Phase — Public landing + console access UX (Thinking freeze)

Status: Reviewed → pass (LAC-r2). Thinking is spec-only; no landing HTML/CSS, Path B chrome rewrite, README ship edits, or DNS changes land in this phase. The Landing + access clarity Auto build ({step}b) is cleared to start mechanically against this frozen contract. Do not reopen Q0 bind/auth casually. Do not claim the website executes tasks or mints session/CSRF.

phase: LANDING-ACCESS-CLARITY
outputs:
- id: landing-access-clarity
  path: docs/archive/phases/PHASE-LANDING-ACCESS-CLARITY.md
  frozen: true
frozen_inputs:
- id: k12-landing
  path: docs/archive/phases/PHASE-K12-TRACK-N-LANDING-CONTRACT.md
- id: landing-hosting
  path: docs/landing/HOSTING.md
- id: q0-overseer-app
  path: docs/archive/phases/PHASE-TRACK-Q-Q0-OVERSEER-APP.md
- id: q4a-ui-redesign
  path: docs/archive/phases/PHASE-TRACK-Q-Q4A-UI-REDESIGN.md
- id: q3-release-installers
  path: docs/archive/phases/PHASE-Q3-RELEASE-DESKTOP-INSTALLERS.md
- id: desktop-runbook
  path: docs/TRACK-Q-DESKTOP-OPERATOR-RUNBOOK.md
- id: kit-spec-freeze
  path: docs/OVERSEER-KIT-SPEC.md#6
- id: kit-boundary
  path: AGENTS.md
- id: test-tiers
  path: policy/test-tiers.yaml
- id: decision-tiers
  path: policy/tiers.yaml
- id: roadmap
  path: docs/ROADMAP.md
review_stamp:
  reviewed_at: '2026-07-14T13:53:22Z'
  verdict: pass
  reviewer_mode: agent
  reviewer_model: thinking-high
  reviewer_provider: local
  kit_version: 0.1.0
  artifact_digest: sha256:c0ac8162b8d86959c6a01c2201f8e8aa32dfff8120335bbbee4c13882235068a

Downstream edge: the Landing + access clarity Auto build treats this document as ground truth without re-deriving it (SPEC §6). K12 remains the historical Track N ship; this freeze amends public IA / CTAs / HOSTING honesty for the pre-public gate. Q0 bind + Bearer/CSRF rules stay closed except the narrow api/health additive in §LAC.6.3. Q4a/Q4b Structure diagrams are the SVG source of truth for offline embeds.

Review record (§6.2): every freeze-review finding MUST cite file+line per SPEC §6; uncited findings are invalid and are discarded. Fixes applied during the loop are Tier 1 (feature branch); merge to main, DNS cutover, and live capability flips are Tier 3 and are never part of this loop.

Round	Reviewer	Verdict	Resolution
LAC-r1	Freeze-review (checklist + thinking, thinking-high)	findings	R1-M1 Path 1 step underspecified: installed .dmg defaults repo_root to bundled kit unless OVERSEER_REPO_ROOT is set (no folder picker). R1-M2 Q0 api/health “liveness only” wording needs explicit amendment cite for repo_root. R1-M3 Primary CTA arch label must say Apple Silicon (aarch64) only. R1-C4 CLI blocked on releases/latest absolute-path false positive (leading slash). R1-N1 Auto must not invent GUI repo picker. No true escalation.
LAC-r1 fix	Author (cited items only)	—	R1-M1/N1 Path 1 + §LAC.7 bind honesty + rejection row. R1-M2 §LAC.6.3 Q0 health amendment. R1-M3 CTA labels. R1-C4 rephrased releases/latest.
LAC-r2	Freeze-review (checklist + thinking, thinking-high)	pass	CLI checklist gate clean (0 findings, dry-run). Semantic re-read confirmed R1 RESOLVED: IA §LAC.3 amends K12; offline SVG embed; Download href frozen to signed v0.1.0 .dmg; Paths 1–3 + Path B chrome; OVERSEER_REPO_ROOT honesty; narrow health repo_root only; domain apex static-only; pre-public DNS gate; rejection table; seven-tier §LAC.12; no security/irreversible/real_money/gates_tier3 escalation. Stamp written by ok review --freeze.

---

§LAC.0 — Simple summary

Visitors need a professional front door that shows how Overseer Kit is structured at a glance, and operators need an obvious way to open the local governance console. A signed Mac installer now exists on GitHub Release v0.1.0; browser Path B still needs paste-from-terminal; the public site must not pretend to be the live app.

This freeze locks: public landing information architecture + visual direction; offline structure flowcharts on the main page; suite doors + Download / clone CTAs; a single “Open the local console” playbook (README + landing + Path B Overview); Path B chrome clarity (bound repo, collapse bootstrap, tab explainers, Status auto-refresh once); domain honesty for overseerkit.com; seven-tier matrix + Definitions of Done for Auto and for “ready to point DNS.”

Technical summary: amend docs/landing/ contract beyond K12 §K12.2 section list; copy Q4b SVGs under docs/landing/assets/diagrams/; wire primary CTA to the live signed .dmg; document Python 3.11+; authorize one additive repo_root field on GET api/health for chrome honesty; presentation-only Path B JS/HTML tweaks; extend landing validator + tests. Spec-only this phase.

---

§LAC.1 — Scope

In scope (freeze only — this phase writes no product code):

• Public site IA + visual direction (§LAC.3–§LAC.4).
• Structure flowchart embed rule (§LAC.5).
• Suite doors + CTA hierarchy (§LAC.6.1).
• Single console-access playbook Paths 1–3 (§LAC.6).
• Path B chrome UX clarity (§LAC.6.2–§LAC.6.4).
• Bound-repo honesty (§LAC.7).
• Domain / hosting map (§LAC.8).
• Pre-public DNS gate DoD (§LAC.9).
• Rejection table (§LAC.10).
• Auto deliverable file list (§LAC.11).
• Seven-tier test matrix (§LAC.12).
• Definitions of Done (§LAC.13–§LAC.14).

Out of scope (explicit non-goals):

• Reopening Q0 bind allowlist, CORS, peer check, Bearer + CSRF, cookie/localStorage auth.
• Public mint of session_credential / csrf_token (website, API, or “magic link”).
• Signup, OAuth, hosted task runner, chatbot runtime, website that “executes tasks.”
• Unsigned installer as primary Download CTA (smoke AppImages / unsigned builds).
• Claiming Windows/Linux signed installers exist until Release assets + signing.status: signed.
• Embedding Python in the installer (Q3-release Auto v1 honesty unchanged).
• Tier-3 DNS cutover, merge to main, staging push, or live gate flips in Thinking.
• Hosted governance dashboard redesign (ok hosted-dashboard remains a different command).
• LICENSE flip (Apache-2.0 stays; MIT needs separate K12 §K12.4 Thinking).
• Engine rewrite beyond the narrow api/health additive in §LAC.6.3.

---

§LAC.2 — Verified baseline (do not invent)

Fact	Evidence / rule
Mac signed installer published	GitHub Release v0.1.0 asset Overseer.Kit_0.1.0_aarch64.dmg; manifest signing method developer_id_notarized, signing.status: signed (operator-verified 2026-07-14)
Primary Download href (frozen for Auto v1)	https://github.com/aaronrene/overseer-kit/releases/download/v0.1.0/Overseer.Kit_0.1.0_aarch64.dmg
Releases index	https://github.com/aaronrene/overseer-kit/releases/tag/v0.1.0 (and GitHub releases/latest for “find current tag”)
Win/Linux	Unavailable as primary CTAs until secrets exist and a signed Release row ships
Host Python	Path C Auto v1 still requires Python 3.11+ on PATH
Path B today	ok app / ok app --open; paste credential + CSRF from that terminal; Q4b Overview/Structure shipped
Diagrams	tools/app/static/assets/diagrams/{lanes,regimes,layers,kit-consumer}.svg (Q4b)
Landing today	K12 static tree under docs/landing/ with DONE status table residue — Auto must strip public WIP/DONE/TODO chrome
Domain intent	overseerkit.com → static docs/landing/ only (HOSTING.md); not yet operator-wired

---

§LAC.3 — Public site IA (frozen)

§LAC.3.1 — Section order (amends K12 §K12.2 for Auto)

Auto MUST update docs/landing/manifest.yaml + index.html so section ids match this order:

#	Section id	Visitor job
1	hero	Brand + one promise + primary/secondary CTAs
2	problem	Why governance honesty matters (plain language)
3	structure	Four offline structure flowcharts at a glance
4	layers	L0→L3 stack in visitor language (no module jargon dump)
5	console-access	Single “Open the local console” playbook (Paths 1–3)
6	suite-doors	Suite doors (GitHub, MuseHub, Knowtation, Scooling, VideoFactory, Consumer pattern)
7	quickstart	Clone / ok init secondary path
8	funnel	GitHub → Kit layers → optional MuseHub
9	scenarios	Link into scenario gallery (personas stay on /scenarios/)

Removed from public main page (frozen): roadmap-public status table with DONE/TODO/WIP rows; any “K9b DONE” style phase residue; links that imply the site is a live console.

Kept: scenario gallery A–E + badges (dogfood/reference/aspirational) on scenarios/index.html (K12 §K12.3 unchanged). Footer may link SECURITY + LICENSE + HOSTING.

§LAC.3.2 — Hero copy (frozen intent)

Element	Rule
Brand	🆗 Overseer Kit — hero-level (not nav-only)
Promise	Governance + honesty for phased AI work — without amnesia, fake DONE, or silent drift
Subpromise	Portable patterns for any repo; product task runtimes live in sister projects
Primary CTA	Download Mac console (Apple Silicon) → frozen .dmg href (§LAC.2)
Secondary CTA	Clone / init on GitHub → https://github.com/aaronrene/overseer-kit
Tertiary	Scenarios · MuseHub · Knowtation (suite doors; not primary)

Forbidden hero claims: “Run agents here”, “Sign up”, “Open live console on this domain”, “Windows/Linux download ready”, “No Python required”, “Pick any folder in the app” (no picker).

§LAC.3.3 — Visitor language (frozen)

Prefer: phases, living docs, checkpoints, independent review, local console.
Avoid on the main page: DONE/TODO/WIP status boards, freeze-contract digests, Tier jargon unless a short glossary footnote is needed. Developer detail stays in linked docs.

---

§LAC.4 — Visual direction (frozen)

Concern	Frozen choice
Medium	Static HTML + CSS only; no external script CDN; no analytics tags
Palette	Refine existing Track N tokens (docs/landing/assets/style.css): dark surface, green accent, clear hierarchy — professional explainer, not a neon “AI dashboard”
Type	System / UI stack OK; larger display scale for brand + H1; readable body ≥16px
Layout	One composition in the first viewport: brand, one headline, one short support line, CTA group — then diagrams
Diagrams	Offline SVG embeds; captions + text fallbacks (same accessibility rule as Q4a §Q4A.6.5)
Cards	Allowed only for suite-door / persona interaction blocks — not in the hero
Motion	Optional subtle CSS only; no JS animation framework
Residue strip	Auto MUST remove public DONE/TODO/WIP tables and “dev residue” from main landing

---

§LAC.5 — Structure flowcharts (frozen)

§LAC.5.1 — Assets

Auto MUST copy (byte-stable or regenerated-from-same mermaid as Q4a §Q4A.6) into:

Landing path	Source
docs/landing/assets/diagrams/lanes.svg	tools/app/static/assets/diagrams/lanes.svg
docs/landing/assets/diagrams/regimes.svg	tools/app/static/assets/diagrams/regimes.svg
docs/landing/assets/diagrams/layers.svg	tools/app/static/assets/diagrams/layers.svg
docs/landing/assets/diagrams/kit-consumer.svg	tools/app/static/assets/diagrams/kit-consumer.svg

Offline rule: no runtime Mermaid CDN. Captions match Q4a §Q4A.6.1–§Q4A.6.4 intent (±10% wording).

§LAC.5.2 — Placement

All four diagrams appear in section structure on the main landing page (at-a-glance). Scenario pages may keep ASCII/diagram snippets; they are not required to duplicate the SVG gallery.

---

§LAC.6 — Console access playbook (frozen)

Canonical title everywhere: Open the local console.

Map to existing Track Q Path letters (do not erase A/B/C runbook language):

Playbook	Track Q letter	Who
Path 1	Path C signed installer	Operators who want a native window (preferred when Mac Release exists)
Path 2	Path B browser	Developers with Python + kit/consumer checkout
Path 3	Path C build-from-source	Contributors developing the desktop shell

§LAC.6.1 — Path steps (exact intent)

Path 1 — Download Mac console (preferred for operators on Apple Silicon)

1. Confirm Python 3.11+ on the host (python3 --version).
2. Download the signed Apple Silicon (aarch64) .dmg from the frozen Release asset href (§LAC.2).
3. Optionally verify SHA256SUMS.txt + manifest signing.status: signed (runbook steps).
4. Bind a governed checkout before launch: set OVERSEER_REPO_ROOT to the absolute path of the consumer (or kit) repo that already has .overseer/ from ok init.
   Default without that env var: the desktop launcher binds repo_root to the bundled kit root inside the app resources (desktop/src-tauri/src/launcher.rs resolve_repo_root) — useful for dogfooding the kit itself, not an automatic “pick my project” folder dialog.
5. Open the app; desktop shell auto-fills session bootstrap (same as Path 3 auto-fill).
6. Confirm the chrome shows the expected bound path (§LAC.6.3) before any write action.

Honesty line (must appear near CTA): Apple Silicon (aarch64) Mac · signed+notarized · requires Python 3.11+. Set OVERSEER_REPO_ROOT to your governed repo. Windows/Linux signed installers are not published yet. No in-app folder picker in Auto v1.

Rejected for this Auto: inventing a GUI repo-folder picker or changing launcher bind defaults without a dedicated Thinking freeze.

Path 2 — Browser (ok app)

1. From a governed repo (.overseer/ present): ok app --open (or ok app then open the printed URL).
2. In the same terminal that started the server, copy session_credential and csrf_token.
3. Paste into Session bootstrap → Connect.
4. Credentials are process-lifetime only; never commit them; website never mints them.

Path 3 — Dev desktop

1. From kit root: ./scripts/bundle-desktop-kit.sh then cd desktop && npm install && npm run tauri dev.
2. Same auto-fill behavior as Path 1 install; still needs Python 3.11+ + Rust/Node for dev builds.

§LAC.6.2 — Surfaces that MUST carry the playbook

Surface	Requirement
README.md	Dedicated short section “Open the local console” with Paths 1–3 + Python honesty
docs/landing/index.html #console-access	Same three paths; primary visual weight on Path 1 when Mac asset exists
Path B Overview (tools/app/static/)	Compact Paths 1–3 + bound-repo honesty; link to GitHub Releases for Download
docs/TRACK-Q-DESKTOP-OPERATOR-RUNBOOK.md	Align §Release vs dev with live Mac Release; keep Win/Linux honest
docs/landing/HOSTING.md	Domain map + “site does not mint CSRF / does not run console”

Copy MUST be consistent across surfaces (same path names and order). Wording may tighten ±10%.

§LAC.6.3 — Path B chrome UX (frozen for Auto)

Behavior	Rule
After Connect succeeds	Collapse or hide #auth-panel Session bootstrap (may keep a small “Reconnect / new session” control)
Bound repo	Show absolute bound checkout path in chrome (header or Overview) from GET api/health → result.repo_root
Overview tabs	Plain-language one-liner for each tab (Status, Roadmap, Handover, Gates, Actions, Ledger, Structure)
Status enter	Auto-refresh once when the Status tab is activated (manual Refresh remains)
Auth	Still in-memory only; no cookies/localStorage (Q0 §Q0.6)

Narrow Q0 additive (authorized here only):

Amends Q0 §Q0.7 health result (docs/archive/phases/PHASE-TRACK-Q-Q0-OVERSEER-APP.md success result for GET api/health) from { status, port, bind } to:

{ "status": "ok", "port": <int>, "bind": "<literal>", "repo_root": "<absolute path>" }

Rule	Detail
Meaning	Absolute filesystem path of the bound checkout this process mutates (§LAC.7)
Auth	Still requires Bearer session credential (Q0 §Q0.6); not anonymous
Secrets	Path is local workspace location, not a credential; still must not appear in public HTML
Non-goals	Does not reopen bind allowlist, CORS, CSRF, cookies, or any other api/* schema
Server touch	Pass config.repo_root into handle_health only; no engine rewrite

Q0’s phrase “process liveness only (no repo secrets)” remains: repo_root is not a secret and does not expose living-doc contents. Living docs stay behind existing authenticated doc routes.

§LAC.6.4 — Overview tab explainers (frozen intent)

Tab	Plain-language job
Overview	What this console is; suite doors; how to open it; bound repo
Status	Health of governance for the bound repo
Roadmap	Living phase board
Handover	Next-session relay / paste prompt
Gates	Pending honesty/governance reminders
Actions	Dry-run-first freeze review + governance-sync + honesty-status
Ledger	Append-only honesty ledger view/verify
Structure	Full flowchart gallery

---

§LAC.7 — Bound-repo honesty (frozen)

Mechanism	Surface	Meaning
Process cwd + .overseer walk	Path 2 (ok app)	Default when --repo omitted (cli/paths.py resolve_repo_root)
--repo PATH	Path 2	Explicit bind for ok app
OVERSEER_REPO_ROOT	Path 1 / Path 3	Desktop launcher bind when set (desktop/.../launcher.rs)
Default without env	Path 1 / Path 3	Bundled kit root (not a consumer project picker)

Frozen statement (must appear in playbook + Overview):
This console is bound to one local checkout. Reads and writes (when confirmed) apply only to that tree — not to overseerkit.com and not to arbitrary remote repos. Desktop Path 1/3: set OVERSEER_REPO_ROOT to your governed repo; otherwise the shell binds the bundled kit.

Auto MUST NOT invent multi-repo switcher UI or a folder picker in this phase.

---

§LAC.8 — Domain map (frozen)

Host	Content
overseerkit.com (apex)	Static landing ONLY (docs/landing/)
Optional docs.overseerkit.com	Static docs mirror (still not a live ok app)
Any app.* / console.* subdomain	Forbidden if it pretends to host live Path B/C without a separate Thinking freeze
Hosted dashboard	Different CLI: ok hosted-dashboard — must not be branded as the apex product console

HOSTING.md Auto updates: replace outdated “signed installers optional later / developers clone” primary-path wording with Path 1 Mac Release honesty + Python 3.11+; keep “not a product runtime.”

---

§LAC.9 — Pre-public gate (ready to point DNS)

Operator may point DNS to the static host only when all are true:

1. Landing + access clarity Auto seven-tier matrix green (§LAC.12) + /build-verification-review → pass.
2. Access playbook present on README + landing #console-access + Path B Overview.
3. Primary Mac Download CTA href resolves to a Release asset with signing.status: signed (frozen v0.1.0 .dmg or a later signed tag Auto retargets only via governance note — never unsigned).
4. No unsigned-as-primary marketing; Win/Linux not claimed ready.
5. HOSTING.md matches §LAC.8; no subdomain marketed as live ok app.
6. No public CSRF/session mint claims anywhere on the site.

DNS cutover itself remains Tier 3 (human operator). This freeze does not authorize it.

---

§LAC.10 — Rejection table + hard stops

Proposal	Verdict
GUI folder picker / multi-repo switcher in Auto	Reject (needs dedicated Thinking)
Website mints or proxies session_credential / CSRF	Reject
app.overseerkit.com as live Path B	Reject (needs dedicated Thinking + security)
Primary CTA = unsigned smoke AppImage / unsigned .dmg	Reject
“No Python required” for Auto v1 Path C	Reject
Signup / OAuth / task runtime on landing	Reject
Reopen non-loopback bind or disable auth	Reject
New api/* beyond health repo_root additive	Reject (later freeze)
LICENSE → MIT in this phase	Reject
Tier-3 merge / DNS in Thinking session	Reject

Escalate to human (security / gates_tier3) if Auto attempts any of the above.

---

§LAC.11 — Auto deliverables (file list)

Path	Action
docs/landing/index.html	Rewrite IA per §LAC.3; embed diagrams; CTAs; console-access
docs/landing/scenarios/index.html	Nav/copy parity; keep persona badges
docs/landing/assets/style.css	Visual direction §LAC.4
docs/landing/assets/diagrams/*.svg	Four offline SVGs (§LAC.5)
docs/landing/manifest.yaml	Section ids per §LAC.3.1
docs/landing/HOSTING.md	Domain + Download honesty
tools/landing/validate.py (+ schema if needed)	Enforce new section ids, Download href allowlist, forbidden strings
README.md	“Open the local console” playbook
docs/TRACK-Q-DESKTOP-OPERATOR-RUNBOOK.md	Align with live Mac Release
tools/app/engine.py + tools/app/server.py	Narrow api/health repo_root additive only
tools/app/static/index.html + assets/app.js (+ CSS as needed)	Chrome UX §LAC.6.3–§LAC.6.4; Overview playbook
tests/	Seven-tier harness §LAC.12
docs/ROADMAP.md + docs/OVERSEER-HANDOVER.md	Governance sync after BV pass

Must not modify for Auto DONE: Q0 freeze artifact text (except citing this additive), LICENSE, desktop signing secrets, non-loopback bind defaults.

---

§LAC.12 — Seven-tier test matrix (Auto must satisfy)

Tier	Proves
unit	Manifest section ids match §LAC.3.1; primary Download href equals frozen .dmg URL; forbidden strings absent (Sign up, Create account, executes tasks, mint+csrf/session_credential on landing); no DONE/TODO/WIP status table on main landing; four diagram paths referenced; health result schema documents repo_root.
integration	validate_landing green on kit tree; relative doc links exist; api/health returns repo_root with Bearer; Path B static still serves; unknown api/ still rejected.
e2e	Landing fixtures validate; start ok app → Connect → auth panel collapsed/hidden → Overview shows bound path + Paths 1–3 → Status auto-fetches once on tab enter → SIGINT 0.
stress	Concurrent static GETs of landing SVGs + api/health (≥20) do not crash or leak credentials into responses.
data-integrity	Landing SVG files non-empty well-formed <svg>; checksum-stable across two runs; Download href host is github.com releases path only.
performance	Landing validator completes within existing K12 performance bound class; health additive adds no full-repo walk.
security	No external script tags; no secret heuristics; CSRF/session never appear as minted values in HTML; repo_root only on authenticated health; bind/auth non-loopback rules unchanged; no auth-disable.

---

§LAC.13 — Definition of Done (Thinking freeze)

• [x] This document reviewed → pass via /freeze-review-loop + ok review --freeze
• [x] Review-record table stamped; review_stamp filled
• [x] docs/ROADMAP.md row → DONE (Thinking); Auto remains TODO gated on this contract
• [x] docs/OVERSEER-HANDOVER.md NEXT regenerated for Landing + access clarity Auto
• [x] No landing/UI/README product rewrite landed in Thinking itself (governance + this artifact only)
• [x] No Tier-3 DNS/merge performed

§LAC.14 — Definition of Done (Auto build)

• [x] Mechanical implementation matches §§LAC.3–LAC.8 and §LAC.11
• [x] Seven-tier matrix §LAC.12 green
• [x] /build-verification-review → pass before ROADMAP Auto → DONE (LAC-BV-r1)
• [x] Closed Q0 bind/auth unchanged except §LAC.6.3 health additive (diff proof in BV)
• [x] Pre-public checklist §LAC.9 items 1–6 ready for operator DNS (DNS itself still Tier 3)
• [x] Governance sync (ROADMAP + HANDOVER) in the closing commit
• [ ] Feature-branch push / PR only; merge remains Tier 3

---

§LAC.15 — Boundary & capability table

Concern	This phase (after Auto)	Not this phase
Explain kit + diagrams on overseerkit.com	Yes (static)	Live governance server on apex
Download signed Mac console	Yes (link to GitHub Release)	Embed installer binary in repo
Open local console Paths 1–3	Document + chrome clarity	Public session mint
Mutate remote repos from website	Never	—
Merge / DNS / live flips	Never (Tier 3 human)	—

Capability	git-only	muse+git-mirror / muse-only
Static landing	Full	Full
Path B/C console	Full (local)	Full (local)
Muse-only landing features	None	None (K7)