Changes touching this path

• Scaffold site/ + wire Vercel #2, loot. subdomain, install proxy (#257) Thin end-to-end tracer for loot.millerbyte.com (spec docs/specs/loot-site.md SS1-3): site/ = TanStack Start SSG consuming published @millerbyte/ui@^0.1.0 (theme.css at the root), five placeholder surface routes prerendered, deployed on Vercel project #2 (root site/) at https://loot.millerbyte.com. Install proxy: the spec's vercel.json external-rewrite mechanism was falsified live (Vercel passes GitHub's releases/latest 302 through to the client), so /install.sh and /install.ps1 are Start server routes that fetch upstream and stream the bytes back 200 - spec SS2 amended in place. site/** explicitly public in .lootattributes; .vercelignore allowlists site/ so .loot/ keys and docs/pitch/ can never reach the Vercel builder; site build artifacts lootignored. 1931146c · dbf3dbe6…
• Scaffold site/ + wire Vercel #2, loot. subdomain, install proxy (#257) (#291) * Scaffold site/ + wire Vercel #2, loot. subdomain, install proxy (#257) Thin end-to-end tracer for loot.millerbyte.com (spec docs/specs/loot-site.md SS1-3): site/ = TanStack Start SSG consuming published @millerbyte/ui@^0.1.0 (theme.css at the root), five placeholder surface routes prerendered, deployed on Vercel project #2 (root site/) at https://loot.millerbyte.com. Install proxy: the spec's vercel.json external-rewrite mechanism was falsified live (Vercel passes GitHub's releases/latest 302 through to the client), so /install.sh and /install.ps1 are Start server routes that fetch upstream and stream the bytes back 200 - spec SS2 amended in place. site/** explicitly public in .lootattributes; .vercelignore allowlists site/ so .loot/ keys and docs/pitch/ can never reach the Vercel builder; site build artifacts lootignored. Landed via break-glass git branch: the loot-native lane land was blocked by two live shared-store bugs (review-ferry folds a described WIP into a reconcile finalize; describe/status disagree on the working change under concurrent sessions) - tickets to follow. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Apply #291 review findings Cache only successful upstream responses in the installer proxy (a transient GitHub failure must not be CDN-cached for 5 minutes); extract the install one-liners to one shared module (three copies drifted apart otherwise); fix the vite.config "fully static" comment and spec SS0 framing to name the two server-route exceptions; tighten the .lootattributes rationale (the interim manual deploy is gated by .vercelignore, not the GitHub projection); drop the cargo-culted overrides block (its pins targeted server deps the site lacks). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Git-Author: Connor Miller <53197564+Connor-Miller@users.noreply.github.com> 231eb5f8diff
• Author the five surfaces' real content (#259) (#301) Fill the deployed site/ shells with real content per the loot-site spec section 4: - Landing: thesis hook + install one-liner + "what works today" loop + three demo vignettes (private .env / embargo / grant) deep-linking into Docs + CTA row. - Install: OS-detected default command, 5-native-triple platforms table (v0.1.0), build-from-source footnote, verify-your-download (checksum + gh attestation, TLS-only Windows note), troubleshooting. Win ARM64 noted as x64-emulated, not a native download (#270). - Docs: getting started (.env quickstart, current verbs), seven distilled core concepts, four task guides, and a hand-written CLI reference grouped setup/local/docks/sync/grants/identity - sourced from the binary's usage text so flags can't drift. - Why loot: fresh sell-only copy (hook / the claim / why now / grants over permission bits / proof). No bytes from the sealed docs/pitch/. - Evidence: proof-log index, one card per committed run over verbatim output (sealed path, hard embargo, concurrent agents, grant+maroon, amend divergence, loot-first). Styling extends styles.css with @millerbyte/ui theme tokens only; nav, footer, routes, and the install proxy are untouched. tsc clean; all five routes (plus deep-link hashes) prerender. Git-Author: Connor Miller <53197564+Connor-Miller@users.noreply.github.com> e088f034diff
• Add loot verify: object-store integrity check (#19) - rehash every loose object against its address, report corrupt and missing by address, exit 1 on problems; load-free so a corrupt store can still be diagnosed aeb147b3 · dbf3dbe6…diff
• loot verify: name each missing object's referencing change+path, and add --accept-loss lost-ledger (#335) - missing report carries provenance (MissingObject/MissingRef); .loot/lost records operator-acknowledged unrecoverable losses so verify gates CI again while new damage still fails; primary-only, store-locked 57350aa4 · dbf3dbe6…diff
• the site stops understating what the forge enforces, and the host path it documents becomes runnable: --allow learns the only pubkey form the CLI actually prints (#1086) c83e98f5 · dbf3dbe6…diff
• the relay half of the honest-limits pass stops overstating itself: rotation no longer claims burn authority it never took, and the push allowlist is named as the one gate it is (#1086) 23c8d4b2 · dbf3dbe6…diff
• loot --help names the vulnerability disclosure route, and /docs cites the trust matrix instead of restating it wrong twice (#1142) 8e79e7e8 · dbf3dbe6…diff
• loot clone probes the host and speaks the signed forge client, so a forge URL reaches the door instead of dying at the transport, and the sealed grants arrive with it (#1162) 98f5b662 · dbf3dbe6…diff
• the alpha promise ships in the product: /install carries ADR 0066's canonical block, docs and loot --help carry the headline verbatim, and one test pins all three surfaces plus the disclosure route (#1137) 9d724d85 · dbf3dbe6…diff
• the Known Issues page publishes what costs a tester their work, nine findings re-run against v0.4.16, and it is updated on report against a dated last-review rather than a cadence nobody keeps (#1143) 48f5788f · dbf3dbe6…diff
• the site stops offering public as a tier name in the three places a reader copies it from, and a grammar-precise pin reads the vocabulary off USAGE so the page cannot drift from the CLI again (#1185) fd5bb36f · dbf3dbe6…diff
• the getting-started demo hands the repo to a second keypair instead of renaming the actor, so the first block a stranger pastes proves the thesis its caption claims, and a test runs the published bytes rather than reading them (#1214) 05629898 · dbf3dbe6…diff
• the site stops shipping 298 grammars to highlight two languages, and a three-line meta helper stops dragging fifteen more into the entry chunk of every page including the ones with no code at all (#1244) b06ca1b5 · dbf3dbe6…diff
• an --allow that lost its key refuses instead of opening the relay it was typed to close, and a flag glued to its value with = refuses instead of being read as absent (#1224) 25052753 · dbf3dbe6…diff
• the known-issues pin becomes four tests that each say what broke, the phrase-issuer guard asserts the whole public surface of the mnemonic module instead of guessing a function name, and the trust versus known-issues split has one canonical copy the other sites point at (#1217) f751adc3 · dbf3dbe6…diff
• the site chrome becomes an instrument: a slim mono Console bar carries the six links, the release tag it now imports rather than retypes and the account key chip on every page, the footer band collapses into a one-line end-mark that still carries the disclosure route, docs trades its in-page contents list for a prop-driven side navigation any later surface can mount, and the account page is re-presented as a dashboard of key rows and a four-step ceremony with every Clerk call, every byte of crypto and every load-bearing sentence untouched - the #1323 prototype verdict, raising every surface ceiling on the record for the shared stylesheet it costs 786e5a21 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.