Changes touching this path

• Scaffold site/ + wire Vercel #2, loot. subdomain, install proxy (#257) Thin end-to-end tracer for loot.millerbyte.com (spec docs/specs/loot-site.md SS1-3): site/ = TanStack Start SSG consuming published @millerbyte/ui@^0.1.0 (theme.css at the root), five placeholder surface routes prerendered, deployed on Vercel project #2 (root site/) at https://loot.millerbyte.com. Install proxy: the spec's vercel.json external-rewrite mechanism was falsified live (Vercel passes GitHub's releases/latest 302 through to the client), so /install.sh and /install.ps1 are Start server routes that fetch upstream and stream the bytes back 200 - spec SS2 amended in place. site/** explicitly public in .lootattributes; .vercelignore allowlists site/ so .loot/ keys and docs/pitch/ can never reach the Vercel builder; site build artifacts lootignored. 1931146c · dbf3dbe6…
• Scaffold site/ + wire Vercel #2, loot. subdomain, install proxy (#257) (#291) * Scaffold site/ + wire Vercel #2, loot. subdomain, install proxy (#257) Thin end-to-end tracer for loot.millerbyte.com (spec docs/specs/loot-site.md SS1-3): site/ = TanStack Start SSG consuming published @millerbyte/ui@^0.1.0 (theme.css at the root), five placeholder surface routes prerendered, deployed on Vercel project #2 (root site/) at https://loot.millerbyte.com. Install proxy: the spec's vercel.json external-rewrite mechanism was falsified live (Vercel passes GitHub's releases/latest 302 through to the client), so /install.sh and /install.ps1 are Start server routes that fetch upstream and stream the bytes back 200 - spec SS2 amended in place. site/** explicitly public in .lootattributes; .vercelignore allowlists site/ so .loot/ keys and docs/pitch/ can never reach the Vercel builder; site build artifacts lootignored. Landed via break-glass git branch: the loot-native lane land was blocked by two live shared-store bugs (review-ferry folds a described WIP into a reconcile finalize; describe/status disagree on the working change under concurrent sessions) - tickets to follow. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Apply #291 review findings Cache only successful upstream responses in the installer proxy (a transient GitHub failure must not be CDN-cached for 5 minutes); extract the install one-liners to one shared module (three copies drifted apart otherwise); fix the vite.config "fully static" comment and spec SS0 framing to name the two server-route exceptions; tighten the .lootattributes rationale (the interim manual deploy is gated by .vercelignore, not the GitHub projection); drop the cargo-culted overrides block (its pins targeted server deps the site lacks). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Git-Author: Connor Miller <53197564+Connor-Miller@users.noreply.github.com> 231eb5f8diff
• Author the five surfaces' real content (#259) (#301) Fill the deployed site/ shells with real content per the loot-site spec section 4: - Landing: thesis hook + install one-liner + "what works today" loop + three demo vignettes (private .env / embargo / grant) deep-linking into Docs + CTA row. - Install: OS-detected default command, 5-native-triple platforms table (v0.1.0), build-from-source footnote, verify-your-download (checksum + gh attestation, TLS-only Windows note), troubleshooting. Win ARM64 noted as x64-emulated, not a native download (#270). - Docs: getting started (.env quickstart, current verbs), seven distilled core concepts, four task guides, and a hand-written CLI reference grouped setup/local/docks/sync/grants/identity - sourced from the binary's usage text so flags can't drift. - Why loot: fresh sell-only copy (hook / the claim / why now / grants over permission bits / proof). No bytes from the sealed docs/pitch/. - Evidence: proof-log index, one card per committed run over verbatim output (sealed path, hard embargo, concurrent agents, grant+maroon, amend divergence, loot-first). Styling extends styles.css with @millerbyte/ui theme tokens only; nav, footer, routes, and the install proxy are untouched. tsc clean; all five routes (plus deep-link hashes) prerender. Git-Author: Connor Miller <53197564+Connor-Miller@users.noreply.github.com> e088f034diff
• the receipts are served, not linked: the Evidence page stops pointing at a repo its readers cannot open (#840) Twelve github.com links, every one a 404 for the only audience this site has — Connor-Miller/loot is private permanently (ADR 0045). Nine of them were the Evidence page run-output and evidence-doc links, i.e. the receipt for every thesis claim that page makes, so it asserted a set of proofs and handed the reader nothing to open. The other three were the nav/footer repo links and a LICENSE link, dead twice over since no file of that name exists either. The nine receipts are now inlined at build time with `?raw` and disclosed in place under each excerpt. A link — to GitHub, to a forge surface, to a route of our own — is a promise checked at READ time by someone not here to fix it; an import is checked by `vite build`, so moving one of these files breaks the build in the commit that broke it. This page cannot go stale the way it just spent months being stale. Not served from the forge, which ADR 0045 says is where the world should read loot: measured today, /k/connor and /k/connor/loot both answer 404 — it carries no repo yet, so pointing there would have swapped nine dead links for two. When it does, these become links again and the imports stay as the build-time check. The license moved to a page of its own rather than being dropped: a reader running curl | sh has a real reason to want the terms, and both texts are imported rather than transcribed so they cannot drift from the repo. A sweep test asks the reader question of the whole src/ tree, not the two files that happened to be wrong. It bans href/to/url pointing at github.com and deliberately allows the string in prose — installerProxy documents what dist bakes into the installers, and install.tsx prints cargo install --git as text (that command is #841 own decision). ⭐ The defect was never a wrong URL: it was that nobody ever opened one anonymously, and the person editing these files is always signed in. Verified: no github.com href on any of the 6 prerendered pages, /license prerenders, suite 77 passed | 23 skipped, build green. ⚠ Residue: the inlined evidence DOCUMENTS quote issue URLs in their own prose. They render as inert text in a <pre>, not as links, and rewriting a historical evidence document to hide its citations would falsify the thing it is evidence of. ad95716f · dbf3dbe6…diff
• the custody sweep residuals are answered on the record: the sealed-path demo is re-run so the evidence page shows the binary it names, the disk scan learns base64 and UTF-16, the pull entry points drop their bool, and the mailbox keeps failing loud by decision (#1232) 333e9517 · dbf3dbe6…diff
• the evidence page gets the one proof a reader can run: two identities are minted in the browser, a content key is sealed to one of them, and the other is refused by the engine in its own words rather than in ours, with the 161 KB core fetched only when someone presses the button 846010f8 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.