feat: a project's record on its own GitHub Pages, and live brief sessions

.abcd/config.json

@@ -20,5 +20,8 @@
   },
   "repo": {
     "visibility": "public"
+  },
+  "sessions": {
+    "live": "local"
   }
 }

.abcd/development/brief/02-constraints/03-invariants.md

@@ -126,7 +126,13 @@ The following are non-negotiable invariants — any architectural choice that vi
    which refines adr-38 without superseding it). One package alone opens a
    listener, held by `TestOnlyTheDashboardOpensAListener`
    (`internal/surface/dashboard`); a later listener is admitted only by
-   amending that record in the open.
+   amending that record in the open. Its amendment of 2026-10-14 admits one
+   second listener, the brief session's relay (`internal/surface/session`).
+   The relay is started on purpose and listens on loopback unless an address
+   is chosen on that run. On a person's machine it is reached through
+   Tailscale Serve, never Funnel. It admits people by the host's join code
+   and by GitHub's own answer on a presented token, and it holds no project
+   content at rest.
 
 8. **Acceptance discipline applies uniformly** — every intent's press release is followed by a `## Acceptance Criteria` block in Given-When-Then format (per itd-1). Every brief phase has an `## Acceptance` block in the same format. The format is uniform across the boundary; the *home* differs to match the nature of the work. See [`01-product/03-mental-model.md`](../01-product/03-mental-model.md).
 

.abcd/development/brief/04-surfaces/01-ahoy.md

@@ -1355,6 +1355,7 @@ Sub-verbs: none.
 | `--dev` | bool |
 | `--docs-target` | string |
 | `--install-tool` | stringSlice |
+| `--live-sessions` | string |
 | `--only-waiting` | bool |
 | `--oracle-backend` | string |
 | `--outbound` | bool |

.abcd/development/brief/04-surfaces/16-lint.md

@@ -158,7 +158,7 @@ the identity target runs in no gate.
 | `decision-durability` | warn | a committed `.abcd/work/decisions/` folder, one file per decision; a repository keeping only a frozen single `DECISIONS.md` log is warned that a new decision has no folder to go to, naming the install that lays one, and its log is never asked to change; decisions not living only in the gitignored layer |
 | `docs-currency` | warn | reuses the docs-lint engine where `docs/` exists or `.abcd/docs-lint.json` does (its roots need not include `docs/`), and says so where it cannot: a repo with a `docs/` tree but no docs-lint configuration raises a warn against `.abcd/docs-lint.json`, and the docs target's refusal (a configuration that will not load, or one the engine refuses, such as a `roots` entry that does not exist) is an `error` finding against it, rather than passing quietly |
 | `privacy-hygiene` | error (network-identifier findings mapped from a scanner `warn`/`info` land as `warn`, and so do the two not-scanned findings: a file over the cap, and one that could not be opened) | three leak classes on any tracked text line: absolute local paths in committed files, real network identifiers, and the harness-leak pair the outbound policy bans everywhere (a live agent-session URL, and a tool's own "generated with" footer). The fix names reserved documentation values (RFC 5737/3849/2606/7042, or a persona-derived device name), and an `abcd-lint:allow` line waiver is honoured (the `abcd-audit:allow` spelling too). Each line is read as written and in the scanner's decoded spellings of it (`scanner.DecodedViews`: its percent and JSON-escape views), so a home path, an address or a harness-leak shape written behind an escape in a JSON fixture, export or transcript is the finding its plain spelling is; the waiver is read on the line as written, and the record/docs `harness_leak` rule reads the same spellings. The network severities come from the merged scanner configuration, so a repo that raises one in `.abcd/config/pii.json` is honoured, and an override that cannot be read is itself an `error` finding saying the scan fell back to the built-in severities. Two findings report what was *not* read rather than a leak: a tracked text file over the 4 MiB scan cap, and one that could not be opened. Binary files are skipped silently. In a repository that armed gitleaks (`.abcd/config/gitleaks.json`), each line of a tracked text file gitleaks flags is an `error` finding naming the rule, never the value; an armed gitleaks with no binary installed, or a run that fails, is an `error` finding citing that config |
-| `site-gates` | warn | where `.abcd/site.json` declares a site: renders it into a fresh temporary directory outside the repository, runs the website's gates over it (the site target's, [`22-site.md`](22-site.md)), and removes it, so the lint still writes nothing in the repository. Each gate failure is one finding, filed against the source span it names; a composition that cannot be rendered is the site target's refusal, an `error` finding against `.abcd/site.json` rather than an aborted lint. Gate failures are warn, as `docs-currency` is, because the authoritative gate is the site target's exit 1 and re-raising it as an error would double-gate one check |
+| `site-gates` | warn | where `.abcd/site.json` declares a site: renders it into a fresh temporary directory outside the repository, runs the website's gates over it (the site target's, [`22-site.md`](22-site.md)), and removes it, so the lint still writes nothing in the repository. Each gate failure is one finding, filed against the source span it names; a project site (`.abcd/site.json` in project mode) is gated on its own route; a composition that cannot be rendered is the site target's refusal, an `error` finding against `.abcd/site.json` rather than an aborted lint. Gate failures are warn, as `docs-currency` is, because the authoritative gate is the site target's exit 1 and re-raising it as an error would double-gate one check |
 | `identity-positioning` | warn | every registered surface still carries the canonical identity block's tagline (and pitch, where required), and every registered surface can still be found: a surface whose locator matches nothing is its own finding, because drift there would go unseen. A registry or identity block that cannot be read is the identity target's refusal, an `error` finding whatever the family's severity, rather than a pass. Gated on `.abcd/positioning.json` being present on disk, and per-repo upgradeable to `error` (see [`19-identity.md`](19-identity.md)) |
 
 ## How it is built
@@ -229,6 +229,8 @@ Sub-verbs: none.
 
 | Flag | Type |
 |---|---|
+| `--base-path` | string |
 | `--out` | string |
+| `--project` | bool |
 
 <!-- surface-appendix:end -->

.abcd/development/brief/04-surfaces/22-site.md

@@ -95,9 +95,63 @@ set by abcd, because the value would pass through it: the verb reads which
 secret names are present and prints the exact command for each one that is not.
 The credential is read by name through the credential store and never written
 into the repository or the report, which names only the credential's name. A second run over an unchanged repository and host
-writes nothing and says so. One provider ships, behind an adapter seam
+writes nothing and says so. Two providers ship, behind an adapter seam
 ([`05-internals/02-adapters.md`](../05-internals/02-adapters.md#hosting-providers)).
 
+## A project's own site
+
+The second provider publishes a managed repository's site on the project's own
+GitHub Pages, built by the project's own workflow at each release
+(itd-2610091010348892). Such a site renders only what abcd already writes to the
+repository, as its single source, as the product thinker ruled on 2026-10-15. A
+project's hand-written documentation is read on GitHub, and nothing is written
+for the website.
+
+So setting one up writes two files and no more: the site's settings, holding
+the publish switch and no composition, and the workflow. The interface words,
+styles, scripts and headers policy ship in the binary, and the workflow builds
+and gates with the project flag, so the repository carries no site sources.
+The landing page is an about page derived in code, from four parts in this
+order, each rendered only where the repository holds it: the identity block,
+the brief's opening (the first section of the brief skeleton,
+`01-product/01-press-release.md`), the press releases of the newest shipped
+intents whose audit was met, newest id first (a timestamped id carries when
+abcd minted it, and an ordinal one sorts before every timestamped one), and the
+release list in `CHANGELOG.md`. Without an
+identity block the page is headed and titled by the repository's name on
+GitHub. A repository holding none of the four is refused at setup and at build,
+since its site would be empty. The repository's address and name come from the
+origin remote alone, never from the package manifest, which is a person's file.
+The record pages are built exactly as for any site, from the record's lint
+configuration or, where a managed repository carries none, from abcd's standard
+layout under `.abcd/development/`. The issue ledger is always read, so an
+intent's typed link to an issue resolves, and an issue is published only where
+the settings opt in with `"record": {"issue_ledger": true}`. The references
+page and every picture are left out, because each comes from a person's own
+files rather than from what abcd writes (pictures are a later intent,
+iss-2610150529485165).
+
+A project site shows nothing read from git history either, and its build does
+not read it. Who wrote a commit, what model it declared, how many commits there
+are and when any of them landed are git's record, not abcd's, so the
+contributors page, the timeline, the health page's authorship checks and
+record.json's authorship, history and per-record git dates are all left out,
+and a record is dated by its own frontmatter alone. Whether a project site
+should show any of it is to be revisited.
+
+The project route depends on abcd's own releases: the workflow downloads abcd's
+latest release to build with, so a project site cannot build until a release of
+abcd carries the project flag. Setup states this in a note on every project
+setup, since it asks the network nothing to learn which release is latest.
+
+The gate holds the line: on a project site, a rendered span whose source file
+abcd does not write fails the site's gate, on every page, the record's own
+included, and so does a site with no title.
+Files under `.abcd/` (but the local tier) and `CHANGELOG.md` are abcd's; `docs/`,
+`README.md` and every other file are not. The build and the gate name the route
+explicitly, and refuse settings of the other shape. abcd's own composed site is
+not a project site: it renders its documentation and stays as it is.
+
 ## The page set
 
 Every repository gets the same pages: the landing page, the record explorer,
@@ -310,10 +364,12 @@ Sub-verbs: none.
 
 | Flag | Type |
 |---|---|
+| `--base-path` | string |
 | `--commit` | string |
 | `--date` | string |
 | `--out` | string |
 | `--preview` | bool |
+| `--project` | bool |
 | `--version` | string |
 
 ### `abcd site setup`
@@ -325,6 +381,8 @@ Sub-verbs: none.
 | `--confirm` | bool |
 | `--domain` | string |
 | `--name` | string |
+| `--provider` | string |
+| `--replace-existing` | bool |
 | `--yes` | bool |
 
 <!-- surface-appendix:end -->