Public launch (v2) gate — tracking

[sc2ben]

Tracking issue for everything gating the public launch (v2), from the pre-v2 whole-project review (three personas + accessibility). Persona detail lives in the linked issues; this is the prioritized rollup.

Already landed

• PR fix: harden redaction and PDF-generation correctness #116 — redaction hardening (server-side bar masking, no leak into HTML/search-index/feeds; underscore-corruption fix; trim-syntax) + correctness fixes (date-based version selection, full-path stamp keys, duplicate-name build error, unified PDF filename sanitizer, draft: true excluded from PDFs, mobile-nav toggle) + action binary pinning/SHA256SUMS/env-indirection. Tests + a CI redaction leak check included.
• 1.4.1 — the CSS-only web-redaction advisory (GHSA-j557-r6p7-8r3m), UnclosedRedaction, starter redact_mode default → true.

Launch blockers

• Docs site 404s (README's only doc link + whole site) — UX & marketing: v2 launch readiness #118
• License incoherence: theme.toml AGPL vs PolyForm Noncommercial LICENSE, no commercial path — UX & marketing: v2 launch readiness #118
• Starter deploy: Pages-visibility warning + split PDF artifact from Pages deploy — Security & architecture: v2 launch hardening #117

Should-fix before public

• CI perms scoping + stop force-moving tags after publish; SHA-pin third-party actions — Security & architecture: v2 launch hardening #117
• Web XSS pass (search teaser innerHTML, | safe sinks) — Security & architecture: v2 launch hardening #117
• Wire validatePolicyFiles into the build (approval enforcement); implement/remove -i — Security & architecture: v2 launch hardening #117
• Overdue-review CI warning + scheduled rebuild in starter — End-user (compliance) & accessibility: v2 launch readiness #119

Product / polish

• Dashboard homepage with real data; README screenshot/demo/comparison; positioning + CHANGELOG header — UX & marketing: v2 launch readiness #118
• Accessibility program (tagged PDFs, keyboard/ARIA, skip-link targets, h1, logo alt) — End-user (compliance) & accessibility: v2 launch readiness #119
• Audit bundle (manifest + coverage + revision index); coverage % ignores typo'd terms — End-user (compliance) & accessibility: v2 launch readiness #119
• Mermaid slimming + self-hosted icons — Security & architecture: v2 launch hardening #117 / UX & marketing: v2 launch readiness #118

Personas: security & architecture #117 · UX & marketing #118 · end-user & accessibility #119.

[tsunaminoai]

PR #121 lands a large part of the launch gate:

• Security & architecture (Security & architecture: v2 launch hardening #117): CI least-privilege perms + stop force-moving release tags + SHA-pin @main actions; dev-server loopback bind; output-dir cleanup; validation wiring (+ --strict); web XSS escaping; action checksum fails closed; starter Pages-visibility warning + safe redact_web default.
• Mermaid slimming (Pre-render web-side mermaid with pozeiden (drop vendored mermaid.js) #114): vendored bundle dropped, diagrams rendered to inline SVG at build time.

Still open after #121: docs-site 404 + license coherence (#118), overdue-review/a11y/audit-bundle (#119), and the cross-repo raw-HTML divergence (#117).