Three homepage surfaces described the live fleet falsely, and one registry file was dead weight. Frank ordered all of it 2026-11-03.
What changes
shared/homepage/services.json — the file that actually decides card behaviour:
Jellyfin: wip: "down" + no link → live at http://jelly.franksdank.cloud; the description now says it carries its own logins (no Authentik link) and that accounts come from Frank.
Audiobookshelf: category: admin → user. Authentik SSO (PR #134) made it a household app, so the card belongs on the root page; the description names the SSO door and the per-listener positions.
Marreta: the description said something it does not do. It now says what it is: a paywall sledgehammer that drags the article back through the VPN, strips the paywall chrome and trackers, renders JS-heavy pages with a headless browser, best effort.
shared/homepage/docs.html — the household page gains the Audiobookshelf row (same single sign-on, per-listener position), and the frank-dragoon list gets its missing </ul>. That one is pre-existing: with the list unclosed, the HTML parser nested the whole frank-archon section inside the dragon's last bullet. Confirmed against the live DOM before and after, not by eye.
dankclaw/Caddyfile — comment only, no route change. jelly.franksdank.cloud is now documented as exempt by construction (its own complete auth, the same exempt family as Plex / ABS / the *arr stack), with the accepted exposure written down: the sign-in form is internet-visible with no rate limiter on either side, because this Caddy build ships no rate_limit module.
shared/homepage/dankserver.services.json — removed (35 lines). Nothing read it: not deploy.sh (it copies named files), not the homepage checker, not any seam. .AGENTTRASH/ is gitignored, so the hold is invisible to the seams regardless. The file is held at shared/homepage/.AGENTTRASH/dankserver.services.json, not deleted.
Vault — Homepage.md gains the law that the registry is the placement authority and its own lists are locators (disagreement means the page is the bug), plus Audiobookshelf in the user list. Jellyfin.md gains the API-key ledger and rotation section: the routes, the 204-with-no-body mint, revoke-by-token, and the fact that neither IsActive nor DateLastActivity is a usage signal on 12.4.
Evidence
./tests/run.sh: 824 passed on the committed tree.
Managed-browser census of the rendered homepage and docs page before commit — card states, and the list-nesting defect observed in the DOM before and after the </ul>.
Deploy
scripts/deploy.sh dankclaw --service homepage — docs are a no-op and the Caddyfile edit is a comment, so no container and no LLM endpoint is in the blast radius.
The dankclaw/Caddyfile path is in the frankbook blast radius, so the e2e gate
will run the frankbook project on this deploy even though the edit is a
comment: FrankBook-Pro has to be awake or the gate fails on an unrelated spec.
# Why
Three homepage surfaces described the live fleet falsely, and one registry file was dead weight. Frank ordered all of it 2026-11-03.
# What changes
**`shared/homepage/services.json`** — the file that actually decides card behaviour:
- **Jellyfin**: `wip: "down"` + no link → live at `http://jelly.franksdank.cloud`; the description now says it carries its own logins (no Authentik link) and that accounts come from Frank.
- **Audiobookshelf**: `category: admin → user`. Authentik SSO (PR #134) made it a household app, so the card belongs on the root page; the description names the SSO door and the per-listener positions.
- **Marreta**: the description said something it does not do. It now says what it is: a paywall sledgehammer that drags the article back through the VPN, strips the paywall chrome and trackers, renders JS-heavy pages with a headless browser, best effort.
**`shared/homepage/docs.html`** — the household page gains the Audiobookshelf row (same single sign-on, per-listener position), and the `frank-dragoon` list gets its missing `</ul>`. That one is pre-existing: with the list unclosed, the HTML parser nested the whole `frank-archon` section inside the dragon's last bullet. Confirmed against the live DOM before and after, not by eye.
**`dankclaw/Caddyfile`** — comment only, no route change. `jelly.franksdank.cloud` is now documented as exempt by construction (its own complete auth, the same exempt family as Plex / ABS / the *arr stack), with the accepted exposure written down: the sign-in form is internet-visible with no rate limiter on either side, because this Caddy build ships no `rate_limit` module.
**`shared/homepage/dankserver.services.json` — removed (35 lines).** Nothing read it: not `deploy.sh` (it copies named files), not the homepage checker, not any seam. `.AGENTTRASH/` is gitignored, so the hold is invisible to the seams regardless. The file is **held** at `shared/homepage/.AGENTTRASH/dankserver.services.json`, not deleted.
**Vault** — `Homepage.md` gains the law that the registry is the placement authority and its own lists are locators (disagreement means the page is the bug), plus Audiobookshelf in the user list. `Jellyfin.md` gains the API-key ledger and rotation section: the routes, the `204`-with-no-body mint, revoke-by-token, and the fact that neither `IsActive` nor `DateLastActivity` is a usage signal on 12.4.
# Evidence
- `./tests/run.sh`: **824 passed** on the committed tree.
- Managed-browser census of the rendered homepage and docs page before commit — card states, and the list-nesting defect observed in the DOM before and after the `</ul>`.
# Deploy
`scripts/deploy.sh dankclaw --service homepage` — docs are a no-op and the Caddyfile edit is a comment, so no container and no LLM endpoint is in the blast radius.
The `dankclaw/Caddyfile` path is in the frankbook blast radius, so the e2e gate
will run the `frankbook` project on this deploy even though the edit is a
comment: FrankBook-Pro has to be awake or the gate fails on an unrelated spec.
---
cwd: /home/blank/.omp/wt/wt-20261030-163847-6d1fc1f · session: 01a18f2e-18b1-7573-bcd5-ac9963f6f8cb (build worktree: /tmp/wt-ssogrant)
Jellyfin's card still read "Work in progress: not open to family users yet"
with no link; the server answers 12.4.0 on :8096 and carries a second
(non-admin) account, so the card flips to live status with its Open link on
http://jelly.franksdank.cloud. It has no Authentik link, and the copy says so.
Audiobookshelf moves category admin -> user. A card renders on exactly one
page, so it leaves /admin: Authentik SSO made it a household app, and the
household page is the door that matters.
Marreta's description now names what it is - the content-cleaning proxy in the
Gluetun netns with a headless companion - and its honest limit.
Also in this change:
- docs.html: a "Media & files" line for the audiobook door and its SSO, plus
the pre-existing unclosed <ul> under frank-dragoon, which made the whole
frank-archon block parse inside the dragoon bullet.
- Caddyfile: the jelly. vhost gains the exemption reason the External Exposure
Policy requires (comment only - Caddy strips comments, so no proxy bounce).
- Homepage.md: classification list gains Audiobookshelf, and the section now
states that services.json is the authority for placement/WIP/link.
shared/homepage/dankserver.services.json was read by nothing: no reference
anywhere in the repo, and deploy_homepage never copies it. It sat beside the
real registry looking like a second live card set, which is exactly how a
future agent gets misled about what the page renders. Moved to the gitignored
shared/homepage/.AGENTTRASH/ beside it, so it stays recoverable.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why
Three homepage surfaces described the live fleet falsely, and one registry file was dead weight. Frank ordered all of it 2026-11-03.
What changes
shared/homepage/services.json— the file that actually decides card behaviour:wip: "down"+ no link → live athttp://jelly.franksdank.cloud; the description now says it carries its own logins (no Authentik link) and that accounts come from Frank.category: admin → user. Authentik SSO (PR #134) made it a household app, so the card belongs on the root page; the description names the SSO door and the per-listener positions.shared/homepage/docs.html— the household page gains the Audiobookshelf row (same single sign-on, per-listener position), and thefrank-dragoonlist gets its missing</ul>. That one is pre-existing: with the list unclosed, the HTML parser nested the wholefrank-archonsection inside the dragon's last bullet. Confirmed against the live DOM before and after, not by eye.dankclaw/Caddyfile— comment only, no route change.jelly.franksdank.cloudis now documented as exempt by construction (its own complete auth, the same exempt family as Plex / ABS / the *arr stack), with the accepted exposure written down: the sign-in form is internet-visible with no rate limiter on either side, because this Caddy build ships norate_limitmodule.shared/homepage/dankserver.services.json— removed (35 lines). Nothing read it: notdeploy.sh(it copies named files), not the homepage checker, not any seam..AGENTTRASH/is gitignored, so the hold is invisible to the seams regardless. The file is held atshared/homepage/.AGENTTRASH/dankserver.services.json, not deleted.Vault —
Homepage.mdgains the law that the registry is the placement authority and its own lists are locators (disagreement means the page is the bug), plus Audiobookshelf in the user list.Jellyfin.mdgains the API-key ledger and rotation section: the routes, the204-with-no-body mint, revoke-by-token, and the fact that neitherIsActivenorDateLastActivityis a usage signal on 12.4.Evidence
./tests/run.sh: 824 passed on the committed tree.</ul>.Deploy
scripts/deploy.sh dankclaw --service homepage— docs are a no-op and the Caddyfile edit is a comment, so no container and no LLM endpoint is in the blast radius.The
dankclaw/Caddyfilepath is in the frankbook blast radius, so the e2e gatewill run the
frankbookproject on this deploy even though the edit is acomment: FrankBook-Pro has to be awake or the gate fails on an unrelated spec.
cwd: /home/blank/.omp/wt/wt-20261030-163847-6d1fc1f · session: 01a18f2e-18b1-7573-bcd5-ac9963f6f8cb (build worktree: /tmp/wt-ssogrant)