# praxis-stack.pages.dev — complete site surface documentation

**Canonical host:** https://praxis-stack.pages.dev  
**Package:** 1.6.0 (skills: megapraxis + metamegapraxis + praxis-local-realize)
**Production deploy:** `npx wrangler pages deploy public --project-name=praxis-stack --branch=master`  
**Provenance boundary:** previous production source `ffb3d8f` · current release evidence in `demo/mgs-convergence.json`
**License:** MIT  

This document is the **provable surface map** of the public site: every major URL class, what it is for, which M/G/S/MGS layer it serves, and how it was verified live. It complements (does not replace) the technical white paper.

---

## 1. What the site is

**praxis-stack** materializes MegaPraxis + MetaMegaPraxis as a public Cloudflare Pages project:

| Concern | On this site | Not on this site (by design) |
|---|---|---|
| Install skills | zip, bare git, install.md, onboard playbooks | — |
| Explain architecture | Home / System / whitepaper / llms.txt | — |
| Live audit snapshots | D1 via Pages Functions `/api/snapshots*` | Full GraphDoc / Pharosiraptor MCP |
| Optional graph operant | Cross-link only | **intrikata.com** (sibling) |
| Agent harness runtimes | Adapters + playbooks | Hosting Claude/Grok/Codex processes |

**Tarski bound:** “Complete documentation” means *complete relative to published surfaces and live HTTP probes*, not omniscience about every future agent’s discovery path.

---

## 2. UI tabs (index.html)

| Tab | Role | Layer |
|---|---|---|
| **Home** | OSS community landing — hero, badges, multi-harness install, docs map, principles | GENESIS + META explainer |
| **The System** | Short architecture (modes, traps, Tarski, bridges) | META |
| **Live State** | Fetches scrubbed snapshots from API | SHADOW / MGS (read live D1) |
| **Proven Cycle** | Replay of certified self-audit cycle (demo/cycle.json) | META receipt |

Header actions: Install · White paper · Download zip · Clone · Contribute · MIT.

Live strip on Home checks `/api/snapshots/latest` in-browser.

---

## 3. URL inventory (live-probed 2026-07-18)

### 3.1 Core pages

| URL | Content-Type (live) | Status | Notes |
|---|---|---|---|
| `/` | text/html | 200 | Main SPA-style tabs (static HTML+JS) |
| `/whitepaper` | text/html | 200 | Technical white paper (`whitepaper.html`) |
| `/favicon.svg` | image/svg+xml | 200 | Brand mark |
| `/llms.txt` | text/plain | 200 | Agent discovery index |
| `/sitemap.xml` | application/xml | 200 | Crawl map |
| `/robots.txt` | text/plain | 200 | Allows all; points to sitemap |
| `/SITE.md` | text/markdown | (this file) | Full surface documentation |

`/index.html` and `/whitepaper.html` may **308** to slash/extensionless URLs — use `/` and `/whitepaper`.

### 3.2 Install & onboard

| URL | Purpose |
|---|---|
| `/install.md` | Human + agent install (per-OS) |
| `/onboard-grok.md` | Grok Build short-circuit (filesystem, no MCP required) |
| `/onboard-codex.md` | Codex marketplace install-once |
| `/onboard-local.md` | Cross-agent / cross-OS local realize |
| `/harness.md` | Primitive map outside Claude Code |
| `/backend.md` | Optional graph backend contract |
| `/pkg/praxis-stack-skills.zip` | Skills package (**must** be `application/zip`, magic `PK\x03\x04`) |
| `/git/praxis-stack.git` | Dumb-HTTP bare repo / marketplace source |
| `/scripts/realize.py` | Local realize entry (text/x-python) |
| `/scripts/backend_stub.py` | Optional Tier-1 HTTP stub |

### 3.3 Adapters

| URL | Harness |
|---|---|
| `/adapters/GROK.md` | Grok Build |
| `/adapters/CODEX.md` | OpenAI Codex |
| `/adapters/AGENTS.md` | AGENTS.md family |
| `/adapters/GEMINI.md` | Gemini CLI |
| `/adapters/cursor/praxis.mdc` | Cursor rules |

### 3.4 Community kit

| URL | Role |
|---|---|
| `/LICENSE` | MIT |
| `/CONTRIBUTING.md` | Contribution guide |
| `/CODE_OF_CONDUCT.md` | Conduct |
| `/SECURITY.md` | Security policy |

### 3.5 Demo / certificates (JSON)

| URL | Schema / role |
|---|---|
| `/demo/community.json` | OSS community main cert |
| `/demo/whitepaper.json` | White paper ship cert |
| `/demo/surface-audit.json` | Surface roll-call cert |
| `/demo/site-surface.json` | **This cycle** full site map cert |
| `/demo/local-realize.json` | Local realize cert |
| `/demo/grok-onboard.json` | Grok onboard cert |
| `/demo/codex-onboard.json` | Codex onboard cert |
| `/demo/cycle.json` | Proven cycle replay data |
| `/demo/mgs-convergence.json` | Package 1.6.0 MGS convergence + fixed-point cert |
| `/demo/skills/*.SKILL.md` | Package-identical skill mirrors for demo UI |

### 3.6 Live state API (Pages Functions + D1)

| Method | URL | Auth | Body |
|---|---|---|---|
| GET | `/api/snapshots` | none | `{ snapshots: [...] }` list |
| GET | `/api/snapshots/latest` | none | latest row + payload |
| GET | `/api/snapshots/:id` | none | one snapshot |
| POST | `/api/snapshots` | `Bearer $PRAXIS_INGEST_TOKEN` | ingest scrubbed, structurally validated audit |

Write controls: canonical browser origin (or no `Origin` for server exporters), 128 KiB maximum
body, bounded nested types/counts, 30 requests/minute per observed edge IP, parameterized D1
insert, and generic error responses. API responses are `no-store` and carry explicit MIME,
frame, referrer, and cross-origin resource protections.

**Live check:** GET latest with `Accept: application/json` → `application/json`, structured snapshot **#7** (2026-07-19), source `metamegapraxis-audit`.

Snapshot #7 names the state-validity horizon: its persisted metamegapraxis baseline covers 24
traps while the current package inventory contains 26. The exporter publishes
`baseline_inventory=24`, `current_inventory=26`, and `inventory_delta=2`; it does not invent
statuses for the two newer Intrikata-specific probes.

Ingest rejects shallow-serialized payloads unless trap roll-call entries, coverage layer maps,
and bridge-list entries remain nested JSON objects. This prevents presentation strings such as
PowerShell `@{...}` output from becoming the latest machine-readable snapshot.

The Cache API throttle is a free-tier abuse brake, not a globally atomic rate-limit guarantee;
bearer authentication, origin policy, body bounds, and structural validation remain fail-closed.

**Note:** HEAD without Accept may report misleading Content-Type; always verify body starts with `{`.

### 3.7 Binding / infra

| Resource | Value |
|---|---|
| Pages project | `praxis-stack` |
| D1 database | `praxis_stack` (binding `DB`) |
| Production branch | **master** (not `main` — preview vs production trap) |
| Ingest | `export_state.py` + secret `PRAXIS_INGEST_TOKEN` |

---

## 4. M / G / S / MGS coverage of the site

### META
- System tab, white paper, llms.txt, SITE.md (this file)
- Trap vocabulary, Tarski residuals, bridge flywheel narrative
- Verdict honesty: `converged-modulo-harness` on onboard certs ≠ CTL swarm `converged`

### GENESIS
- Package zip + bare git regenerated from live `~/.claude/skills`
- Skills: megapraxis, metamegapraxis, praxis-local-realize (1.6.0)
- Onboard playbooks + adapters + community kit
- White paper HTML

### SHADOW (always-on disclosures)
- GraphDoc/MCP **not** hosted here — filesystem-fallback is first-class
- Snapshot payloads are **scrubbed** (no raw paths/usernames/full UUIDs)
- Zip must not be SPA/HTML fallback (probe magic `PK`)
- Production deploy requires `--branch=master`
- `/.well-known/security.txt` served as RFC 9116 text (Contact/Policy → SECURITY.md; Expires < 1 year)
- HSTS via `_headers`: `max-age=31536000` only (no `includeSubDomains` / `preload` on multi-tenant `pages.dev`)

### MGS (operational lifecycle)
| Op | Command / path |
|---|---|
| Rebuild package | `build_package.py` (venv/`py`) |
| Rebuild demo mirrors | `build_demo.py` |
| Publish snapshot | `export_state.py` (local GraphDoc + token) |
| Deploy production | `wrangler pages deploy public --project-name=praxis-stack --branch=master` |
| Validate | `validate.py` |

---

## 5. Package 1.6.0 contents (what the zip is)

Built from live skills with portability scrub:

- `praxis/skills/megapraxis/SKILL.md`
- `praxis/skills/metamegapraxis/SKILL.md`
- `praxis/skills/praxis-local-realize/` (+ scripts)
- Plugin/marketplace manifests, `install.py`, INSTALL/BACKEND/HARNESS/ONBOARD-*, adapters, scripts

**1.6.0 delta since production source `ffb3d8f`:** compositional metamegapraxis phases · traps 25–26 + prior trap 24 surfaced in public docs · fail-closed folded-frontmatter parsing · provenance-preserving MGSConvergenceAgent 1.0.1 · semantic saturation fingerprint + autonomous fixed-point proof · CodexCode/GrokBuild peer assistant routing · child-scoped OpenAI CLI fallback without desktop-auth replacement · idempotent package preamble · read-only `realize.py --verify-only` · compositional-audit snapshot exporter support.

---

## 6. Multi-harness install matrix

| Harness | Primary path | Cert |
|---|---|---|
| Claude Code | unzip → `~/.claude/skills` or marketplace | install.md |
| Grok Build | `onboard-grok.md` → `~/.grok/skills` | demo/grok-onboard.json |
| Codex | marketplace add bare git + plugin add | demo/codex-onboard.json |
| Any OS cross-agent | `onboard-local.md` + `realize.py` | demo/local-realize.json |

Grok: **no MCP required** for valid megapraxis briefing (filesystem-fallback).

---

## 7. Security posture (probed)

| Control | Status |
|---|---|
| CSP | present (default-src 'self'; scripts/styles unsafe-inline) |
| X-Frame-Options | DENY |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | camera/mic/geo/payment/usb disabled |
| HSTS | `Strict-Transport-Security: max-age=31536000` via `_headers` (no includeSubDomains on multi-tenant pages.dev) |
| security.txt (RFC 9116 well-known) | `/.well-known/security.txt` (Contact/Policy → SECURITY.md; Expires < 1y) |
| SECURITY.md | published |

---

## 8. Verification checklist (re-runnable)

```text
1. GET /  → 200 HTML, badge v1.6.0
2. GET /pkg/praxis-stack-skills.zip → first bytes PK\x03\x04
3. GET /api/snapshots/latest Accept: application/json → JSON id≥1
4. GET /onboard-grok.md · /onboard-local.md · /llms.txt → 200
5. GET /demo/site-surface.json → schema praxis-stack.site-surface
6. GET /.well-known/security.txt → text/plain, Contact + Expires present (not HTML)
7. HEAD / → Strict-Transport-Security present
8. Deploy only with --branch=master for production hostname
9. GET /demo/mgs-convergence.json → target hash + 281-skill coverage + no secret material
```

---

## 9. SwarmInvocation / CTL (this documentation cycle)

```
SwarmInvocation::inv-mmgp-20260718-site-surface-doc
  ::source=metamegapraxis+otc
  ::class=site-surface-documentation
  ::verdict=converged-modulo-harness
  ::package=1.6.0
  ::production_branch=master
  ::snapshot=7
```

**Verdict meaning:** public surfaces and package map are disk- and HTTP-verified; residuals in §4 SHADOW / §7 are named, not closed by default.

**Related session artifacts (operator machine, not necessarily on site):**  
`_ctl_20260718_session_convergence_certificate.md` · `_msa_20260718_filesystem_SwarmReport.md`

---

## 10. Sibling

- **intrikata.com** — optional CF D1 operant after skills install (`instance new` → bootstrap → operant). Not required for megapraxis.

---

## 11. Document control

| Field | Value |
|---|---|
| Doc | SITE.md |
| Version | 1.1 |
| Package | 1.6.0 |
| Generated | 2026-07-18 |
| Method | Live HEAD/GET probes + local `public/` inventory + session D1–D10 apply evidence |
| Supersedes | Informal README surface list for agent-facing completeness |

_via: filesystem + live HTTPS probes · Tarski-honest site map_