- a/src/pages/docs/releases/compatibility.mdx
+++ b/src/pages/docs/releases/compatibility.mdx
@@ -4,8 +4,8 @@ description: Select compatible Lifecycle components and prepare a safe upgrade o
 audience:
   - platform-operator
   - application-developer
-lastVerified: "2026-07-24"
-verificationBaseline: "2026-07-24-comprehensive-audit"
+lastVerified: "2026-09-15"
+verificationBaseline: "2026-09-15-sites-rollout-pending-release"
 contentProfile: asd-ste100
 tags:
   - release
@@ -36,4 +36,74 @@ version matrix, deprecation window, and rollback guarantee are not available.
 5. Test the upgrade with representative data and enabled features.
 6. Test the documented rollback or restore checkpoint.
 
+## Sites access control pending release
+
+Private Sites is pending release.
+A compatible released version set and production acceptance are not yet established.
+The installation example's chart pin does not establish private Sites support.
+
+The migration preserves existing sites as public.
+Those sites have no assigned owner and cannot be changed through normal user controls.
+New user uploads default to private.
+Service-key uploads remain public and belong to the exact creating key.
+Email sharing and viewer or editor roles are outside this release.
+
+First, test the matched release in an isolated deployment:
+
+1. Prepare the [Sites configuration](/docs/operations/configuration#sites-configuration-pending-release).
+2. Complete the [directory checks](/docs/operations/configuration#sites-directory-release-prerequisite).
+3. Enable both `sitesPrivate.enabled` and `ui.sitesPrivate.enabled` in that deployment.
+4. Test owner access, unrelated-user denial, publication, privatization, expiration, deletion, and logout.
+5. Verify that disabled users and terminated sessions cannot access private content.
+6. After privatization, verify that the old content hostname stops serving content.
+
+For production, schedule a maintenance window:
+
+1. Back up the database, private object storage, configuration, and Secrets together.
+2. Before replacing workloads, provision directory and bridge configuration.
+3. Verify that configuration.
+4. Keep both production private Sites flags disabled.
+5. Suspend reconcilers that could restart older workloads.
+6. Block Sites requests, including internal uploads and content requests.
+7. Drain requests.
+8. Stop every older API writer, worker, and gateway.
+9. Before any new core image starts, verify that all older instances have stopped.
+10. Start one compatible API instance.
+11. Verify migration completion.
+12. Replace every remaining API, worker, gateway, and UI instance with the compatible version.
+13. Verify directory access, public-site management, and denial of private content.
+14. Verify that no old gateway or direct bucket URL can serve content.
+15. Upgrade CLI clients.
+16. Replace personal API keys that lack identity binding.
+17. Enable both production private Sites flags while requests remain blocked.
+18. Repeat the isolated access tests through a restricted operator test path.
+19. After the tests pass, permit traffic.
+20. Resume reconcilers with the compatible configuration.
+
+Core startup runs the migration even when private Sites is disabled.
+An ordinary rolling image upgrade does not stop older writers before that migration.
+Use the selected chart release's [coordinated maintenance procedure](https://github.com/GoodRxOSS/helm-charts/blob/main/docs/sites-private-release-check.md#coordinated-production-barrier).
+Checks with disabled flags cannot verify private access.
+
+If migration fails, keep traffic blocked.
+If access tests fail, disable both flags.
+Before restoring public traffic, verify private-content denial.
+Keep compatible core and gateway images, the schema, and directory and bridge credentials during recovery.
+
+Older clients that fetch the configuration cache need an upgrade.
+That endpoint now requires administrator authentication.
+Sites clients must use the capabilities endpoint.
+Concurrent replacement can return `409`, including for older clients without revision fields.
+Fetch current site details before you retry a change.
+
+Do not downgrade to an older gateway or remove access-control data after enabling private Sites.
+The access-control migration does not provide a safe down migration.
+Disabling private Sites preserves private status and denies private access.
+
+An older UI can remove the logout protection that private Sites requires.
+For a UI rollback, retain compatible sign-in, site-opening, and logout behavior.
+Otherwise, disable private Sites before the UI rollback.
+Verify that private content is unavailable before you replace the UI.
+Use the release's tested recovery procedure or restore the complete pre-upgrade backup in isolation.
+
 Use [Day-two operations](/docs/operations/day-two) for the full procedure.
diff --git a/src/pages/docs/setup/install-lifecycle.mdx b/src/pages/docs/setup/install-lifecycle.mdx
index 8bcf744..db33126 100644
--- a/src/pages/docs/setup/install-lifecycle.mdx
+++ b/src/pages/docs/setup/install-lifecycle.mdx
@@ -4,8 +4,8 @@ description: Select the OpenTofu-managed or standalone Helm installation path. M
 audience:
   - evaluator
   - platform-operator
-lastVerified: "2026-07-24"
-verificationBaseline: "2026-07-24-comprehensive-audit"
+lastVerified: "2026-09-15"
+verificationBaseline: "2026-09-15-sites-rollout-pending-release"
 contentProfile: asd-ste100
 tags:
   - lifecycle
@@ -156,6 +156,16 @@ See [Authentication](/docs/features/authentication) for the full sign-in and
 security checks. If a workload is unhealthy, start with [platform
 monitoring](/docs/operations/monitoring) rather than continuing setup.
 
+## Prepare private Sites
+
+Private Sites access control is pending release.
+The chart version pinned above does not establish support for this feature.
+Before any upgraded core image starts, follow [Sites compatibility](/docs/releases/compatibility#sites-access-control-pending-release) and [Sites configuration](/docs/operations/configuration#sites-configuration-pending-release).
+
+Use a separate registrable domain for Sites content and trusted HTTPS certificates.
+Keep Sites storage private.
+The API, UI, identity directory, and authorization-capable gateway must pass the feature's access tests together.
+
 ## Continue setup
 
 When the API, UI, and sign-in flow are healthy:

From f78e8a9f5a3fde7cf7957c07afa2cf681a9cf53b Mon Sep 17 00:00:00 2001
From: vigneshrajsb <vignesh.raj47@gmail.com>
Date: Tue, 15 Sep 2026 17:16:51 -0700
Subject: [PATCH 2/9] docs(sites): explain simplified private access

---
 documentation-metadata.json                 |  12 +-
 src/pages/docs/features/sites.mdx           |  11 ++
 src/pages/docs/operations/configuration.mdx | 173 ++++++--------------
 src/pages/docs/operations/security.mdx      |  21 ++-
 src/pages/docs/releases/compatibility.mdx   |  20 +--
 5 files changed, 87 insertions(+), 150 deletions(-)

diff --git a/documentation-metadata.json b/documentation-metadata.json
index 39a851d..9994e5b 100644
--- a/documentation-metadata.json
+++ b/documentation-metadata.json
@@ -62,17 +62,17 @@
         "lifecycle-cli": "14552f966cc0eff3e4bb067a1f072f2d0b9dd57a",
         "helm-charts": "992cfe38aa1175ea2acef517932a38f9dd974fef"
       },
-      "notes": "These commits identify baseline checkouts only. Sites access-control behavior was reviewed in uncommitted working trees and is pending release. The implementation tracker records the exact file SHA256 manifest. Replace this baseline with implementing commit revisions before publication."
+      "notes": "These commits identify baseline checkouts only. Sites access-control behavior was reviewed in uncommitted working trees and is pending release. Replace this baseline with implementing commit revisions before publication."
     },
     "2026-09-15-sites-rollout-pending-release": {
       "verifiedOn": "2026-09-15",
       "sources": {
-        "lifecycle": "3e313fae532c4997c595e676e551a4f590dcc691",
-        "lifecycle-ui": "ab98c292aa2155ca0a08e62d6a9823507feeecd6",
-        "lifecycle-cli": "14552f966cc0eff3e4bb067a1f072f2d0b9dd57a",
-        "helm-charts": "992cfe38aa1175ea2acef517932a38f9dd974fef"
+        "lifecycle": "932650d3b3158bdb806626b335dc6531a3094526",
+        "lifecycle-ui": "b925d650870109859deca23e218f298e349b2879",
+        "lifecycle-cli": "6814da76083fa989ffcc967e433b931d40f1dd7f",
+        "helm-charts": "eb81e7d09c5ef9d2de92639f130bbb4a957c62a2"
       },
-      "notes": "These commits identify baseline checkouts only. Rollout and directory configuration refer to uncommitted Sites access-control working trees, pending release. Restricted Keycloak 26.4.7 directory roles and token introspection were exercised in disposable realms. Current viewer source retains the exact authorizing token encrypted with a purpose-separated key derived from the existing bridge Secret, caps each record to 15 minutes and token/login expiry, and introspects that token on private reads. No session-list fallback or new configuration is used. This does not establish a supported released version set, production rollout, or final application acceptance. Replace with implementing commit revisions before publication."
+      "notes": "Sites access-control behavior was verified against these implementing commits and remains pending release. User JWTs authorize Site-only browser access, capped at five minutes and JWT expiry. Private reads check current Site state. Ordinary UI logout does not immediately revoke issued access. These checks do not establish a supported released version set or production rollout."
     }
   }
 }
diff --git a/src/pages/docs/features/sites.mdx b/src/pages/docs/features/sites.mdx
index 85457a9..e817a9a 100644
--- a/src/pages/docs/features/sites.mdx
+++ b/src/pages/docs/features/sites.mdx
@@ -113,6 +113,17 @@ Deletion or expiration stops new content requests.
 Deletion cannot be undone.
 Content already downloaded or displayed can remain on a user's device.
 
+## Private access and logout
+
+Sign in as the owner to open a private site.
+Browser access expires within five minutes and no later than the authorizing JWT.
+If content stops loading after access expires, reopen the stable Site link.
+A valid user session can obtain access again after an ownership check.
+
+Ordinary UI logout does not immediately revoke issued access.
+This release does not guarantee a fixed five-minute cutoff measured from logout.
+An unrelated signed-in user cannot open your private site.
+
 ## Private content compatibility
 
 Private sites block Web Workers, SharedWorkers, and service workers.
diff --git a/src/pages/docs/operations/configuration.mdx b/src/pages/docs/operations/configuration.mdx
index 8420590..7bfbb73 100644
--- a/src/pages/docs/operations/configuration.mdx
+++ b/src/pages/docs/operations/configuration.mdx
@@ -61,146 +61,69 @@ The legacy configuration-cache endpoint requires administrator authentication an
 
 The upcoming core chart uses these `sitesPrivate` values:
 
-| Value                                            | Purpose                                                                                              |
-| ------------------------------------------------ | ---------------------------------------------------------------------------------------------------- |
-| `enabled`                                        | Permit private Sites. Defaults to `false`. Use the coordinated enablement procedure.                 |
-| `uiOAuthClientId`                                | Match the UI `NEXT_PUBLIC_KEYCLOAK_CLIENT_ID`.                                                       |
-| `uiOrigin`                                       | Exact HTTPS origin of the Lifecycle UI.                                                              |
-| `bridgeSecret.name` and `bridgeSecret.key`       | Reference an externally provisioned bridge Secret.                                                   |
-| `directory.clientId`                             | Identify the dedicated Keycloak directory client.                                                    |
-| `directory.secretName` and `directory.secretKey` | Reference that client's Secret.                                                                      |
-| `trustedProxyAddresses`                          | Comma-separated IP string, for example `"192.0.2.10,192.0.2.11"`. Empty ignores forwarded addresses. |
-
-The UI chart also needs `sitesPrivate.enabled`, `uiOrigin`, and the same bridge Secret value.
-Its optional `sitesPrivate.apiInternalUrl` selects the internal API connection.
-Use the web Service DNS name and `components.web.service.port`, which defaults to `80`.
-For an umbrella installation, configure the UI chart under `ui.sitesPrivate`.
-
-Use a random bridge Secret with at least 32 bytes.
-Do not reuse the NextAuth secret or another signing secret.
-Before replacing existing workloads, complete the [directory release prerequisite](#sites-directory-release-prerequisite).
-Do not reuse management or worker synchronization credentials.
-
-Even when private creation is disabled, human Sites management requires directory access and the matching UI OAuth client ID.
+| Value                   | Purpose                                                                                                   |
+| ----------------------- | --------------------------------------------------------------------------------------------------------- |
+| `enabled`               | Permit private Sites. Defaults to `false`. Use the coordinated enablement procedure.                      |
+| `uiOrigin`              | Exact HTTPS origin of the Lifecycle UI. The umbrella chart derives the default from its UI configuration. |
+| `trustedProxyAddresses` | Comma-separated IP string, for example `"192.0.2.10,192.0.2.11"`. Empty ignores forwarded addresses.      |
+
+For a separately installed UI, set `sitesPrivate.uiOrigin` to its canonical HTTPS origin.
+The UI uses its existing application URL, API URL, and sign-in configuration.
+No additional UI Sites flag or shared bridge Secret is required.
 
 The gateway component must remain enabled.
 Disabling private Sites stops private access and all human uploads, including explicitly public uploads.
 Service-key public uploads remain available when Sites is enabled.
-It does not make private sites public.
-Keep bridge and directory credentials configured for logout and public-site management.
+Disabling private Sites does not make private sites public.
 
-Private viewer access also depends on Redis and the existing bridge Secret.
+Private viewer access depends on Redis.
 Missing or corrupt authorization records prevent private access.
-Changing or losing the bridge Secret makes existing encrypted records unusable.
-
-During Secret rotation, configure the same replacement value on core web, gateway, and UI workloads.
-After rotation, ask users to sign in again.
-Ask users to reopen the stable Site link.
-After normal viewer expiry, reopen the stable Site link.
-If Redis or token checks are unavailable, restore those dependencies before retrying private access.
-Do not disable authorization to restore access.
+Each browser access grant expires within five minutes and no later than its authorizing JWT.
+After expiry, reopen the stable Site link to obtain access with a valid user session.
+An existing Site cookie cannot renew itself.
+If Redis is unavailable, restore it before retrying private access.
 
 ## Sites directory release prerequisite
 
-Use a dedicated confidential OpenID Connect client in the Lifecycle realm.
-The following procedure applies to Keycloak `26.4.7` with its built-in `realm-management` roles.
-Complete these checks again for another Keycloak version or a customized permission model.
-Do not replace existing Lifecycle workloads until the directory checks and isolated Sites tests pass.
-
-An identity administrator provisions the client through the Keycloak Admin REST API.
-In the paths below, `ADMIN` means the Keycloak base URL plus `/admin/realms/REALM`.
-`CLIENT_ID`, `SERVICE_USER_ID`, and `ROLE_CLIENT_ID` are internal IDs from the API responses.
-Keep administrative credentials separate from the resulting directory credential.
-
-1. Create the client with `POST ADMIN/clients` and this representation:
-
-   ```json
-   {
-     "clientId": "lifecycle-sites-directory",
-     "enabled": true,
-     "protocol": "openid-connect",
-     "publicClient": false,
-     "serviceAccountsEnabled": true,
-     "standardFlowEnabled": false,
-     "directAccessGrantsEnabled": false,
-     "fullScopeAllowed": false,
-     "defaultClientScopes": ["roles"]
-   }
-   ```
-
-2. Obtain `CLIENT_ID` with `GET ADMIN/clients?clientId=lifecycle-sites-directory`.
-3. Obtain `SERVICE_USER_ID` with `GET ADMIN/clients/CLIENT_ID/service-account-user`.
-4. Obtain `ROLE_CLIENT_ID` with `GET ADMIN/clients?clientId=realm-management`.
-5. Obtain the role representation with `GET ADMIN/clients/ROLE_CLIENT_ID/roles/view-users`.
-6. Put that unchanged role representation in a JSON array.
-7. Assign it with `POST ADMIN/users/SERVICE_USER_ID/role-mappings/clients/ROLE_CLIENT_ID`.
-8. Apply the same array with `POST ADMIN/clients/CLIENT_ID/scope-mappings/clients/ROLE_CLIENT_ID`.
-9. Store the client credential from `GET ADMIN/clients/CLIENT_ID/client-secret` through your approved Secret provider.
-10. Configure `sitesPrivate.directory` with the client ID and Secret reference.
-
-The `view-users` composite includes `query-users` and `query-groups` in this version.
-It permits realm-wide user, group, role-mapping, and session reads.
-This permission exceeds an enabled-status check.
-Do not assign user-management, client-management, or realm-management write roles to this client.
-Do not grant `view-clients`: it also permits access to client secrets in this version.
-Restrict the credential to core web and gateway workloads.
-
-### Verify directory access
-
-Obtain a token with the directory client's credentials and `grant_type=client_credentials` at `/realms/REALM/protocol/openid-connect/token`.
-Keep the token in memory or approved secret tooling.
-Do not print it in logs or reports.
-
-Using that token, verify these requests return `200`:
-
-| Request                                                           | Expected result                              |
-| ----------------------------------------------------------------- | -------------------------------------------- |
-| `GET ADMIN/users/USER_ID`                                         | The correct enabled or disabled state.       |
-| `GET ADMIN/users/USER_ID/role-mappings/realm/composite`           | Expanded realm roles for the selected user.  |
-| `GET ADMIN/users/USER_ID/groups?briefRepresentation=true&max=100` | The user's group memberships.                |
-| `GET ADMIN/groups/GROUP_ID/role-mappings/realm/composite`         | Expanded realm roles for the selected group. |
-
-Use separate disposable users for direct roles, composite roles, group-derived roles, no Lifecycle role, and disabled status.
-For group testing, assign a composite containing `user` to a top-level group.
-Give its test user no directly assigned Lifecycle role.
-Verify the group role response includes `user`.
-
-### Verify token status
-
-Use the same directory client to authenticate requests to `/realms/REALM/protocol/openid-connect/token/introspect`.
-Send a form-encoded `POST` with `client_id`, `client_secret`, `token`, and `token_type_hint=access_token`.
-Keep all credentials and token values out of reports and command history.
-No client-search permission or client UUID mapping is required.
-
-In an isolated realm, verify these results:
-
-1. Submit an eligible user's current token.
-2. Verify `active: true`.
-3. Terminate its online session.
-4. Resubmit that unexpired online token.
-5. Verify `active: false`.
-6. After its online session ends, verify that a CLI offline token remains active.
-7. Revoke that offline grant.
-8. Verify its unexpired token returns `active: false`.
-9. Repeat the offline checks with a dynamically registered MCP client.
-10. Disable a disposable user with an active token.
-11. Verify that token returns `active: false`.
+Sites reuses the existing read-only identity client configured under `keycloak.clients.lifecycleApiPrincipalSync`.
+The chart supplies that client to worker, web, and gateway workloads.
+Keep this client configured when private Sites is disabled.
+Its existing client ID and Secret-reference overrides remain applicable.
+
+Human Sites management requires identity checks even when private creation is disabled.
+New browser access grants also require identity checks.
+Do not substitute the identity management credential.
+
+Before replacing workloads, verify that the configured client can read user status, effective roles, and group roles.
+Verify that it can introspect incoming user access tokens.
+Use separate disposable users for direct roles, group-derived roles, missing roles, and disabled status.
+Keep credentials and token values out of logs and reports.
+
+In an isolated deployment, verify these results:
+
+1. An eligible user's current token permits Sites management.
+2. A group-derived Lifecycle role permits the same access.
+3. A disabled user cannot manage Sites or obtain a new private browser grant.
+   A user without the required role has the same restriction.
+4. A revoked online token cannot obtain a new grant.
+5. A revoked CLI or MCP offline grant cannot authorize new Sites operations.
+6. An unrelated user cannot obtain a private owner's Site content.
+7. An existing private browser grant expires within five minutes and no later than its authorizing JWT.
 
 Offline grants can remain valid after identity-provider SSO logout.
 Revoke the offline grant to terminate that client's offline access.
-An unavailable token-status service must prevent protected Sites access.
 
-### Verify Sites access
+Existing Site browser grants remain valid until their own expiry, subject to current Site ownership, access state, and availability.
+Ordinary UI logout does not immediately revoke issued JWTs or Site browser grants.
+A valid authenticated session can obtain another grant after fresh authorization.
+This release does not guarantee a fixed five-minute cutoff measured from logout.
 
-In the isolated Lifecycle deployment, verify successful Sites reads for eligible direct-role and group-role users.
-Disable a disposable owner after sign-in and verify that Sites management and private content deny access.
-Terminate another disposable browser login and verify that its existing credentials cannot access private content.
-Revoke a disposable CLI offline grant and verify that its existing credentials cannot access private content.
-Revoke a disposable owner's authorizing OAuth token while the account remains enabled.
-Verify that its existing private viewer cookie no longer grants access.
+Private asset requests use the Site grant and current Site state.
+They do not contact Keycloak for each asset.
+If identity checks are unavailable, new protected Sites operations fail closed.
+Existing browser grants can continue until their expiry while Redis and Site state remain available.
 
-If any required read fails, keep production unchanged and correct the permission configuration.
-Do not substitute a management credential.
+If a required identity check fails, keep production unchanged and correct the existing read-only client configuration.
 
 ## Secret handling
 
diff --git a/src/pages/docs/operations/security.mdx b/src/pages/docs/operations/security.mdx
index 35201f3..cf1a3cd 100644
--- a/src/pages/docs/operations/security.mdx
+++ b/src/pages/docs/operations/security.mdx
@@ -67,20 +67,23 @@ Do not cache private content or serve it through an older gateway.
 A private site's content requires its owner and a valid browser session.
 A copied URL, administrator role, or unrelated API key does not grant access.
 
-Each private content request checks the OAuth token that authorized its browser access.
-Keycloak must still consider that exact token active.
-Lifecycle retains that token encrypted in Redis.
-Each record lasts at most 15 minutes.
-The record expires earlier if the token or application login expires.
-Content cookies and Site responses contain no retained OAuth token or ciphertext.
+Core verifies the user's JWT, identity status, and Site ownership before issuing browser access.
+The browser receives Site-only access that expires within five minutes and no later than the authorizing JWT.
+Each private content request checks that grant and the current Site owner, access state, and availability.
+Content cookies contain no reusable OAuth access token or refresh token.
+Private asset requests do not contact Keycloak for each file.
 
-Protect Redis access and the bridge Secret.
-See [Sites configuration](/docs/operations/configuration#sites-configuration-pending-release) for dependency failures and Secret rotation.
+Protect Redis access.
+Missing authorization records prevent private access.
+See [Sites configuration](/docs/operations/configuration#sites-configuration-pending-release) for dependency requirements.
 
 Private content blocks Web Workers, SharedWorkers, service workers, and display inside an iframe.
 Applications that require these features need a compatible site build.
 
-After logout, verify that another private content request requires sign-in.
+Ordinary UI logout does not immediately revoke issued JWTs or Site browser grants.
+An existing grant can remain valid until expiry.
+A valid user session can obtain another grant after fresh authorization.
+This release does not guarantee a fixed five-minute cutoff measured from logout.
 Previously displayed or downloaded content can remain on the device.
 Making a public site private cannot remove copies that other users already obtained.
 
diff --git a/src/pages/docs/releases/compatibility.mdx b/src/pages/docs/releases/compatibility.mdx
index 3ca34c0..96769df 100644
--- a/src/pages/docs/releases/compatibility.mdx
+++ b/src/pages/docs/releases/compatibility.mdx
@@ -52,17 +52,18 @@ First, test the matched release in an isolated deployment:
 
 1. Prepare the [Sites configuration](/docs/operations/configuration#sites-configuration-pending-release).
 2. Complete the [directory checks](/docs/operations/configuration#sites-directory-release-prerequisite).
-3. Enable both `sitesPrivate.enabled` and `ui.sitesPrivate.enabled` in that deployment.
+3. Enable `sitesPrivate.enabled` in that deployment.
 4. Test owner access, unrelated-user denial, publication, privatization, expiration, deletion, and logout.
-5. Verify that disabled users and terminated sessions cannot access private content.
+5. Verify that disabled users and revoked tokens cannot obtain new private access grants.
+   Verify that existing browser grants expire within five minutes and no later than their authorizing JWTs.
 6. After privatization, verify that the old content hostname stops serving content.
 
 For production, schedule a maintenance window:
 
 1. Back up the database, private object storage, configuration, and Secrets together.
-2. Before replacing workloads, provision directory and bridge configuration.
+2. Before replacing workloads, configure the UI origin and existing read-only identity client.
 3. Verify that configuration.
-4. Keep both production private Sites flags disabled.
+4. Keep production `sitesPrivate.enabled` disabled.
 5. Suspend reconcilers that could restart older workloads.
 6. Block Sites requests, including internal uploads and content requests.
 7. Drain requests.
@@ -75,7 +76,7 @@ For production, schedule a maintenance window:
 14. Verify that no old gateway or direct bucket URL can serve content.
 15. Upgrade CLI clients.
 16. Replace personal API keys that lack identity binding.
-17. Enable both production private Sites flags while requests remain blocked.
+17. Enable production `sitesPrivate.enabled` while requests remain blocked.
 18. Repeat the isolated access tests through a restricted operator test path.
 19. After the tests pass, permit traffic.
 20. Resume reconcilers with the compatible configuration.
@@ -83,12 +84,12 @@ For production, schedule a maintenance window:
 Core startup runs the migration even when private Sites is disabled.
 An ordinary rolling image upgrade does not stop older writers before that migration.
 Use the selected chart release's [coordinated maintenance procedure](https://github.com/GoodRxOSS/helm-charts/blob/main/docs/sites-private-release-check.md#coordinated-production-barrier).
-Checks with disabled flags cannot verify private access.
+Checks with private Sites disabled cannot verify authorized private access.
 
 If migration fails, keep traffic blocked.
-If access tests fail, disable both flags.
+If access tests fail, disable private Sites.
 Before restoring public traffic, verify private-content denial.
-Keep compatible core and gateway images, the schema, and directory and bridge credentials during recovery.
+Keep compatible core and gateway images, the schema, Redis, and the existing identity configuration during recovery.
 
 Older clients that fetch the configuration cache need an upgrade.
 That endpoint now requires administrator authentication.
@@ -100,8 +101,7 @@ Do not downgrade to an older gateway or remove access-control data after enablin
 The access-control migration does not provide a safe down migration.
 Disabling private Sites preserves private status and denies private access.
 
-An older UI can remove the logout protection that private Sites requires.
-For a UI rollback, retain compatible sign-in, site-opening, and logout behavior.
+For a UI rollback, retain compatible sign-in and site-opening behavior.
 Otherwise, disable private Sites before the UI rollback.
 Verify that private content is unavailable before you replace the UI.
 Use the release's tested recovery procedure or restore the complete pre-upgrade backup in isolation.

From c889216a0b15c4db37a4778b10fc3ad3a26e35f5 Mon Sep 17 00:00:00 2001
From: vigneshrajsb <vignesh.raj47@gmail.com>
Date: Wed, 16 Sep 2026 09:18:58 -0700
Subject: [PATCH 3/9] docs(sites): remove internal checklist reference

Keep the product migration procedure and refresh its reviewed chart source revision after internal artifact cleanup.
---
 documentation-metadata.json               | 2 +-
 src/pages/docs/releases/compatibility.mdx | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/documentation-metadata.json b/documentation-metadata.json
index 9994e5b..c768b7e 100644
--- a/documentation-metadata.json
+++ b/documentation-metadata.json
@@ -70,7 +70,7 @@
         "lifecycle": "932650d3b3158bdb806626b335dc6531a3094526",
         "lifecycle-ui": "b925d650870109859deca23e218f298e349b2879",
         "lifecycle-cli": "6814da76083fa989ffcc967e433b931d40f1dd7f",
-        "helm-charts": "eb81e7d09c5ef9d2de92639f130bbb4a957c62a2"
+        "helm-charts": "abc06cf3002f0ae7f19fecc85f7733708a412bf4"
       },
       "notes": "Sites access-control behavior was verified against these implementing commits and remains pending release. User JWTs authorize Site-only browser access, capped at five minutes and JWT expiry. Private reads check current Site state. Ordinary UI logout does not immediately revoke issued access. These checks do not establish a supported released version set or production rollout."
     }
diff --git a/src/pages/docs/releases/compatibility.mdx b/src/pages/docs/releases/compatibility.mdx
index 96769df..d254d5f 100644
--- a/src/pages/docs/releases/compatibility.mdx
+++ b/src/pages/docs/releases/compatibility.mdx
@@ -83,7 +83,6 @@ For production, schedule a maintenance window:
 
 Core startup runs the migration even when private Sites is disabled.
 An ordinary rolling image upgrade does not stop older writers before that migration.
-Use the selected chart release's [coordinated maintenance procedure](https://github.com/GoodRxOSS/helm-charts/blob/main/docs/sites-private-release-check.md#coordinated-production-barrier).
 Checks with private Sites disabled cannot verify authorized private access.
 
 If migration fails, keep traffic blocked.

From e2c81d24a4e6daf380fb0965a604b8ddaae9d771 Mon Sep 17 00:00:00 2001
From: vigneshrajsb <vignesh.raj47@gmail.com>
Date: Wed, 16 Sep 2026 09:42:43 -0700
Subject: [PATCH 4/9] docs(sites): use existing configuration for private
 access

Describe the existing Sites setting and UI URL, with read-only identity credentials limited to web and worker.
---
 documentation-metadata.json                 |  4 ++--
 src/pages/docs/operations/configuration.mdx | 24 +++++++++------------
 src/pages/docs/releases/compatibility.mdx   | 21 +++++++++---------
 3 files changed, 23 insertions(+), 26 deletions(-)

diff --git a/documentation-metadata.json b/documentation-metadata.json
index c768b7e..4d680a4 100644
--- a/documentation-metadata.json
+++ b/documentation-metadata.json
@@ -67,10 +67,10 @@
     "2026-09-15-sites-rollout-pending-release": {
       "verifiedOn": "2026-09-15",
       "sources": {
-        "lifecycle": "932650d3b3158bdb806626b335dc6531a3094526",
+        "lifecycle": "d2af3d1f651dcfb1e38b38619ebfd89ab2760012",
         "lifecycle-ui": "b925d650870109859deca23e218f298e349b2879",
         "lifecycle-cli": "6814da76083fa989ffcc967e433b931d40f1dd7f",
-        "helm-charts": "abc06cf3002f0ae7f19fecc85f7733708a412bf4"
+        "helm-charts": "4acd7917c4f19f4f0d8420af3f62e5db43438e3f"
       },
       "notes": "Sites access-control behavior was verified against these implementing commits and remains pending release. User JWTs authorize Site-only browser access, capped at five minutes and JWT expiry. Private reads check current Site state. Ordinary UI logout does not immediately revoke issued access. These checks do not establish a supported released version set or production rollout."
     }
diff --git a/src/pages/docs/operations/configuration.mdx b/src/pages/docs/operations/configuration.mdx
index 7bfbb73..972cce2 100644
--- a/src/pages/docs/operations/configuration.mdx
+++ b/src/pages/docs/operations/configuration.mdx
@@ -59,22 +59,18 @@ Administrators manage upload limits through `GET /api/v2/config/sites` and `PUT
 Ordinary Sites clients use `GET /api/v2/sites/capabilities` for upload limits and allowed visibility.
 The legacy configuration-cache endpoint requires administrator authentication and is not a Sites client interface.
 
-The upcoming core chart uses these `sitesPrivate` values:
+Sites uses its existing `enabled` setting in core configuration.
+No additional private-Sites feature flag is required.
+The chart supplies `LIFECYCLE_UI_URL` from `ui.config.appUrl` or the configured global UI domain.
+For a separately installed UI, set the core chart's existing `ui.config.appUrl` value.
+Private Sites requires an HTTPS UI URL and a separate content domain.
 
-| Value                   | Purpose                                                                                                   |
-| ----------------------- | --------------------------------------------------------------------------------------------------------- |
-| `enabled`               | Permit private Sites. Defaults to `false`. Use the coordinated enablement procedure.                      |
-| `uiOrigin`              | Exact HTTPS origin of the Lifecycle UI. The umbrella chart derives the default from its UI configuration. |
-| `trustedProxyAddresses` | Comma-separated IP string, for example `"192.0.2.10,192.0.2.11"`. Empty ignores forwarded addresses.      |
-
-For a separately installed UI, set `sitesPrivate.uiOrigin` to its canonical HTTPS origin.
 The UI uses its existing application URL, API URL, and sign-in configuration.
 No additional UI Sites flag or shared bridge Secret is required.
 
 The gateway component must remain enabled.
-Disabling private Sites stops private access and all human uploads, including explicitly public uploads.
-Service-key public uploads remain available when Sites is enabled.
-Disabling private Sites does not make private sites public.
+Disabling Sites stops all Sites uploads and content access, including public sites.
+It does not make private sites public.
 
 Private viewer access depends on Redis.
 Missing or corrupt authorization records prevent private access.
@@ -86,11 +82,11 @@ If Redis is unavailable, restore it before retrying private access.
 ## Sites directory release prerequisite
 
 Sites reuses the existing read-only identity client configured under `keycloak.clients.lifecycleApiPrincipalSync`.
-The chart supplies that client to worker, web, and gateway workloads.
-Keep this client configured when private Sites is disabled.
+The chart supplies that client to worker and web workloads.
+The gateway does not receive this credential.
 Its existing client ID and Secret-reference overrides remain applicable.
 
-Human Sites management requires identity checks even when private creation is disabled.
+Human Sites management requires identity checks for public and private sites.
 New browser access grants also require identity checks.
 Do not substitute the identity management credential.
 
diff --git a/src/pages/docs/releases/compatibility.mdx b/src/pages/docs/releases/compatibility.mdx
index d254d5f..5865577 100644
--- a/src/pages/docs/releases/compatibility.mdx
+++ b/src/pages/docs/releases/compatibility.mdx
@@ -52,7 +52,7 @@ First, test the matched release in an isolated deployment:
 
 1. Prepare the [Sites configuration](/docs/operations/configuration#sites-configuration-pending-release).
 2. Complete the [directory checks](/docs/operations/configuration#sites-directory-release-prerequisite).
-3. Enable `sitesPrivate.enabled` in that deployment.
+3. Enable Sites through its existing core configuration setting.
 4. Test owner access, unrelated-user denial, publication, privatization, expiration, deletion, and logout.
 5. Verify that disabled users and revoked tokens cannot obtain new private access grants.
    Verify that existing browser grants expire within five minutes and no later than their authorizing JWTs.
@@ -63,7 +63,7 @@ For production, schedule a maintenance window:
 1. Back up the database, private object storage, configuration, and Secrets together.
 2. Before replacing workloads, configure the UI origin and existing read-only identity client.
 3. Verify that configuration.
-4. Keep production `sitesPrivate.enabled` disabled.
+4. Disable Sites through its existing core configuration setting.
 5. Suspend reconcilers that could restart older workloads.
 6. Block Sites requests, including internal uploads and content requests.
 7. Drain requests.
@@ -72,22 +72,23 @@ For production, schedule a maintenance window:
 10. Start one compatible API instance.
 11. Verify migration completion.
 12. Replace every remaining API, worker, gateway, and UI instance with the compatible version.
-13. Verify directory access, public-site management, and denial of private content.
+13. Verify directory access and denial of Sites content while Sites is disabled.
 14. Verify that no old gateway or direct bucket URL can serve content.
 15. Upgrade CLI clients.
 16. Replace personal API keys that lack identity binding.
-17. Enable production `sitesPrivate.enabled` while requests remain blocked.
+17. Enable Sites through core configuration while requests remain blocked.
 18. Repeat the isolated access tests through a restricted operator test path.
 19. After the tests pass, permit traffic.
 20. Resume reconcilers with the compatible configuration.
 
-Core startup runs the migration even when private Sites is disabled.
+Core startup runs the migration even when Sites is disabled.
 An ordinary rolling image upgrade does not stop older writers before that migration.
-Checks with private Sites disabled cannot verify authorized private access.
+Checks with Sites disabled cannot verify authorized private access.
 
 If migration fails, keep traffic blocked.
-If access tests fail, disable private Sites.
-Before restoring public traffic, verify private-content denial.
+If access tests fail, disable Sites.
+This stops public and private Sites access.
+Keep Sites traffic blocked until access tests pass.
 Keep compatible core and gateway images, the schema, Redis, and the existing identity configuration during recovery.
 
 Older clients that fetch the configuration cache need an upgrade.
@@ -98,10 +99,10 @@ Fetch current site details before you retry a change.
 
 Do not downgrade to an older gateway or remove access-control data after enabling private Sites.
 The access-control migration does not provide a safe down migration.
-Disabling private Sites preserves private status and denies private access.
+Disabling Sites preserves private status and denies all Sites content access.
 
 For a UI rollback, retain compatible sign-in and site-opening behavior.
-Otherwise, disable private Sites before the UI rollback.
+Otherwise, disable Sites before the UI rollback.
 Verify that private content is unavailable before you replace the UI.
 Use the release's tested recovery procedure or restore the complete pre-upgrade backup in isolation.
 

From 43094561eb83aab9aa9101cd4cbfadb68b382ab3 Mon Sep 17 00:00:00 2001
From: vigneshrajsb <vignesh.raj47@gmail.com>
Date: Mon, 21 Sep 2026 16:29:38 -0700
Subject: [PATCH 5/9] Document simplified Sites list views

---
 documentation-metadata.json       | 10 ++++++++++
 public/llms.txt                   |  2 +-
 src/pages/docs/features/sites.mdx |  5 ++---
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/documentation-metadata.json b/documentation-metadata.json
index 4d680a4..09d9d43 100644
--- a/documentation-metadata.json
+++ b/documentation-metadata.json
@@ -64,6 +64,16 @@
       },
       "notes": "These commits identify baseline checkouts only. Sites access-control behavior was reviewed in uncommitted working trees and is pending release. Replace this baseline with implementing commit revisions before publication."
     },
+    "2026-09-21-sites-ui-filter-pending-release": {
+      "verifiedOn": "2026-09-21",
+      "sources": {
+        "lifecycle": "4343694b08c158832f6fd269b81d848bcdaf9077",
+        "lifecycle-ui": "a8d65d351d68ca7466d4368d9eb4018bd46621aa",
+        "lifecycle-cli": "6814da76083fa989ffcc967e433b931d40f1dd7f",
+        "helm-charts": "0b5a50890635c7941984aaff622cc6e4fe79d1c1"
+      },
+      "notes": "Sites V1 behavior remains pending release. The UI offers My sites and Public list views; the API also supports view=all for other clients."
+    },
     "2026-09-15-sites-rollout-pending-release": {
       "verifiedOn": "2026-09-15",
       "sources": {
diff --git a/public/llms.txt b/public/llms.txt
index a8925ea..8f9eefa 100644
--- a/public/llms.txt
+++ b/public/llms.txt
@@ -32,7 +32,7 @@ This index is generated from the human documentation. Follow the linked page for
 - [Cloud secrets](https://uselifecycle.com/docs/features/secrets.md): Reference External Secrets Operator values from Lifecycle Services and native Helm deployments. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Environment expiration and cleanup](https://uselifecycle.com/docs/features/environment-ttl.md): Understand how Lifecycle cleans up pull-request environments and expires API-created environments. _(audience: application-developer, platform-operator, administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [API-created Environments](https://uselifecycle.com/docs/features/api-environments.md): Create branch-based Lifecycle Environments without a pull request. Then, track, extend, redeploy, or tear them down. _(audience: api-user, application-developer; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Sites](https://uselifecycle.com/docs/features/sites.md): Upload and manage static HTML sites through Lifecycle's UI, CLI, or authenticated v2 API. _(audience: application-developer, platform-operator; last verified: 2026-09-15; baseline: 2026-09-15-sites-rollout-pending-release)_
+- [Sites](https://uselifecycle.com/docs/features/sites.md): Upload and manage static HTML sites through Lifecycle's UI, CLI, or authenticated v2 API. _(audience: application-developer, platform-operator; last verified: 2026-09-21; baseline: 2026-09-21-sites-ui-filter-pending-release)_
 - [Lifecycle Agent](https://uselifecycle.com/docs/features/ai-agent.md): Investigate a Lifecycle Environment, examine evidence, and do approved recovery tasks from the Environment details page. _(audience: agent-user; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Configure Lifecycle Agent](https://uselifecycle.com/docs/features/ai-agent-configuration.md): Configure models, instructions, tools, approvals, and repository overrides for Lifecycle Agent from Settings. _(audience: administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Agent Sessions](https://uselifecycle.com/docs/features/agent-sessions.md): Start, examine, and continue repository work with Lifecycle Agent in an isolated workspace. _(audience: agent-user; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
diff --git a/src/pages/docs/features/sites.mdx b/src/pages/docs/features/sites.mdx
index e817a9a..74ef7f1 100644
--- a/src/pages/docs/features/sites.mdx
+++ b/src/pages/docs/features/sites.mdx
@@ -4,8 +4,8 @@ description: Upload and manage static HTML sites through Lifecycle's UI, CLI, or
 audience:
   - application-developer
   - platform-operator
-lastVerified: "2026-09-15"
-verificationBaseline: "2026-09-15-sites-rollout-pending-release"
+lastVerified: "2026-09-21"
+verificationBaseline: "2026-09-21-sites-ui-filter-pending-release"
 contentProfile: asd-ste100
 tags:
   - sites
@@ -60,7 +60,6 @@ This release has no ownership transfer or recovery UI or API.
 
 **My sites** shows sites that you own.
 **Public** shows public sites.
-**All accessible** shows your sites and public sites.
 Search matches the site name or ID.
 Search and pagination do not expose other users' private sites.
 

From 76dbdb0158fce76f671fb4842704e04625685a6b Mon Sep 17 00:00:00 2001
From: vigneshrajsb <vignesh.raj47@gmail.com>
Date: Mon, 21 Sep 2026 16:57:31 -0700
Subject: [PATCH 6/9] Document intentional Sites ACL downgrade

---
 documentation-metadata.json               | 10 +++++
 public/llms.txt                           |  2 +-
 src/pages/docs/releases/compatibility.mdx | 45 ++++++++++++++++++++---
 3 files changed, 50 insertions(+), 7 deletions(-)

diff --git a/documentation-metadata.json b/documentation-metadata.json
index 09d9d43..da7a6f1 100644
--- a/documentation-metadata.json
+++ b/documentation-metadata.json
@@ -64,6 +64,16 @@
       },
       "notes": "These commits identify baseline checkouts only. Sites access-control behavior was reviewed in uncommitted working trees and is pending release. Replace this baseline with implementing commit revisions before publication."
     },
+    "2026-09-21-sites-downgrade-pending-release": {
+      "verifiedOn": "2026-09-21",
+      "sources": {
+        "lifecycle": "5a95f69995272b9dec92c8a3c067458be46a65d4",
+        "lifecycle-ui": "a8d65d351d68ca7466d4368d9eb4018bd46621aa",
+        "lifecycle-cli": "6814da76083fa989ffcc967e433b931d40f1dd7f",
+        "helm-charts": "0b5a50890635c7941984aaff622cc6e4fe79d1c1"
+      },
+      "notes": "Sites V1 remains pending release. The core migration supports an intentional full downgrade that preserves Site rows and versions but publishes content through the older gateway and discards ACL metadata. An isolated PostgreSQL up/down/up test passed."
+    },
     "2026-09-21-sites-ui-filter-pending-release": {
       "verifiedOn": "2026-09-21",
       "sources": {
diff --git a/public/llms.txt b/public/llms.txt
index 8f9eefa..4e0c3c0 100644
--- a/public/llms.txt
+++ b/public/llms.txt
@@ -89,7 +89,7 @@ This index is generated from the human documentation. Follow the linked page for
 ## Releases and compatibility
 
 - [Releases](https://uselifecycle.com/docs/releases.md): Find your installed Lifecycle versions and the release information for an upgrade. _(audience: platform-operator, application-developer; last verified: 2026-08-01; baseline: 2026-08-01-adopt-lifecycle-mcp-browser-validation)_
-- [Compatibility and deprecation policy](https://uselifecycle.com/docs/releases/compatibility.md): Select compatible Lifecycle components and prepare a safe upgrade or rollback. _(audience: platform-operator, application-developer; last verified: 2026-09-15; baseline: 2026-09-15-sites-rollout-pending-release)_
+- [Compatibility and deprecation policy](https://uselifecycle.com/docs/releases/compatibility.md): Select compatible Lifecycle components and prepare a safe upgrade or rollback. _(audience: platform-operator, application-developer; last verified: 2026-09-21; baseline: 2026-09-21-sites-downgrade-pending-release)_
 
 ## Troubleshooting
 
diff --git a/src/pages/docs/releases/compatibility.mdx b/src/pages/docs/releases/compatibility.mdx
index 5865577..33e01ad 100644
--- a/src/pages/docs/releases/compatibility.mdx
+++ b/src/pages/docs/releases/compatibility.mdx
@@ -4,8 +4,8 @@ description: Select compatible Lifecycle components and prepare a safe upgrade o
 audience:
   - platform-operator
   - application-developer
-lastVerified: "2026-09-15"
-verificationBaseline: "2026-09-15-sites-rollout-pending-release"
+lastVerified: "2026-09-21"
+verificationBaseline: "2026-09-21-sites-downgrade-pending-release"
 contentProfile: asd-ste100
 tags:
   - release
@@ -97,13 +97,46 @@ Sites clients must use the capabilities endpoint.
 Concurrent replacement can return `409`, including for older clients without revision fields.
 Fetch current site details before you retry a change.
 
-Do not downgrade to an older gateway or remove access-control data after enabling private Sites.
-The access-control migration does not provide a safe down migration.
-Disabling Sites preserves private status and denies all Sites content access.
+If private Sites must stay private, keep the access-control schema and a compatible gateway.
+Disable Sites while you fix the release.
+This preserves private status and denies all Sites content access.
+
+The Sites access-control migration also supports an intentional full downgrade.
+An older gateway serves active, unexpired Site content without an ownership check.
+A private content URL can stop working, while the older Site ID hostname serves the same content.
+The downgrade removes visibility, owner identity, creator-key identity, serving generation, revision fields, and personal-key issuer binding.
+
+It keeps Site rows, Site versions, and stored files.
+After a later upgrade, every surviving Site becomes public and unassigned.
+Personal API keys must be replaced before they can manage Sites again.
+
+For a full downgrade:
+
+1. Confirm that making all active Site content public and losing ownership metadata is acceptable.
+2. Back up the database and Site object storage together.
+3. Block Site uploads and content requests.
+4. Stop all core API, worker, and gateway instances.
+5. Stop reconcilers that could restart a new core instance.
+6. Verify that `035_sites_access_control.ts` is the latest applied migration.
+7. Start a one-off maintenance container with the candidate core image and database configuration.
+8. Bypass its normal startup command.
+9. Run this targeted migration command once:
+
+   ```bash
+   pnpm exec tsx node_modules/knex/bin/cli.js migrate:down 035_sites_access_control.ts
+   ```
+
+10. Verify that the migration completed and Site and version counts did not change.
+11. Deploy the matching older core, gateway, UI, and CLI versions.
+12. Before you permit Site traffic again, verify the expected public access.
+
+Do not use `pnpm db:rollback` for this step. It reverses an entire migration batch, which can contain other changes.
+Do not start a new core image after the down migration. Its startup would apply the migration again.
 
 For a UI rollback, retain compatible sign-in and site-opening behavior.
 Otherwise, disable Sites before the UI rollback.
 Verify that private content is unavailable before you replace the UI.
-Use the release's tested recovery procedure or restore the complete pre-upgrade backup in isolation.
+Use the privacy-preserving recovery path or the intentional full downgrade above.
+You can also restore the complete pre-upgrade backup in isolation.
 
 Use [Day-two operations](/docs/operations/day-two) for the full procedure.

From 347cce854d5132e91c97b04a73b9e452ed492679 Mon Sep 17 00:00:00 2001
From: vigneshrajsb <vignesh.raj47@gmail.com>
Date: Tue, 22 Sep 2026 08:57:58 -0700
Subject: [PATCH 7/9] docs: clarify stable Site URLs and shared-apex option

---
 documentation-metadata.json                 | 10 ++++++++++
 public/llms.txt                             | 10 +++++-----
 src/pages/docs/features/cli.mdx             |  6 +++---
 src/pages/docs/features/sites.mdx           | 15 ++++++++-------
 src/pages/docs/operations/configuration.mdx | 10 +++++++---
 src/pages/docs/operations/security.mdx      | 15 +++++++++------
 src/pages/docs/releases/compatibility.mdx   |  8 ++++----
 7 files changed, 46 insertions(+), 28 deletions(-)

diff --git a/documentation-metadata.json b/documentation-metadata.json
index da7a6f1..aa58e62 100644
--- a/documentation-metadata.json
+++ b/documentation-metadata.json
@@ -93,6 +93,16 @@
         "helm-charts": "4acd7917c4f19f4f0d8420af3f62e5db43438e3f"
       },
       "notes": "Sites access-control behavior was verified against these implementing commits and remains pending release. User JWTs authorize Site-only browser access, capped at five minutes and JWT expiry. Private reads check current Site state. Ordinary UI logout does not immediately revoke issued access. These checks do not establish a supported released version set or production rollout."
+    },
+    "2026-09-22-sites-stable-url-pending-release": {
+      "verifiedOn": "2026-09-22",
+      "sources": {
+        "lifecycle": "0af126b06788110e5db4762b9b7fe4d7491de8e1",
+        "lifecycle-ui": "eb73479ddc0543bf133a9d8146334e94641ae88e",
+        "lifecycle-cli": "8dab9f14b45673703f3244ae220919042f0805bd",
+        "helm-charts": "0b5a50890635c7941984aaff622cc6e4fe79d1c1"
+      },
+      "notes": "Sites V1 remains pending release. Verified stable Site ID and content URL on visibility changes, server owner checks, the temporary same-apex opt-in, and the intentional full downgrade. Live browser retest of private open remains pending."
     }
   }
 }
diff --git a/public/llms.txt b/public/llms.txt
index 4e0c3c0..ce72970 100644
--- a/public/llms.txt
+++ b/public/llms.txt
@@ -32,7 +32,7 @@ This index is generated from the human documentation. Follow the linked page for
 - [Cloud secrets](https://uselifecycle.com/docs/features/secrets.md): Reference External Secrets Operator values from Lifecycle Services and native Helm deployments. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Environment expiration and cleanup](https://uselifecycle.com/docs/features/environment-ttl.md): Understand how Lifecycle cleans up pull-request environments and expires API-created environments. _(audience: application-developer, platform-operator, administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [API-created Environments](https://uselifecycle.com/docs/features/api-environments.md): Create branch-based Lifecycle Environments without a pull request. Then, track, extend, redeploy, or tear them down. _(audience: api-user, application-developer; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Sites](https://uselifecycle.com/docs/features/sites.md): Upload and manage static HTML sites through Lifecycle's UI, CLI, or authenticated v2 API. _(audience: application-developer, platform-operator; last verified: 2026-09-21; baseline: 2026-09-21-sites-ui-filter-pending-release)_
+- [Sites](https://uselifecycle.com/docs/features/sites.md): Upload and manage static HTML sites through Lifecycle's UI, CLI, or authenticated v2 API. _(audience: application-developer, platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-stable-url-pending-release)_
 - [Lifecycle Agent](https://uselifecycle.com/docs/features/ai-agent.md): Investigate a Lifecycle Environment, examine evidence, and do approved recovery tasks from the Environment details page. _(audience: agent-user; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Configure Lifecycle Agent](https://uselifecycle.com/docs/features/ai-agent-configuration.md): Configure models, instructions, tools, approvals, and repository overrides for Lifecycle Agent from Settings. _(audience: administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Agent Sessions](https://uselifecycle.com/docs/features/agent-sessions.md): Start, examine, and continue repository work with Lifecycle Agent in an isolated workspace. _(audience: agent-user; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
@@ -40,7 +40,7 @@ This index is generated from the human documentation. Follow the linked page for
 - [Agent workspace backends](https://uselifecycle.com/docs/features/workspace-backends.md): Compare and safely activate the runtime backend used for new Lifecycle Agent workspaces. _(audience: administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Connect external MCP servers](https://uselifecycle.com/docs/features/mcp-integration.md): Add administrator-approved Model Context Protocol servers and complete authentication for each Lifecycle Agent user. _(audience: agent-user, administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Lifecycle MCP](https://uselifecycle.com/docs/features/mcp-server.md): Enable Lifecycle MCP, connect an OAuth client, and use Lifecycle tools with existing user permissions. _(audience: agent-user, administrator, platform-operator; last verified: 2026-09-14; baseline: 2026-09-14-sites-pending-release)_
-- [CLI (lfc)](https://uselifecycle.com/docs/features/cli.md): Install and use the Lifecycle CLI to examine Environments, manage Services, stream logs, and validate configuration. _(audience: application-developer, platform-operator; last verified: 2026-09-14; baseline: 2026-09-14-sites-pending-release)_
+- [CLI (lfc)](https://uselifecycle.com/docs/features/cli.md): Install and use the Lifecycle CLI to examine Environments, manage Services, stream logs, and validate configuration. _(audience: application-developer, platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-stable-url-pending-release)_
 - [Lifecycle CLI telemetry](https://uselifecycle.com/docs/features/cli-telemetry.md): Understand the pseudonymous command-usage event sent by lfc, its destination, and how to opt out. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Use the Lifecycle UI](https://uselifecycle.com/docs/features/lifecycle-ui.md): Use the web UI to find Environments, examine Services and logs, run actions, and examine webhooks. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 
@@ -81,15 +81,15 @@ This index is generated from the human documentation. Follow the linked page for
 ## Operations
 
 - [Lifecycle architecture](https://uselifecycle.com/docs/operations/architecture.md): Understand how requests become Lifecycle Environments and plan dependencies, security controls, availability, and recovery. _(audience: evaluator, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Runtime configuration surfaces](https://uselifecycle.com/docs/operations/configuration.md): Select a supported UI, API, Helm, or repository configuration surface and verify each change. _(audience: platform-operator, administrator; last verified: 2026-09-15; baseline: 2026-09-15-sites-rollout-pending-release)_
-- [Security boundaries](https://uselifecycle.com/docs/operations/security.md): Understand Lifecycle authentication, network, Kubernetes, secret, and Agent boundaries before other networks can reach a deployment. _(audience: platform-operator; last verified: 2026-09-15; baseline: 2026-09-15-sites-rollout-pending-release)_
+- [Runtime configuration surfaces](https://uselifecycle.com/docs/operations/configuration.md): Select a supported UI, API, Helm, or repository configuration surface and verify each change. _(audience: platform-operator, administrator; last verified: 2026-09-22; baseline: 2026-09-22-sites-stable-url-pending-release)_
+- [Security boundaries](https://uselifecycle.com/docs/operations/security.md): Understand Lifecycle authentication, network, Kubernetes, secret, and Agent boundaries before other networks can reach a deployment. _(audience: platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-stable-url-pending-release)_
 - [Monitor Lifecycle](https://uselifecycle.com/docs/operations/monitoring.md): Interpret health endpoints, verify end-to-end operation, and collect safe diagnostic data for stuck work. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Day-two operations](https://uselifecycle.com/docs/operations/day-two.md): Plan Lifecycle upgrades, backups, rollback decisions, recovery validation, and uninstall. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 
 ## Releases and compatibility
 
 - [Releases](https://uselifecycle.com/docs/releases.md): Find your installed Lifecycle versions and the release information for an upgrade. _(audience: platform-operator, application-developer; last verified: 2026-08-01; baseline: 2026-08-01-adopt-lifecycle-mcp-browser-validation)_
-- [Compatibility and deprecation policy](https://uselifecycle.com/docs/releases/compatibility.md): Select compatible Lifecycle components and prepare a safe upgrade or rollback. _(audience: platform-operator, application-developer; last verified: 2026-09-21; baseline: 2026-09-21-sites-downgrade-pending-release)_
+- [Compatibility and deprecation policy](https://uselifecycle.com/docs/releases/compatibility.md): Select compatible Lifecycle components and prepare a safe upgrade or rollback. _(audience: platform-operator, application-developer; last verified: 2026-09-22; baseline: 2026-09-22-sites-stable-url-pending-release)_
 
 ## Troubleshooting
 
diff --git a/src/pages/docs/features/cli.mdx b/src/pages/docs/features/cli.mdx
index b1a6c83..8e97f0c 100644
--- a/src/pages/docs/features/cli.mdx
+++ b/src/pages/docs/features/cli.mdx
@@ -4,8 +4,8 @@ description: Install and use the Lifecycle CLI to examine Environments, manage S
 audience:
   - application-developer
   - platform-operator
-lastVerified: "2026-09-14"
-verificationBaseline: "2026-09-14-sites-pending-release"
+lastVerified: "2026-09-22"
+verificationBaseline: "2026-09-22-sites-stable-url-pending-release"
 contentProfile: asd-ste100
 tags:
   - cli
@@ -244,7 +244,7 @@ lfc sites delete <id> --yes
 ```
 
 The CLI prints the site's `openUrl`.
-Making a public site private retires the previous content URL.
+Changing visibility keeps the Site ID and content URL.
 If a change returns `409`, fetch the site again before you retry.
 See [Sites](/docs/features/sites) for access rules and API details.
 
diff --git a/src/pages/docs/features/sites.mdx b/src/pages/docs/features/sites.mdx
index 74ef7f1..b9be3c5 100644
--- a/src/pages/docs/features/sites.mdx
+++ b/src/pages/docs/features/sites.mdx
@@ -4,8 +4,8 @@ description: Upload and manage static HTML sites through Lifecycle's UI, CLI, or
 audience:
   - application-developer
   - platform-operator
-lastVerified: "2026-09-21"
-verificationBaseline: "2026-09-21-sites-ui-filter-pending-release"
+lastVerified: "2026-09-22"
+verificationBaseline: "2026-09-22-sites-stable-url-pending-release"
 contentProfile: asd-ste100
 tags:
   - sites
@@ -65,8 +65,8 @@ Search and pagination do not expose other users' private sites.
 
 From an owned site's actions menu, you can replace content, change visibility, or delete it.
 The visibility dialog requires confirmation before publication.
-When you make a public site private, Lifecycle retires its previous content URL.
-Use the returned opening URL for access to the current site.
+When you change visibility, the site ID and content URL stay the same.
+New requests to a private site require owner access.
 
 ## Upload a directory with the CLI
 
@@ -102,8 +102,7 @@ Before an upload, the CLI checks the deployment's upload policy and allowed visi
 - Remove credentials, internal data, source maps, and unnecessary output.
 - Before publication, check navigation and assets.
 
-A content replacement preserves the current content URL.
-A public-to-private change creates a fresh content URL.
+A content replacement or visibility change preserves the current content URL.
 The API's `openUrl` opens the current site through Lifecycle.
 The `contentUrl` identifies the current content host.
 Neither URL grants access to a private site.
@@ -125,10 +124,12 @@ An unrelated signed-in user cannot open your private site.
 
 ## Private content compatibility
 
-Private sites block Web Workers, SharedWorkers, and service workers.
+Private sites block Web Workers, SharedWorkers, and new service workers.
 Features that require these workers, including some offline features, do not work.
 Use a site build that works without browser workers.
 Private sites also block display inside an iframe.
+If a site was public, a service worker installed in a visitor's browser can remain after you make it private.
+For sensitive content, upload a new private site instead of changing the public site's visibility.
 
 ## Expiration
 
diff --git a/src/pages/docs/operations/configuration.mdx b/src/pages/docs/operations/configuration.mdx
index 972cce2..a0f2f56 100644
--- a/src/pages/docs/operations/configuration.mdx
+++ b/src/pages/docs/operations/configuration.mdx
@@ -4,8 +4,8 @@ description: Select a supported UI, API, Helm, or repository configuration surfa
 audience:
   - platform-operator
   - administrator
-lastVerified: "2026-09-15"
-verificationBaseline: "2026-09-15-sites-rollout-pending-release"
+lastVerified: "2026-09-22"
+verificationBaseline: "2026-09-22-sites-stable-url-pending-release"
 contentProfile: asd-ste100
 tags:
   - operator
@@ -63,7 +63,11 @@ Sites uses its existing `enabled` setting in core configuration.
 No additional private-Sites feature flag is required.
 The chart supplies `LIFECYCLE_UI_URL` from `ui.config.appUrl` or the configured global UI domain.
 For a separately installed UI, set the core chart's existing `ui.config.appUrl` value.
-Private Sites requires an HTTPS UI URL and a separate content domain.
+Private Sites requires HTTPS for the UI and content hosts.
+
+When possible, use a separate registrable content domain.
+If an internal deployment uses a shared registrable domain, set `SITES_ALLOW_SHARED_APEX=true` on both web and gateway.
+The chart supports this through each component's `deployment.extraEnv` list.
 
 The UI uses its existing application URL, API URL, and sign-in configuration.
 No additional UI Sites flag or shared bridge Secret is required.
diff --git a/src/pages/docs/operations/security.mdx b/src/pages/docs/operations/security.mdx
index cf1a3cd..41d5303 100644
--- a/src/pages/docs/operations/security.mdx
+++ b/src/pages/docs/operations/security.mdx
@@ -3,8 +3,8 @@ title: Security boundaries
 description: Understand Lifecycle authentication, network, Kubernetes, secret, and Agent boundaries before other networks can reach a deployment.
 audience:
   - platform-operator
-lastVerified: "2026-09-15"
-verificationBaseline: "2026-09-15-sites-rollout-pending-release"
+lastVerified: "2026-09-22"
+verificationBaseline: "2026-09-22-sites-stable-url-pending-release"
 contentProfile: asd-ste100
 tags:
   - operator
@@ -57,9 +57,10 @@ Disabling authentication does not expose private site content.
 Public site content remains readable without signing in.
 
 Use HTTPS for both the Lifecycle UI and Sites content.
-The content domain must have a different registrable domain from the UI.
-For example, `ui.example.com` and `report.example.net` meet this separation requirement.
-Sibling hosts such as `ui.example.com` and `report.example.com` do not.
+A separate registrable content domain gives stronger isolation from the UI.
+For example, `ui.example.com` and `report.example.net` use separate domains.
+Internal deployments can use sibling hosts by setting `SITES_ALLOW_SHARED_APEX=true` on both web and gateway.
+This opt-in keeps the two hosts on the same browser site and does not provide separate-domain isolation.
 
 Keep object storage private and inaccessible through public bucket URLs.
 Route every content request through the authorization-capable gateway.
@@ -77,8 +78,10 @@ Protect Redis access.
 Missing authorization records prevent private access.
 See [Sites configuration](/docs/operations/configuration#sites-configuration-pending-release) for dependency requirements.
 
-Private content blocks Web Workers, SharedWorkers, service workers, and display inside an iframe.
+Private content blocks Web Workers, SharedWorkers, new service workers, and display inside an iframe.
 Applications that require these features need a compatible site build.
+An existing service worker from a public version of the same site can remain in a visitor's browser.
+For sensitive content, create a new private site instead of making that public site private.
 
 Ordinary UI logout does not immediately revoke issued JWTs or Site browser grants.
 An existing grant can remain valid until expiry.
diff --git a/src/pages/docs/releases/compatibility.mdx b/src/pages/docs/releases/compatibility.mdx
index 33e01ad..14912e5 100644
--- a/src/pages/docs/releases/compatibility.mdx
+++ b/src/pages/docs/releases/compatibility.mdx
@@ -4,8 +4,8 @@ description: Select compatible Lifecycle components and prepare a safe upgrade o
 audience:
   - platform-operator
   - application-developer
-lastVerified: "2026-09-21"
-verificationBaseline: "2026-09-21-sites-downgrade-pending-release"
+lastVerified: "2026-09-22"
+verificationBaseline: "2026-09-22-sites-stable-url-pending-release"
 contentProfile: asd-ste100
 tags:
   - release
@@ -103,8 +103,8 @@ This preserves private status and denies all Sites content access.
 
 The Sites access-control migration also supports an intentional full downgrade.
 An older gateway serves active, unexpired Site content without an ownership check.
-A private content URL can stop working, while the older Site ID hostname serves the same content.
-The downgrade removes visibility, owner identity, creator-key identity, serving generation, revision fields, and personal-key issuer binding.
+The same content URL becomes public after a full downgrade.
+The downgrade removes visibility, owner identity, creator-key identity, revision fields, and personal-key issuer binding.
 
 It keeps Site rows, Site versions, and stored files.
 After a later upgrade, every surviving Site becomes public and unassigned.

From 780fd26892a2e6487582bc7262bfa49e03c404c9 Mon Sep 17 00:00:00 2001
From: Vigneshraj Sekar Babu <vignesh.raj47@gmail.com>
Date: Tue, 22 Sep 2026 16:26:45 -0700
Subject: [PATCH 8/9] docs(sites): reflect current release state, not
 pending-release framing

Sites access control has shipped (lifecycle#247, lifecycle-ui#85,
lifecycle-cli#10). Remove "pending release" callouts and headings across
the 8 affected pages, fix cross-reference anchors to match, and add a
new documentation-metadata.json baseline entry pinned to today's source
commits across lifecycle/lifecycle-ui/lifecycle-cli/helm-charts.
---
 documentation-metadata.json                   | 10 ++++++
 documentation-style-baseline.json             | 34 +++++++++----------
 public/llms.txt                               | 16 ++++-----
 .../docs/api-authentication/api-keys.mdx      |  8 ++---
 src/pages/docs/features/cli.mdx               |  7 +---
 src/pages/docs/features/mcp-server.mdx        | 11 +++---
 src/pages/docs/features/sites.mdx             | 19 +++--------
 src/pages/docs/operations/configuration.mdx   | 12 +++----
 src/pages/docs/operations/security.mdx        |  9 +++--
 src/pages/docs/releases/compatibility.mdx     | 15 ++++----
 src/pages/docs/setup/install-lifecycle.mdx    |  8 ++---
 11 files changed, 67 insertions(+), 82 deletions(-)

diff --git a/documentation-metadata.json b/documentation-metadata.json
index aa58e62..8035142 100644
--- a/documentation-metadata.json
+++ b/documentation-metadata.json
@@ -103,6 +103,16 @@
         "helm-charts": "0b5a50890635c7941984aaff622cc6e4fe79d1c1"
       },
       "notes": "Sites V1 remains pending release. Verified stable Site ID and content URL on visibility changes, server owner checks, the temporary same-apex opt-in, and the intentional full downgrade. Live browser retest of private open remains pending."
+    },
+    "2026-09-22-sites-access-control-released": {
+      "verifiedOn": "2026-09-22",
+      "sources": {
+        "lifecycle": "e50c29f7659fc14dc98f061e0c8fa57b40b788c0",
+        "lifecycle-ui": "917d8a8936b6054ae9fc102571a5b9c808a0bcb7",
+        "lifecycle-cli": "a08d9c2d0abb79ab7941c12d6ead1783a70ea45f",
+        "helm-charts": "6aff91c22411e641964774bcbb09e5265ac1250c"
+      },
+      "notes": "All four Sites access-control implementing PRs merged to main and deployed to production. Live-verified end to end: owner-only private access, distinct denied-vs-missing responses on the management API, the CLI's visibility/create/list/get/update/extend/delete commands, the shared-apex opt-in, stable Site ID and content URL across visibility and content changes, and the intentional full downgrade path."
     }
   }
 }
diff --git a/documentation-style-baseline.json b/documentation-style-baseline.json
index efe69eb..e5d5119 100644
--- a/documentation-style-baseline.json
+++ b/documentation-style-baseline.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 3,
-  "updatedOn": "2026-08-01",
+  "updatedOn": "2026-09-22",
   "references": {
     "canonical": "ASD-STE100 Issue 9",
     "canonicalRules": [
@@ -69,8 +69,8 @@
     "/docs/api-authentication/api-keys": {
       "file": "src/pages/docs/api-authentication/api-keys.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-07-25",
-      "sha256": "abccff28a910388f751789b3cd1ba7aba1ef81fc98e31ba66379427332eb6257"
+      "reviewedOn": "2026-09-22",
+      "sha256": "d26dc85ca89bf2fea22cb1b71994e64e7106375badc4605cd269c843e528c1a1"
     },
     "/docs/api-authentication/overview": {
       "file": "src/pages/docs/api-authentication/overview.mdx",
@@ -135,8 +135,8 @@
     "/docs/features/cli": {
       "file": "src/pages/docs/features/cli.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-08-01",
-      "sha256": "88a35c2ebf6bb6ac52874de2df6edd96b99dab582e6e3de3414226d12cbe5c7c"
+      "reviewedOn": "2026-09-22",
+      "sha256": "0f57d131ad05effbf05847828dd7f30d8b5641c5ecde54af181c3aec6821e15b"
     },
     "/docs/features/cli-telemetry": {
       "file": "src/pages/docs/features/cli-telemetry.mdx",
@@ -177,8 +177,8 @@
     "/docs/features/mcp-server": {
       "file": "src/pages/docs/features/mcp-server.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-08-01",
-      "sha256": "69ab72bfb6486d0189fc903d4a3d8e170c578be252d39335b7bea8e7c8b0da36"
+      "reviewedOn": "2026-09-22",
+      "sha256": "70ab60a321461fb609365c7184ad40fd7450e1ae68271748681b87be80d7e699"
     },
     "/docs/features/native-helm-deployment": {
       "file": "src/pages/docs/features/native-helm-deployment.mdx",
@@ -201,8 +201,8 @@
     "/docs/features/sites": {
       "file": "src/pages/docs/features/sites.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-07-25",
-      "sha256": "598f40560777f7d3f2074137ba9b2a102ceb4f61946fc05bc74f3a85d64d6bca"
+      "reviewedOn": "2026-09-22",
+      "sha256": "6005f5d24aa14e604c0387568099d79cbc321e423f750edc59372fbf40eab773"
     },
     "/docs/features/template-variables": {
       "file": "src/pages/docs/features/template-variables.mdx",
@@ -273,8 +273,8 @@
     "/docs/operations/configuration": {
       "file": "src/pages/docs/operations/configuration.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-08-01",
-      "sha256": "dcf78161c9d44e74638153de0f0b074361ba9ac6a8878a41338d35716860d755"
+      "reviewedOn": "2026-09-22",
+      "sha256": "fd1c2f4537187df8dfced9799dec480e5754c6ba519f548d244f65f66666717f"
     },
     "/docs/operations/day-two": {
       "file": "src/pages/docs/operations/day-two.mdx",
@@ -291,8 +291,8 @@
     "/docs/operations/security": {
       "file": "src/pages/docs/operations/security.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-07-25",
-      "sha256": "892aafebdd33b0c39b51f5c8ae6817e067679e3797d02eaaceee949b6ce13365"
+      "reviewedOn": "2026-09-22",
+      "sha256": "96b4850da7e8fb65f5e7de8ddeeedf6fb4e409a2d67814f6a8453af4a674bf92"
     },
     "/docs/reference/statuses": {
       "file": "src/pages/docs/reference/statuses.mdx",
@@ -309,8 +309,8 @@
     "/docs/releases/compatibility": {
       "file": "src/pages/docs/releases/compatibility.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-07-25",
-      "sha256": "1901b9d61ca33af98a41c41382624e7c07607c6cbaffb112e71718c3e17bbb1f"
+      "reviewedOn": "2026-09-22",
+      "sha256": "1f7e3d9d575e9f402afff84ede1c143bc40ffc879b7247470b92dc94ce1338d9"
     },
     "/docs/schema/aurora-restore": {
       "file": "src/pages/docs/schema/aurora-restore.mdx",
@@ -387,8 +387,8 @@
     "/docs/setup/install-lifecycle": {
       "file": "src/pages/docs/setup/install-lifecycle.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-07-25",
-      "sha256": "675a15ac05fef8f53b5cd2e177eb24b1fac1f745e5189ae6d8fc3133d9580a0c"
+      "reviewedOn": "2026-09-22",
+      "sha256": "db86fea5d5f8521bc86e049fba7a157a1e6be1198cca3839efb686083445dcfa"
     },
     "/docs/setup/prerequisites": {
       "file": "src/pages/docs/setup/prerequisites.mdx",
diff --git a/public/llms.txt b/public/llms.txt
index ce72970..80551ad 100644
--- a/public/llms.txt
+++ b/public/llms.txt
@@ -32,22 +32,22 @@ This index is generated from the human documentation. Follow the linked page for
 - [Cloud secrets](https://uselifecycle.com/docs/features/secrets.md): Reference External Secrets Operator values from Lifecycle Services and native Helm deployments. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Environment expiration and cleanup](https://uselifecycle.com/docs/features/environment-ttl.md): Understand how Lifecycle cleans up pull-request environments and expires API-created environments. _(audience: application-developer, platform-operator, administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [API-created Environments](https://uselifecycle.com/docs/features/api-environments.md): Create branch-based Lifecycle Environments without a pull request. Then, track, extend, redeploy, or tear them down. _(audience: api-user, application-developer; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Sites](https://uselifecycle.com/docs/features/sites.md): Upload and manage static HTML sites through Lifecycle's UI, CLI, or authenticated v2 API. _(audience: application-developer, platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-stable-url-pending-release)_
+- [Sites](https://uselifecycle.com/docs/features/sites.md): Upload and manage static HTML sites through Lifecycle's UI, CLI, or authenticated v2 API. _(audience: application-developer, platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
 - [Lifecycle Agent](https://uselifecycle.com/docs/features/ai-agent.md): Investigate a Lifecycle Environment, examine evidence, and do approved recovery tasks from the Environment details page. _(audience: agent-user; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Configure Lifecycle Agent](https://uselifecycle.com/docs/features/ai-agent-configuration.md): Configure models, instructions, tools, approvals, and repository overrides for Lifecycle Agent from Settings. _(audience: administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Agent Sessions](https://uselifecycle.com/docs/features/agent-sessions.md): Start, examine, and continue repository work with Lifecycle Agent in an isolated workspace. _(audience: agent-user; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Agent administration](https://uselifecycle.com/docs/features/agent-administration.md): Administer Lifecycle Agent availability, models, instructions, permissions, tools, workspaces, and session audit. _(audience: administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Agent workspace backends](https://uselifecycle.com/docs/features/workspace-backends.md): Compare and safely activate the runtime backend used for new Lifecycle Agent workspaces. _(audience: administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Connect external MCP servers](https://uselifecycle.com/docs/features/mcp-integration.md): Add administrator-approved Model Context Protocol servers and complete authentication for each Lifecycle Agent user. _(audience: agent-user, administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Lifecycle MCP](https://uselifecycle.com/docs/features/mcp-server.md): Enable Lifecycle MCP, connect an OAuth client, and use Lifecycle tools with existing user permissions. _(audience: agent-user, administrator, platform-operator; last verified: 2026-09-14; baseline: 2026-09-14-sites-pending-release)_
-- [CLI (lfc)](https://uselifecycle.com/docs/features/cli.md): Install and use the Lifecycle CLI to examine Environments, manage Services, stream logs, and validate configuration. _(audience: application-developer, platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-stable-url-pending-release)_
+- [Lifecycle MCP](https://uselifecycle.com/docs/features/mcp-server.md): Enable Lifecycle MCP, connect an OAuth client, and use Lifecycle tools with existing user permissions. _(audience: agent-user, administrator, platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
+- [CLI (lfc)](https://uselifecycle.com/docs/features/cli.md): Install and use the Lifecycle CLI to examine Environments, manage Services, stream logs, and validate configuration. _(audience: application-developer, platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
 - [Lifecycle CLI telemetry](https://uselifecycle.com/docs/features/cli-telemetry.md): Understand the pseudonymous command-usage event sent by lfc, its destination, and how to opt out. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Use the Lifecycle UI](https://uselifecycle.com/docs/features/lifecycle-ui.md): Use the web UI to find Environments, examine Services and logs, run actions, and examine webhooks. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 
 ## API authentication
 
 - [API authentication](https://uselifecycle.com/docs/api-authentication/overview.md): Select a supported authentication method for Lifecycle v2 API requests and understand typical authorization failures. _(audience: api-user, administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [API keys](https://uselifecycle.com/docs/api-authentication/api-keys.md): Create, scope, use, rotate, and revoke personal or service API keys for authenticated Lifecycle v2 requests. _(audience: api-user, administrator; last verified: 2026-09-15; baseline: 2026-09-15-sites-rollout-pending-release)_
+- [API keys](https://uselifecycle.com/docs/api-authentication/api-keys.md): Create, scope, use, rotate, and revoke personal or service API keys for authenticated Lifecycle v2 requests. _(audience: api-user, administrator; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
 
 ## HTTP API
 
@@ -74,22 +74,22 @@ This index is generated from the human documentation. Follow the linked page for
 
 - [Starter infrastructure prerequisites](https://uselifecycle.com/docs/setup/prerequisites.md): Prepare cloud, DNS, domain, and command-line access for the starter OpenTofu evaluation path. _(audience: evaluator, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Set up an evaluation cluster](https://uselifecycle.com/docs/setup/setup-infra.md): Provision starter GKE or EKS infrastructure, DNS, dependencies, and Lifecycle for evaluation. _(audience: evaluator, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Install Lifecycle](https://uselifecycle.com/docs/setup/install-lifecycle.md): Select the OpenTofu-managed or standalone Helm installation path. Make sure that the API, UI, identity, and cluster are healthy. _(audience: evaluator, platform-operator; last verified: 2026-09-15; baseline: 2026-09-15-sites-rollout-pending-release)_
+- [Install Lifecycle](https://uselifecycle.com/docs/setup/install-lifecycle.md): Select the OpenTofu-managed or standalone Helm installation path. Make sure that the API, UI, identity, and cluster are healthy. _(audience: evaluator, platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
 - [Create the GitHub App](https://uselifecycle.com/docs/setup/create-github-app.md): Create and connect a private GitHub App for Lifecycle. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Optional configuration](https://uselifecycle.com/docs/setup/configure-lifecycle.md): Apply optional installation-wide settings safely after Lifecycle is running. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 
 ## Operations
 
 - [Lifecycle architecture](https://uselifecycle.com/docs/operations/architecture.md): Understand how requests become Lifecycle Environments and plan dependencies, security controls, availability, and recovery. _(audience: evaluator, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Runtime configuration surfaces](https://uselifecycle.com/docs/operations/configuration.md): Select a supported UI, API, Helm, or repository configuration surface and verify each change. _(audience: platform-operator, administrator; last verified: 2026-09-22; baseline: 2026-09-22-sites-stable-url-pending-release)_
-- [Security boundaries](https://uselifecycle.com/docs/operations/security.md): Understand Lifecycle authentication, network, Kubernetes, secret, and Agent boundaries before other networks can reach a deployment. _(audience: platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-stable-url-pending-release)_
+- [Runtime configuration surfaces](https://uselifecycle.com/docs/operations/configuration.md): Select a supported UI, API, Helm, or repository configuration surface and verify each change. _(audience: platform-operator, administrator; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
+- [Security boundaries](https://uselifecycle.com/docs/operations/security.md): Understand Lifecycle authentication, network, Kubernetes, secret, and Agent boundaries before other networks can reach a deployment. _(audience: platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
 - [Monitor Lifecycle](https://uselifecycle.com/docs/operations/monitoring.md): Interpret health endpoints, verify end-to-end operation, and collect safe diagnostic data for stuck work. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Day-two operations](https://uselifecycle.com/docs/operations/day-two.md): Plan Lifecycle upgrades, backups, rollback decisions, recovery validation, and uninstall. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 
 ## Releases and compatibility
 
 - [Releases](https://uselifecycle.com/docs/releases.md): Find your installed Lifecycle versions and the release information for an upgrade. _(audience: platform-operator, application-developer; last verified: 2026-08-01; baseline: 2026-08-01-adopt-lifecycle-mcp-browser-validation)_
-- [Compatibility and deprecation policy](https://uselifecycle.com/docs/releases/compatibility.md): Select compatible Lifecycle components and prepare a safe upgrade or rollback. _(audience: platform-operator, application-developer; last verified: 2026-09-22; baseline: 2026-09-22-sites-stable-url-pending-release)_
+- [Compatibility and deprecation policy](https://uselifecycle.com/docs/releases/compatibility.md): Select compatible Lifecycle components and prepare a safe upgrade or rollback. _(audience: platform-operator, application-developer; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
 
 ## Troubleshooting
 
diff --git a/src/pages/docs/api-authentication/api-keys.mdx b/src/pages/docs/api-authentication/api-keys.mdx
index 806a4cf..829768b 100644
--- a/src/pages/docs/api-authentication/api-keys.mdx
+++ b/src/pages/docs/api-authentication/api-keys.mdx
@@ -4,8 +4,8 @@ description: Create, scope, use, rotate, and revoke personal or service API keys
 audience:
   - api-user
   - administrator
-lastVerified: "2026-09-15"
-verificationBaseline: "2026-09-15-sites-rollout-pending-release"
+lastVerified: "2026-09-22"
+verificationBaseline: "2026-09-22-sites-access-control-released"
 contentProfile: asd-ste100
 tags:
   - api
@@ -78,10 +78,6 @@ grant `sites:read`.
 
 ## Sites access with API keys
 
-<Callout type="warning">
-  The following Sites access controls are pending release.
-</Callout>
-
 `sites:read` permits public reads and reads of sites owned by the caller.
 `sites:write` also permits creation and changes to owned sites, including visibility changes.
 Scopes do not grant access to another user's private site.
diff --git a/src/pages/docs/features/cli.mdx b/src/pages/docs/features/cli.mdx
index 8e97f0c..1def2b0 100644
--- a/src/pages/docs/features/cli.mdx
+++ b/src/pages/docs/features/cli.mdx
@@ -5,7 +5,7 @@ audience:
   - application-developer
   - platform-operator
 lastVerified: "2026-09-22"
-verificationBaseline: "2026-09-22-sites-stable-url-pending-release"
+verificationBaseline: "2026-09-22-sites-access-control-released"
 contentProfile: asd-ste100
 tags:
   - cli
@@ -222,11 +222,6 @@ each field. Exit code `3` means that the CLI did not find a configuration file.
 
 ### Static sites
 
-<Callout type="warning">
-  Sites visibility controls are pending release and require compatible server
-  and CLI versions.
-</Callout>
-
 User uploads default to private.
 Public uploads require confirmation when you specify `--visibility public`.
 Only the owner can change a site.
diff --git a/src/pages/docs/features/mcp-server.mdx b/src/pages/docs/features/mcp-server.mdx
index 782d7de..faa15bd 100644
--- a/src/pages/docs/features/mcp-server.mdx
+++ b/src/pages/docs/features/mcp-server.mdx
@@ -5,8 +5,8 @@ audience:
   - agent-user
   - administrator
   - platform-operator
-lastVerified: "2026-09-14"
-verificationBaseline: "2026-09-14-sites-pending-release"
+lastVerified: "2026-09-22"
+verificationBaseline: "2026-09-22-sites-access-control-released"
 contentProfile: asd-ste100
 tags:
   - mcp
@@ -91,10 +91,9 @@ When Sites is enabled, these tools are available:
 | `get_site`   | Gets one visible Site |
 
 <Callout type="info">
-  Sites access control is pending release. With compatible components, these
-  tools return the user's private sites and public sites. `mineOnly` selects
-  ownership rather than creator or updater email. Sites tools provide read
-  access only.
+  These tools return the user's private sites and public sites. `mineOnly`
+  selects ownership rather than creator or updater email. Sites tools provide
+  read access only.
 </Callout>
 
 Results include visibility and `openUrl`.
diff --git a/src/pages/docs/features/sites.mdx b/src/pages/docs/features/sites.mdx
index b9be3c5..d83c6ab 100644
--- a/src/pages/docs/features/sites.mdx
+++ b/src/pages/docs/features/sites.mdx
@@ -5,7 +5,7 @@ audience:
   - application-developer
   - platform-operator
 lastVerified: "2026-09-22"
-verificationBaseline: "2026-09-22-sites-stable-url-pending-release"
+verificationBaseline: "2026-09-22-sites-access-control-released"
 contentProfile: asd-ste100
 tags:
   - sites
@@ -14,18 +14,9 @@ tags:
   - api
 ---
 
-import { Callout } from "nextra/components";
-
 Sites hosts static HTML files and ZIP archives for reports, prototypes, and documentation previews.
 A server-side application is not necessary.
 
-<Callout type="warning">
-  Private Sites and the access controls on this page are pending release.
-  Compatible API, gateway, UI, CLI, and chart versions are required. Existing
-  releases do not provide these access controls.
-</Callout>
-
-For upgrade requirements, see [Sites compatibility](/docs/releases/compatibility#sites-access-control-pending-release).
 Sites requires storage, gateway, DNS, TLS, and authentication configuration.
 If **Sites** is unavailable, contact your deployment owner.
 
@@ -39,12 +30,12 @@ Administrator access does not give ownership rights.
 A public site lets anyone with its URL read its content without signing in.
 Other users cannot change it.
 Public content can contain copies that remain outside Lifecycle after you make the site private.
-Email invitations and viewer or editor roles are not available in this release.
+Email invitations and viewer or editor roles are not available.
 
-During migration, existing sites remain public.
+Sites that existed before ownership tracking was added remain public.
 These sites have no assigned owner and are read-only through normal user controls.
 For an unassigned site or a site owned by a retired service key, contact your platform operator.
-This release has no ownership transfer or recovery UI or API.
+There is no ownership transfer or recovery UI or API.
 
 ## Upload from the UI
 
@@ -119,7 +110,7 @@ If content stops loading after access expires, reopen the stable Site link.
 A valid user session can obtain access again after an ownership check.
 
 Ordinary UI logout does not immediately revoke issued access.
-This release does not guarantee a fixed five-minute cutoff measured from logout.
+There is no guaranteed fixed cutoff measured from logout.
 An unrelated signed-in user cannot open your private site.
 
 ## Private content compatibility
diff --git a/src/pages/docs/operations/configuration.mdx b/src/pages/docs/operations/configuration.mdx
index a0f2f56..62fdb55 100644
--- a/src/pages/docs/operations/configuration.mdx
+++ b/src/pages/docs/operations/configuration.mdx
@@ -5,7 +5,7 @@ audience:
   - platform-operator
   - administrator
 lastVerified: "2026-09-22"
-verificationBaseline: "2026-09-22-sites-stable-url-pending-release"
+verificationBaseline: "2026-09-22-sites-access-control-released"
 contentProfile: asd-ste100
 tags:
   - operator
@@ -49,11 +49,9 @@ For a supported change:
 Do not restart all components unless the applicable procedure tells you to do
 so.
 
-## Sites configuration pending release
+## Sites configuration
 
-Private Sites requires compatible components and additional operator configuration.
-The currently documented installation pin does not establish support for this feature.
-See [Sites upgrade requirements](/docs/releases/compatibility#sites-access-control-pending-release).
+Private Sites requires additional operator configuration.
 
 Administrators manage upload limits through `GET /api/v2/config/sites` and `PUT /api/v2/config/sites`.
 Ordinary Sites clients use `GET /api/v2/sites/capabilities` for upload limits and allowed visibility.
@@ -83,7 +81,7 @@ After expiry, reopen the stable Site link to obtain access with a valid user ses
 An existing Site cookie cannot renew itself.
 If Redis is unavailable, restore it before retrying private access.
 
-## Sites directory release prerequisite
+## Sites identity configuration
 
 Sites reuses the existing read-only identity client configured under `keycloak.clients.lifecycleApiPrincipalSync`.
 The chart supplies that client to worker and web workloads.
@@ -116,7 +114,7 @@ Revoke the offline grant to terminate that client's offline access.
 Existing Site browser grants remain valid until their own expiry, subject to current Site ownership, access state, and availability.
 Ordinary UI logout does not immediately revoke issued JWTs or Site browser grants.
 A valid authenticated session can obtain another grant after fresh authorization.
-This release does not guarantee a fixed five-minute cutoff measured from logout.
+There is no guaranteed fixed cutoff measured from logout.
 
 Private asset requests use the Site grant and current Site state.
 They do not contact Keycloak for each asset.
diff --git a/src/pages/docs/operations/security.mdx b/src/pages/docs/operations/security.mdx
index 41d5303..d890e1b 100644
--- a/src/pages/docs/operations/security.mdx
+++ b/src/pages/docs/operations/security.mdx
@@ -4,7 +4,7 @@ description: Understand Lifecycle authentication, network, Kubernetes, secret, a
 audience:
   - platform-operator
 lastVerified: "2026-09-22"
-verificationBaseline: "2026-09-22-sites-stable-url-pending-release"
+verificationBaseline: "2026-09-22-sites-access-control-released"
 contentProfile: asd-ste100
 tags:
   - operator
@@ -49,9 +49,8 @@ and user synchronization.
 | Agents and MCP  | Tool permissions, approvals, external connections, workspace egress, and session review expand the trust boundary. |
 | Backups         | Recovery must include database, key material, and object storage together.                                         |
 
-## Private Sites pending release
+## Private Sites
 
-Sites access controls require the compatible release described in [Sites compatibility](/docs/releases/compatibility#sites-access-control-pending-release).
 Sites management requires authentication even on an authentication-disabled deployment.
 Disabling authentication does not expose private site content.
 Public site content remains readable without signing in.
@@ -76,7 +75,7 @@ Private asset requests do not contact Keycloak for each file.
 
 Protect Redis access.
 Missing authorization records prevent private access.
-See [Sites configuration](/docs/operations/configuration#sites-configuration-pending-release) for dependency requirements.
+See [Sites configuration](/docs/operations/configuration#sites-configuration) for dependency requirements.
 
 Private content blocks Web Workers, SharedWorkers, new service workers, and display inside an iframe.
 Applications that require these features need a compatible site build.
@@ -86,7 +85,7 @@ For sensitive content, create a new private site instead of making that public s
 Ordinary UI logout does not immediately revoke issued JWTs or Site browser grants.
 An existing grant can remain valid until expiry.
 A valid user session can obtain another grant after fresh authorization.
-This release does not guarantee a fixed five-minute cutoff measured from logout.
+There is no guaranteed fixed cutoff measured from logout.
 Previously displayed or downloaded content can remain on the device.
 Making a public site private cannot remove copies that other users already obtained.
 
diff --git a/src/pages/docs/releases/compatibility.mdx b/src/pages/docs/releases/compatibility.mdx
index 14912e5..39a3388 100644
--- a/src/pages/docs/releases/compatibility.mdx
+++ b/src/pages/docs/releases/compatibility.mdx
@@ -5,7 +5,7 @@ audience:
   - platform-operator
   - application-developer
 lastVerified: "2026-09-22"
-verificationBaseline: "2026-09-22-sites-stable-url-pending-release"
+verificationBaseline: "2026-09-22-sites-access-control-released"
 contentProfile: asd-ste100
 tags:
   - release
@@ -36,22 +36,21 @@ version matrix, deprecation window, and rollback guarantee are not available.
 5. Test the upgrade with representative data and enabled features.
 6. Test the documented rollback or restore checkpoint.
 
-## Sites access control pending release
+## Sites access control upgrade
 
-Private Sites is pending release.
-A compatible released version set and production acceptance are not yet established.
-The installation example's chart pin does not establish private Sites support.
+Private Sites requires matched API, gateway, UI, CLI, and chart versions.
+An older component does not enforce the access-control checks that a newer one expects.
 
 The migration preserves existing sites as public.
 Those sites have no assigned owner and cannot be changed through normal user controls.
 New user uploads default to private.
 Service-key uploads remain public and belong to the exact creating key.
-Email sharing and viewer or editor roles are outside this release.
+Email invitations and viewer or editor roles are not available.
 
 First, test the matched release in an isolated deployment:
 
-1. Prepare the [Sites configuration](/docs/operations/configuration#sites-configuration-pending-release).
-2. Complete the [directory checks](/docs/operations/configuration#sites-directory-release-prerequisite).
+1. Prepare the [Sites configuration](/docs/operations/configuration#sites-configuration).
+2. Complete the [identity checks](/docs/operations/configuration#sites-identity-configuration).
 3. Enable Sites through its existing core configuration setting.
 4. Test owner access, unrelated-user denial, publication, privatization, expiration, deletion, and logout.
 5. Verify that disabled users and revoked tokens cannot obtain new private access grants.
diff --git a/src/pages/docs/setup/install-lifecycle.mdx b/src/pages/docs/setup/install-lifecycle.mdx
index db33126..126a77b 100644
--- a/src/pages/docs/setup/install-lifecycle.mdx
+++ b/src/pages/docs/setup/install-lifecycle.mdx
@@ -4,8 +4,8 @@ description: Select the OpenTofu-managed or standalone Helm installation path. M
 audience:
   - evaluator
   - platform-operator
-lastVerified: "2026-09-15"
-verificationBaseline: "2026-09-15-sites-rollout-pending-release"
+lastVerified: "2026-09-22"
+verificationBaseline: "2026-09-22-sites-access-control-released"
 contentProfile: asd-ste100
 tags:
   - lifecycle
@@ -158,9 +158,7 @@ monitoring](/docs/operations/monitoring) rather than continuing setup.
 
 ## Prepare private Sites
 
-Private Sites access control is pending release.
-The chart version pinned above does not establish support for this feature.
-Before any upgraded core image starts, follow [Sites compatibility](/docs/releases/compatibility#sites-access-control-pending-release) and [Sites configuration](/docs/operations/configuration#sites-configuration-pending-release).
+Before you enable Sites, follow [Sites compatibility](/docs/releases/compatibility#sites-access-control-upgrade) and [Sites configuration](/docs/operations/configuration#sites-configuration).
 
 Use a separate registrable domain for Sites content and trusted HTTPS certificates.
 Keep Sites storage private.

From a57f299832adb6f2d2ed4d85776f0971970104b4 Mon Sep 17 00:00:00 2001
From: Vigneshraj Sekar Babu <vignesh.raj47@gmail.com>
Date: Wed, 23 Sep 2026 10:58:19 -0700
Subject: [PATCH 9/9] docs(sites): apply Google style guide to touched pages,
 drop dead upgrade runbook

Restructure the Sites-related pages reviewed this pass for scannability
(tables/lists over dense prose, subheadings on operations/security.mdx's
Private Sites section) and fix a stale cross-reference left over from the
prior pass. Remove releases/compatibility.mdx's Sites access-control
upgrade/downgrade runbook entirely -- GoodRx is the only current deployment
and has already completed this migration, and any future install gets
Sites ACL as the default, so the runbook has no real reader. Also drop
setup/install-lifecycle.mdx's "Prepare private Sites" section, since Sites
setup is optional and not part of a first install.
---
 documentation-style-baseline.json             |  22 ++--
 public/llms.txt                               |  10 +-
 .../docs/api-authentication/api-keys.mdx      |  26 ++---
 src/pages/docs/features/sites.mdx             |  44 ++++----
 src/pages/docs/operations/security.mdx        |  32 ++++--
 src/pages/docs/releases/compatibility.mdx     | 104 +-----------------
 src/pages/docs/setup/install-lifecycle.mdx    |  10 +-
 7 files changed, 76 insertions(+), 172 deletions(-)

diff --git a/documentation-style-baseline.json b/documentation-style-baseline.json
index e5d5119..95c3247 100644
--- a/documentation-style-baseline.json
+++ b/documentation-style-baseline.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 3,
-  "updatedOn": "2026-09-22",
+  "updatedOn": "2026-09-23",
   "references": {
     "canonical": "ASD-STE100 Issue 9",
     "canonicalRules": [
@@ -69,8 +69,8 @@
     "/docs/api-authentication/api-keys": {
       "file": "src/pages/docs/api-authentication/api-keys.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-09-22",
-      "sha256": "d26dc85ca89bf2fea22cb1b71994e64e7106375badc4605cd269c843e528c1a1"
+      "reviewedOn": "2026-09-23",
+      "sha256": "6ab98c32c5f8ebf35d609cdb62d6d67820fbaa6cc9ece818537948ab86eb4aa6"
     },
     "/docs/api-authentication/overview": {
       "file": "src/pages/docs/api-authentication/overview.mdx",
@@ -201,8 +201,8 @@
     "/docs/features/sites": {
       "file": "src/pages/docs/features/sites.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-09-22",
-      "sha256": "6005f5d24aa14e604c0387568099d79cbc321e423f750edc59372fbf40eab773"
+      "reviewedOn": "2026-09-23",
+      "sha256": "7a1bbdb4b545c7fcba428fc4f4eaa336ee6f556916ee4cb9f2371203cdfaf1e8"
     },
     "/docs/features/template-variables": {
       "file": "src/pages/docs/features/template-variables.mdx",
@@ -291,8 +291,8 @@
     "/docs/operations/security": {
       "file": "src/pages/docs/operations/security.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-09-22",
-      "sha256": "96b4850da7e8fb65f5e7de8ddeeedf6fb4e409a2d67814f6a8453af4a674bf92"
+      "reviewedOn": "2026-09-23",
+      "sha256": "0d56688220d7f4a802d79f085237ae6f8b9d57ec5e7566bc3e650ac401583b4d"
     },
     "/docs/reference/statuses": {
       "file": "src/pages/docs/reference/statuses.mdx",
@@ -309,8 +309,8 @@
     "/docs/releases/compatibility": {
       "file": "src/pages/docs/releases/compatibility.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-09-22",
-      "sha256": "1f7e3d9d575e9f402afff84ede1c143bc40ffc879b7247470b92dc94ce1338d9"
+      "reviewedOn": "2026-09-23",
+      "sha256": "1901b9d61ca33af98a41c41382624e7c07607c6cbaffb112e71718c3e17bbb1f"
     },
     "/docs/schema/aurora-restore": {
       "file": "src/pages/docs/schema/aurora-restore.mdx",
@@ -387,8 +387,8 @@
     "/docs/setup/install-lifecycle": {
       "file": "src/pages/docs/setup/install-lifecycle.mdx",
       "profile": "asd-ste100",
-      "reviewedOn": "2026-09-22",
-      "sha256": "db86fea5d5f8521bc86e049fba7a157a1e6be1198cca3839efb686083445dcfa"
+      "reviewedOn": "2026-09-23",
+      "sha256": "675a15ac05fef8f53b5cd2e177eb24b1fac1f745e5189ae6d8fc3133d9580a0c"
     },
     "/docs/setup/prerequisites": {
       "file": "src/pages/docs/setup/prerequisites.mdx",
diff --git a/public/llms.txt b/public/llms.txt
index 80551ad..f8fb8f8 100644
--- a/public/llms.txt
+++ b/public/llms.txt
@@ -32,7 +32,7 @@ This index is generated from the human documentation. Follow the linked page for
 - [Cloud secrets](https://uselifecycle.com/docs/features/secrets.md): Reference External Secrets Operator values from Lifecycle Services and native Helm deployments. _(audience: application-developer, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Environment expiration and cleanup](https://uselifecycle.com/docs/features/environment-ttl.md): Understand how Lifecycle cleans up pull-request environments and expires API-created environments. _(audience: application-developer, platform-operator, administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [API-created Environments](https://uselifecycle.com/docs/features/api-environments.md): Create branch-based Lifecycle Environments without a pull request. Then, track, extend, redeploy, or tear them down. _(audience: api-user, application-developer; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Sites](https://uselifecycle.com/docs/features/sites.md): Upload and manage static HTML sites through Lifecycle's UI, CLI, or authenticated v2 API. _(audience: application-developer, platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
+- [Sites](https://uselifecycle.com/docs/features/sites.md): Upload and manage static HTML sites through Lifecycle's UI, CLI, or authenticated v2 API. _(audience: application-developer, platform-operator; last verified: 2026-09-23; baseline: 2026-09-22-sites-access-control-released)_
 - [Lifecycle Agent](https://uselifecycle.com/docs/features/ai-agent.md): Investigate a Lifecycle Environment, examine evidence, and do approved recovery tasks from the Environment details page. _(audience: agent-user; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Configure Lifecycle Agent](https://uselifecycle.com/docs/features/ai-agent-configuration.md): Configure models, instructions, tools, approvals, and repository overrides for Lifecycle Agent from Settings. _(audience: administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Agent Sessions](https://uselifecycle.com/docs/features/agent-sessions.md): Start, examine, and continue repository work with Lifecycle Agent in an isolated workspace. _(audience: agent-user; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
@@ -47,7 +47,7 @@ This index is generated from the human documentation. Follow the linked page for
 ## API authentication
 
 - [API authentication](https://uselifecycle.com/docs/api-authentication/overview.md): Select a supported authentication method for Lifecycle v2 API requests and understand typical authorization failures. _(audience: api-user, administrator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [API keys](https://uselifecycle.com/docs/api-authentication/api-keys.md): Create, scope, use, rotate, and revoke personal or service API keys for authenticated Lifecycle v2 requests. _(audience: api-user, administrator; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
+- [API keys](https://uselifecycle.com/docs/api-authentication/api-keys.md): Create, scope, use, rotate, and revoke personal or service API keys for authenticated Lifecycle v2 requests. _(audience: api-user, administrator; last verified: 2026-09-23; baseline: 2026-09-22-sites-access-control-released)_
 
 ## HTTP API
 
@@ -74,7 +74,7 @@ This index is generated from the human documentation. Follow the linked page for
 
 - [Starter infrastructure prerequisites](https://uselifecycle.com/docs/setup/prerequisites.md): Prepare cloud, DNS, domain, and command-line access for the starter OpenTofu evaluation path. _(audience: evaluator, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Set up an evaluation cluster](https://uselifecycle.com/docs/setup/setup-infra.md): Provision starter GKE or EKS infrastructure, DNS, dependencies, and Lifecycle for evaluation. _(audience: evaluator, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
-- [Install Lifecycle](https://uselifecycle.com/docs/setup/install-lifecycle.md): Select the OpenTofu-managed or standalone Helm installation path. Make sure that the API, UI, identity, and cluster are healthy. _(audience: evaluator, platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
+- [Install Lifecycle](https://uselifecycle.com/docs/setup/install-lifecycle.md): Select the OpenTofu-managed or standalone Helm installation path. Make sure that the API, UI, identity, and cluster are healthy. _(audience: evaluator, platform-operator; last verified: 2026-09-23; baseline: 2026-09-22-sites-access-control-released)_
 - [Create the GitHub App](https://uselifecycle.com/docs/setup/create-github-app.md): Create and connect a private GitHub App for Lifecycle. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Optional configuration](https://uselifecycle.com/docs/setup/configure-lifecycle.md): Apply optional installation-wide settings safely after Lifecycle is running. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 
@@ -82,14 +82,14 @@ This index is generated from the human documentation. Follow the linked page for
 
 - [Lifecycle architecture](https://uselifecycle.com/docs/operations/architecture.md): Understand how requests become Lifecycle Environments and plan dependencies, security controls, availability, and recovery. _(audience: evaluator, platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Runtime configuration surfaces](https://uselifecycle.com/docs/operations/configuration.md): Select a supported UI, API, Helm, or repository configuration surface and verify each change. _(audience: platform-operator, administrator; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
-- [Security boundaries](https://uselifecycle.com/docs/operations/security.md): Understand Lifecycle authentication, network, Kubernetes, secret, and Agent boundaries before other networks can reach a deployment. _(audience: platform-operator; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
+- [Security boundaries](https://uselifecycle.com/docs/operations/security.md): Understand Lifecycle authentication, network, Kubernetes, secret, and Agent boundaries before other networks can reach a deployment. _(audience: platform-operator; last verified: 2026-09-23; baseline: 2026-09-22-sites-access-control-released)_
 - [Monitor Lifecycle](https://uselifecycle.com/docs/operations/monitoring.md): Interpret health endpoints, verify end-to-end operation, and collect safe diagnostic data for stuck work. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 - [Day-two operations](https://uselifecycle.com/docs/operations/day-two.md): Plan Lifecycle upgrades, backups, rollback decisions, recovery validation, and uninstall. _(audience: platform-operator; last verified: 2026-07-24; baseline: 2026-07-24-comprehensive-audit)_
 
 ## Releases and compatibility
 
 - [Releases](https://uselifecycle.com/docs/releases.md): Find your installed Lifecycle versions and the release information for an upgrade. _(audience: platform-operator, application-developer; last verified: 2026-08-01; baseline: 2026-08-01-adopt-lifecycle-mcp-browser-validation)_
-- [Compatibility and deprecation policy](https://uselifecycle.com/docs/releases/compatibility.md): Select compatible Lifecycle components and prepare a safe upgrade or rollback. _(audience: platform-operator, application-developer; last verified: 2026-09-22; baseline: 2026-09-22-sites-access-control-released)_
+- [Compatibility and deprecation policy](https://uselifecycle.com/docs/releases/compatibility.md): Select compatible Lifecycle components and prepare a safe upgrade or rollback. _(audience: platform-operator, application-developer; last verified: 2026-09-23; baseline: 2026-09-22-sites-access-control-released)_
 
 ## Troubleshooting
 
diff --git a/src/pages/docs/api-authentication/api-keys.mdx b/src/pages/docs/api-authentication/api-keys.mdx
index 829768b..66c9d1c 100644
--- a/src/pages/docs/api-authentication/api-keys.mdx
+++ b/src/pages/docs/api-authentication/api-keys.mdx
@@ -4,7 +4,7 @@ description: Create, scope, use, rotate, and revoke personal or service API keys
 audience:
   - api-user
   - administrator
-lastVerified: "2026-09-22"
+lastVerified: "2026-09-23"
 verificationBaseline: "2026-09-22-sites-access-control-released"
 contentProfile: asd-ste100
 tags:
@@ -54,15 +54,15 @@ creation.
 
 Lifecycle recognizes seven scopes:
 
-| Scope         | Access                                                              |
-| ------------- | ------------------------------------------------------------------- |
-| `env:read`    | Read Environments and Builds                                        |
-| `env:write`   | Create or change Environments and Builds. Also satisfies `env:read` |
-| `sites:read`  | Read sites. `sites:write` satisfies this scope.                     |
-| `sites:write` | Upload, replace, extend, or delete sites                            |
-| `repos:read`  | Read repository information. `repos:write` satisfies this scope.    |
-| `repos:write` | Change supported repository configuration                           |
-| `env:admin`   | Legacy/reserved Environment administration                          |
+| Scope         | Access                                                               |
+| ------------- | -------------------------------------------------------------------- |
+| `env:read`    | Read Environments and Builds                                         |
+| `env:write`   | Create or change Environments and Builds. Also satisfies `env:read`. |
+| `sites:read`  | Read sites. `sites:write` satisfies this scope.                      |
+| `sites:write` | Upload, replace, extend, or delete sites                             |
+| `repos:read`  | Read repository information. `repos:write` satisfies this scope.     |
+| `repos:write` | Change supported repository configuration                            |
+| `env:admin`   | Legacy/reserved Environment administration                           |
 
 New keys can request only the first six scopes. A legacy service key can keep
 `env:admin`. You cannot grant this scope to a new key.
@@ -84,15 +84,15 @@ Scopes do not grant access to another user's private site.
 Administrator status does not override ownership.
 
 A personal key uses its user's ownership and defaults to private uploads.
-After migration, older personal keys without the required identity binding cannot access Sites.
-Create replacement personal keys through your signed-in account.
+An older personal key without an identity binding cannot access Sites.
+Create a replacement personal key through your signed-in account.
 
 Service keys create public sites only.
 Each service key owns only the sites created with that exact key.
 A replacement service key does not inherit site ownership.
 Before you retire a service key that owns sites, contact your platform operator.
 Revoked or expired keys cannot manage their sites.
-For sites with retired keys, see [Sites ownership limitations](/docs/features/sites#choose-who-can-access-a-site).
+For sites with retired keys, see [Sites troubleshooting](/docs/features/sites#troubleshooting).
 
 Keep API keys in authorization headers.
 Do not put API keys in site content or URLs.
diff --git a/src/pages/docs/features/sites.mdx b/src/pages/docs/features/sites.mdx
index d83c6ab..49ada49 100644
--- a/src/pages/docs/features/sites.mdx
+++ b/src/pages/docs/features/sites.mdx
@@ -4,7 +4,7 @@ description: Upload and manage static HTML sites through Lifecycle's UI, CLI, or
 audience:
   - application-developer
   - platform-operator
-lastVerified: "2026-09-22"
+lastVerified: "2026-09-23"
 verificationBaseline: "2026-09-22-sites-access-control-released"
 contentProfile: asd-ste100
 tags:
@@ -14,28 +14,29 @@ tags:
   - api
 ---
 
+import { Callout } from "nextra/components";
+
 Sites hosts static HTML files and ZIP archives for reports, prototypes, and documentation previews.
 A server-side application is not necessary.
 
-Sites requires storage, gateway, DNS, TLS, and authentication configuration.
-If **Sites** is unavailable, contact your deployment owner.
+<Callout type="warning">
+  Sites requires storage, gateway, DNS, TLS, and authentication configuration.
+  If **Sites** is unavailable, contact your platform operator.
+</Callout>
 
 ## Choose who can access a site
 
 New sites from your user account are private by default.
-Only the owner can view a private site.
-The owner can replace content, extend expiration, delete the site, or change visibility.
 Administrator access does not give ownership rights.
 
-A public site lets anyone with its URL read its content without signing in.
-Other users cannot change it.
-Public content can contain copies that remain outside Lifecycle after you make the site private.
-Email invitations and viewer or editor roles are not available.
+| Visibility        | Who can view it                         | Who can change it |
+| ----------------- | --------------------------------------- | ----------------- |
+| Private (default) | Only the owner                          | Only the owner    |
+| Public            | Anyone with the URL, without signing in | Only the owner    |
 
-Sites that existed before ownership tracking was added remain public.
-These sites have no assigned owner and are read-only through normal user controls.
-For an unassigned site or a site owned by a retired service key, contact your platform operator.
-There is no ownership transfer or recovery UI or API.
+The owner can replace content, extend expiration, delete the site, or change visibility.
+Public content can contain copies that remain outside Lifecycle after you make the site private.
+Sites has no email invitations or viewer or editor roles.
 
 ## Upload from the UI
 
@@ -181,11 +182,12 @@ See [API overview](/docs/api/overview) and [API keys](/docs/api-authentication/a
 
 ## Troubleshooting
 
-| Symptom                       | Action                                                                                 |
-| ----------------------------- | -------------------------------------------------------------------------------------- |
-| Private upload is unavailable | Ask the operator to check private Sites readiness.                                     |
-| Upload is rejected            | Compare the entry file, extensions, counts, and sizes with the returned upload policy. |
-| A private URL does not open   | Sign in as the owner through the site's opening URL.                                   |
-| A site returns 404            | Check its current URL, visibility, and expiration through an authorized account.       |
-| Assets return 404             | Rebuild with relative paths or the current content base URL.                           |
-| A change returns 409          | Fetch current site details before you retry the intended change.                       |
+| Symptom                       | Action                                                                                        |
+| ----------------------------- | --------------------------------------------------------------------------------------------- |
+| Private upload is unavailable | Ask the operator to check private Sites readiness.                                            |
+| Upload is rejected            | Compare the entry file, extensions, counts, and sizes with the returned upload policy.        |
+| A private URL does not open   | Sign in as the owner through the site's opening URL.                                          |
+| A site returns 404            | Check its current URL, visibility, and expiration through an authorized account.              |
+| A site has no assigned owner  | Contact your platform operator. Lifecycle has no self-service ownership transfer or recovery. |
+| Assets return 404             | Rebuild with relative paths or the current content base URL.                                  |
+| A change returns 409          | Fetch current site details before you retry the intended change.                              |
diff --git a/src/pages/docs/operations/security.mdx b/src/pages/docs/operations/security.mdx
index d890e1b..7f1f1e4 100644
--- a/src/pages/docs/operations/security.mdx
+++ b/src/pages/docs/operations/security.mdx
@@ -3,7 +3,7 @@ title: Security boundaries
 description: Understand Lifecycle authentication, network, Kubernetes, secret, and Agent boundaries before other networks can reach a deployment.
 audience:
   - platform-operator
-lastVerified: "2026-09-22"
+lastVerified: "2026-09-23"
 verificationBaseline: "2026-09-22-sites-access-control-released"
 contentProfile: asd-ste100
 tags:
@@ -55,17 +55,28 @@ Sites management requires authentication even on an authentication-disabled depl
 Disabling authentication does not expose private site content.
 Public site content remains readable without signing in.
 
+### Content domain
+
 Use HTTPS for both the Lifecycle UI and Sites content.
 A separate registrable content domain gives stronger isolation from the UI.
 For example, `ui.example.com` and `report.example.net` use separate domains.
 Internal deployments can use sibling hosts by setting `SITES_ALLOW_SHARED_APEX=true` on both web and gateway.
 This opt-in keeps the two hosts on the same browser site and does not provide separate-domain isolation.
 
+### Storage and routing
+
 Keep object storage private and inaccessible through public bucket URLs.
 Route every content request through the authorization-capable gateway.
 Do not cache private content or serve it through an older gateway.
 A private site's content requires its owner and a valid browser session.
-A copied URL, administrator role, or unrelated API key does not grant access.
+
+None of these grant access on their own:
+
+- A copied URL
+- An administrator role
+- An unrelated API key
+
+### How access grants work
 
 Core verifies the user's JWT, identity status, and Site ownership before issuing browser access.
 The browser receives Site-only access that expires within five minutes and no later than the authorizing JWT.
@@ -77,18 +88,19 @@ Protect Redis access.
 Missing authorization records prevent private access.
 See [Sites configuration](/docs/operations/configuration#sites-configuration) for dependency requirements.
 
-Private content blocks Web Workers, SharedWorkers, new service workers, and display inside an iframe.
+### Browser compatibility
+
+Private content blocks the following:
+
+- Web Workers
+- SharedWorkers
+- New service workers
+- Display inside an iframe
+
 Applications that require these features need a compatible site build.
 An existing service worker from a public version of the same site can remain in a visitor's browser.
 For sensitive content, create a new private site instead of making that public site private.
 
-Ordinary UI logout does not immediately revoke issued JWTs or Site browser grants.
-An existing grant can remain valid until expiry.
-A valid user session can obtain another grant after fresh authorization.
-There is no guaranteed fixed cutoff measured from logout.
-Previously displayed or downloaded content can remain on the device.
-Making a public site private cannot remove copies that other users already obtained.
-
 ## Vulnerability reporting
 
 No private vulnerability-reporting channel is published. Do not post suspected
diff --git a/src/pages/docs/releases/compatibility.mdx b/src/pages/docs/releases/compatibility.mdx
index 39a3388..6ca197f 100644
--- a/src/pages/docs/releases/compatibility.mdx
+++ b/src/pages/docs/releases/compatibility.mdx
@@ -4,7 +4,7 @@ description: Select compatible Lifecycle components and prepare a safe upgrade o
 audience:
   - platform-operator
   - application-developer
-lastVerified: "2026-09-22"
+lastVerified: "2026-09-23"
 verificationBaseline: "2026-09-22-sites-access-control-released"
 contentProfile: asd-ste100
 tags:
@@ -36,106 +36,4 @@ version matrix, deprecation window, and rollback guarantee are not available.
 5. Test the upgrade with representative data and enabled features.
 6. Test the documented rollback or restore checkpoint.
 
-## Sites access control upgrade
-
-Private Sites requires matched API, gateway, UI, CLI, and chart versions.
-An older component does not enforce the access-control checks that a newer one expects.
-
-The migration preserves existing sites as public.
-Those sites have no assigned owner and cannot be changed through normal user controls.
-New user uploads default to private.
-Service-key uploads remain public and belong to the exact creating key.
-Email invitations and viewer or editor roles are not available.
-
-First, test the matched release in an isolated deployment:
-
-1. Prepare the [Sites configuration](/docs/operations/configuration#sites-configuration).
-2. Complete the [identity checks](/docs/operations/configuration#sites-identity-configuration).
-3. Enable Sites through its existing core configuration setting.
-4. Test owner access, unrelated-user denial, publication, privatization, expiration, deletion, and logout.
-5. Verify that disabled users and revoked tokens cannot obtain new private access grants.
-   Verify that existing browser grants expire within five minutes and no later than their authorizing JWTs.
-6. After privatization, verify that the old content hostname stops serving content.
-
-For production, schedule a maintenance window:
-
-1. Back up the database, private object storage, configuration, and Secrets together.
-2. Before replacing workloads, configure the UI origin and existing read-only identity client.
-3. Verify that configuration.
-4. Disable Sites through its existing core configuration setting.
-5. Suspend reconcilers that could restart older workloads.
-6. Block Sites requests, including internal uploads and content requests.
-7. Drain requests.
-8. Stop every older API writer, worker, and gateway.
-9. Before any new core image starts, verify that all older instances have stopped.
-10. Start one compatible API instance.
-11. Verify migration completion.
-12. Replace every remaining API, worker, gateway, and UI instance with the compatible version.
-13. Verify directory access and denial of Sites content while Sites is disabled.
-14. Verify that no old gateway or direct bucket URL can serve content.
-15. Upgrade CLI clients.
-16. Replace personal API keys that lack identity binding.
-17. Enable Sites through core configuration while requests remain blocked.
-18. Repeat the isolated access tests through a restricted operator test path.
-19. After the tests pass, permit traffic.
-20. Resume reconcilers with the compatible configuration.
-
-Core startup runs the migration even when Sites is disabled.
-An ordinary rolling image upgrade does not stop older writers before that migration.
-Checks with Sites disabled cannot verify authorized private access.
-
-If migration fails, keep traffic blocked.
-If access tests fail, disable Sites.
-This stops public and private Sites access.
-Keep Sites traffic blocked until access tests pass.
-Keep compatible core and gateway images, the schema, Redis, and the existing identity configuration during recovery.
-
-Older clients that fetch the configuration cache need an upgrade.
-That endpoint now requires administrator authentication.
-Sites clients must use the capabilities endpoint.
-Concurrent replacement can return `409`, including for older clients without revision fields.
-Fetch current site details before you retry a change.
-
-If private Sites must stay private, keep the access-control schema and a compatible gateway.
-Disable Sites while you fix the release.
-This preserves private status and denies all Sites content access.
-
-The Sites access-control migration also supports an intentional full downgrade.
-An older gateway serves active, unexpired Site content without an ownership check.
-The same content URL becomes public after a full downgrade.
-The downgrade removes visibility, owner identity, creator-key identity, revision fields, and personal-key issuer binding.
-
-It keeps Site rows, Site versions, and stored files.
-After a later upgrade, every surviving Site becomes public and unassigned.
-Personal API keys must be replaced before they can manage Sites again.
-
-For a full downgrade:
-
-1. Confirm that making all active Site content public and losing ownership metadata is acceptable.
-2. Back up the database and Site object storage together.
-3. Block Site uploads and content requests.
-4. Stop all core API, worker, and gateway instances.
-5. Stop reconcilers that could restart a new core instance.
-6. Verify that `035_sites_access_control.ts` is the latest applied migration.
-7. Start a one-off maintenance container with the candidate core image and database configuration.
-8. Bypass its normal startup command.
-9. Run this targeted migration command once:
-
-   ```bash
-   pnpm exec tsx node_modules/knex/bin/cli.js migrate:down 035_sites_access_control.ts
-   ```
-
-10. Verify that the migration completed and Site and version counts did not change.
-11. Deploy the matching older core, gateway, UI, and CLI versions.
-12. Before you permit Site traffic again, verify the expected public access.
-
-Do not use `pnpm db:rollback` for this step. It reverses an entire migration batch, which can contain other changes.
-Do not start a new core image after the down migration. Its startup would apply the migration again.
-
-For a UI rollback, retain compatible sign-in and site-opening behavior.
-Otherwise, disable Sites before the UI rollback.
-Verify that private content is unavailable before you replace the UI.
-Use the privacy-preserving recovery path or the intentional full downgrade above.
-You can also restore the complete pre-upgrade backup in isolation.
-
 Use [Day-two operations](/docs/operations/day-two) for the full procedure.
diff --git a/src/pages/docs/setup/install-lifecycle.mdx b/src/pages/docs/setup/install-lifecycle.mdx
index 126a77b..5bfae18 100644
--- a/src/pages/docs/setup/install-lifecycle.mdx
+++ b/src/pages/docs/setup/install-lifecycle.mdx
@@ -4,7 +4,7 @@ description: Select the OpenTofu-managed or standalone Helm installation path. M
 audience:
   - evaluator
   - platform-operator
-lastVerified: "2026-09-22"
+lastVerified: "2026-09-23"
 verificationBaseline: "2026-09-22-sites-access-control-released"
 contentProfile: asd-ste100
 tags:
@@ -156,14 +156,6 @@ See [Authentication](/docs/features/authentication) for the full sign-in and
 security checks. If a workload is unhealthy, start with [platform
 monitoring](/docs/operations/monitoring) rather than continuing setup.
 
-## Prepare private Sites
-
-Before you enable Sites, follow [Sites compatibility](/docs/releases/compatibility#sites-access-control-upgrade) and [Sites configuration](/docs/operations/configuration#sites-configuration).
-
-Use a separate registrable domain for Sites content and trusted HTTPS certificates.
-Keep Sites storage private.
-The API, UI, identity directory, and authorization-capable gateway must pass the feature's access tests together.
-
 ## Continue setup
 
 When the API, UI, and sign-in flow are healthy: