docs(web): stop implying Ghost calls external APIs today

[mohabbis]

Summary

Follow-up to #414, correcting a claim I introduced there.

The landing page's "So is this just browser automation?" section said:

Where a real API exists that is the better path, and the same controls sit on top of it unchanged.

Read in the present tense — which is how a visitor reads a homepage — that claims Ghost executes API steps. It does not. Checked against the code rather than assumed:

• apiCall and sendEmail parse (schema/step.ts, under a // --- Post-MVP step types (reserved; no executor yet) --- heading)
• the sensitivity classifier gates them, and compensate.ts / expr.ts handle them
• but applyStep in apps/worker/src/browser/driver.ts returns {} for both — they do nothing
• both are listed in UNIMPLEMENTED_ACTION_TYPES and excluded from EDITABLE_STEP_TYPES, with editable-steps.test.ts enforcing it
• the Connector model is schema-only: "no UI or command reads these yet"

The reason the editor withholds the step is stated in the source and is the same reason the page shouldn't have implied the capability:

Offering them would let someone author a workflow that silently performs no action while reporting success, which is worse than not offering the step at all.

Trust & safety

• Touches files / filesystem mutation: none
• Touches OS input: none
• Touches screenshots / screen contents: none
• Touches network: none
• Touches authentication / secrets: none
• Touches app / window state: none

Copy-only change to one public marketing section. No runtime behaviour, no route, no schema.

• Risky actions remain deny-by-default
• Reversible mutations write undo data before executing — n/a
• No silent delete or silent overwrite
• New Tauri commands have a module and a risk class — n/a, cloud app
• Experimental features stay gated or labeled

This is CLAUDE.md rule 10 enforcement — marketing must not promise capabilities the app cannot support — applied to a sentence added two commits earlier.

Changes

cloud/apps/web/src/app/page.tsx — the section now:

1. states outright that today every step runs through a browser;
2. names precisely what exists (the apiCall step type, the connector model, the rules that classify an API action as sensitive) and what does not (the executor);
3. explains why the step is deliberately withheld from the editor;
4. keeps the actual argument intact — the browser is how Ghost reaches a system, not what Ghost is, and most of the systems this work lives in have no usable API anyway.

The honest version reads as more convincing than the vague one, because it is the same reasoning the codebase already applies to itself.

Validation

Cloud app; nothing in src-tauri/ changed, so no Rust check was run.

• pnpm typecheck
• pnpm lint
• pnpm build
• pnpm test

All exit 0.

Risks / follow-up

• Worth a scan of the rest of the page against the same standard. The "not yet" column already covers connectors and screen recording, and the PIPELINE list flags the unbuilt stage, but this slipped through in prose — prose is where it will slip again.
• When the apiCall executor does land, this section, NEXT_UP, and UNIMPLEMENTED_ACTION_TYPES all have to move together. Only the last one is currently enforced by a test.
• Unrelated to this diff, still open from fix(web): give the app a real front door instead of a sign-in wall #414: ghost-app has not been redeployed, so production still serves the pre-fix(web): give the app a real front door instead of a sign-in wall #414 build.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VLqLtoLgi4RDrWaYVJVGuX

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
ghost	Ready	Preview	Aug 7, 2026 4:22pm

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.