Homepage (session redesign) + docs/blog sync from upstream

.github/workflows/sync-install-sh.yml

@@ -0,0 +1,75 @@
+name: sync-install-sh
+
+# Keep the live https://pilotprotocol.network/install.sh in sync with the
+# canonical script. The pilot-release Worker serves /install.sh from the
+# pilot-release-assets R2 bucket — NOT from Pages — so a git-side fix that
+# never reaches R2 is invisible to users. That exact gap shipped a stale,
+# broken installer for ~6 weeks (fresh installs aborted at
+# "cp: pilot-gateway: No such file or directory", reported 2026-07-06).
+#
+# Source of truth: pilot-protocol/release:install.sh (main).
+# This repo's public/install.sh is a shadowed fallback kept byte-identical.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - public/install.sh
+      - .github/workflows/sync-install-sh.yml
+  schedule:
+    - cron: '17 6 * * *'   # daily — catches changes that land only in pilot-protocol/release
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sync-install-sh
+  cancel-in-progress: true
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Fetch canonical install.sh from pilot-protocol/release
+        run: |
+          curl -fsSL "https://raw.githubusercontent.com/pilot-protocol/release/main/install.sh" -o canonical-install.sh
+          bash -n canonical-install.sh
+          # The installer must never hard-depend on the gateway binary —
+          # release tarballs ship daemon/pilotctl/updater only. Guard the
+          # regression that broke fresh installs.
+          if grep -qE '^\s*cp "\$TMPDIR/pilot-gateway"' canonical-install.sh; then
+            if ! grep -qE 'elif \[ -f "\$TMPDIR/pilot-gateway" \]' canonical-install.sh; then
+              echo "::error::canonical install.sh copies pilot-gateway unconditionally — refusing to publish a script that aborts fresh installs"
+              exit 1
+            fi
+          fi
+
+      - name: Warn when the Pages fallback copy has drifted
+        run: |
+          if ! diff -q canonical-install.sh public/install.sh >/dev/null; then
+            echo "::warning::public/install.sh differs from pilot-protocol/release:install.sh — the live copy (R2) follows the release repo; update public/install.sh to match"
+          fi
+
+      - name: Upload to R2 (served by the pilot-release Worker)
+        env:
+          # CLOUDFLARE_API_TOKEN (Pages-scoped) returned 403 code 10000 on the
+          # R2 objects endpoint — mint a token with Account → R2 → Edit scope
+          # and store it as CLOUDFLARE_R2_TOKEN. Falls back to the Pages token
+          # so the day that one gains R2 scope this also starts working.
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_R2_TOKEN || secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          npx --yes wrangler@4 r2 object put pilot-release-assets/install.sh \
+            --file canonical-install.sh \
+            --content-type "text/plain; charset=utf-8" \
+            --remote
+
+      - name: Verify the live URL serves the canonical script
+        run: |
+          sleep 5
+          curl -fsSL -H 'Cache-Control: no-cache' "https://pilotprotocol.network/install.sh" -o live-install.sh
+          diff canonical-install.sh live-install.sh
+          echo "live install.sh matches canonical"

.gitignore

@@ -12,3 +12,6 @@ worker/coverage/
 
 .env
 .gstack/
+
+# macOS
+.DS_Store

.snippets/blog-bar.md

@@ -0,0 +1,144 @@
+# Latest-blog bar (saved for later re-insertion)
+
+A slim, angular, theme-flipping (white-on-dark / black-on-light) outlined strip with
+an outer glow, showing the 3 most recent blog posts (thumbnail + date + title) below
+the thesis section's "One line of code gets an agent online. No SDK. No API key."
+
+Removed from `src/pages/index.astro` on 2026-07-07 at the user's request; restore all
+three pieces below verbatim when asked to "put the blog bar back".
+
+---
+
+## 1. Frontmatter (top of `src/pages/index.astro`, after the `getLiveStats` import + call)
+
+Add the import:
+```js
+import { blogPosts } from '../data/blogPosts';
+```
+
+Add after `const { liveAgents, liveAgentsExact, liveRequests } = await getLiveStats();`:
+```js
+// Three most recent posts for the thesis blog bar, newest first.
+const latestPosts = [...blogPosts]
+  .sort((a, b) => (b.iso_date ?? '').localeCompare(a.iso_date ?? ''))
+  .slice(0, 3);
+```
+
+## 2. Markup — inside `#thesis`, immediately after the closing `</div></div>` of the
+`.thesis` block (i.e. right after the "One line of code…" paragraph's container),
+before the section closes:
+
+```html
+    <!-- Latest blog posts bar. -->
+    <div class="blog-bar">
+      <div class="bb-label">
+        <span class="bb-eyebrow">From the blog</span>
+        <a class="bb-all" href="/blog/">All posts →</a>
+      </div>
+      <div class="bb-posts">
+        {latestPosts.map((post) => (
+          <a class="bb-post" href={`/blog/${post.slug}`}
+             data-track="cta_click" data-track-target="blog" data-track-location="thesis">
+            <span class="bb-thumb">
+              <img src={`/blog/${post.banner}`} alt="" loading="lazy" />
+            </span>
+            <span class="bb-body">
+              <span class="bb-date">{post.date}</span>
+              <span class="bb-title">{post.title}</span>
+            </span>
+          </a>
+        ))}
+      </div>
+    </div>
+```
+
+## 3. CSS — inside the homepage `<style>` block:
+
+```css
+  /* Latest-blog bar under the thesis — slim, angular, theme-flipping outline + glow. */
+  .blog-bar {
+    margin-top: 40px;
+    padding: 30px 32px;
+    /* Theme-flipping outline: near-white in dark mode, near-black in light mode. */
+    border: 1px solid color-mix(in srgb, var(--ink) 55%, transparent);
+    /* Soft outer glow in the same theme-flipping tone. */
+    box-shadow:
+      0 0 24px color-mix(in srgb, var(--ink) 18%, transparent),
+      0 0 4px color-mix(in srgb, var(--ink) 22%, transparent);
+    display: flex;
+    align-items: center;
+    gap: 36px;
+  }
+  .bb-label {
+    display: flex;
+    flex-direction: column;
+    gap: 3px;
+    flex: none;
+  }
+  .bb-eyebrow {
+    font-family: var(--mono);
+    font-size: 11px;
+    letter-spacing: 0.14em;
+    text-transform: uppercase;
+    color: var(--accent);
+  }
+  .bb-all {
+    font-family: var(--mono);
+    font-size: 11px;
+    letter-spacing: 0.04em;
+    color: var(--ink-dim);
+    text-decoration: none;
+  }
+  .bb-all:hover { color: var(--accent); }
+  .bb-posts {
+    flex: 1;
+    display: grid;
+    grid-template-columns: repeat(3, 1fr);
+    gap: 10px;
+  }
+  .bb-post {
+    display: flex;
+    align-items: center;
+    gap: 14px;
+    padding: 10px 10px;
+    text-decoration: none;
+    color: inherit;
+    transition: background 0.15s;
+  }
+  .bb-post:hover { background: color-mix(in srgb, var(--ink) 8%, transparent); }
+  .bb-thumb {
+    flex: none;
+    width: 168px;
+    aspect-ratio: 1200 / 630;
+    overflow: hidden;
+    background: var(--bg-2);
+  }
+  .bb-thumb img { width: 100%; height: 100%; object-fit: contain; display: block; transition: transform 0.3s ease; }
+  .bb-post:hover .bb-thumb img { transform: scale(1.05); }
+  .bb-body { display: flex; flex-direction: column; gap: 5px; min-width: 0; }
+  .bb-date {
+    font-family: var(--mono);
+    font-size: 11px;
+    letter-spacing: 0.08em;
+    text-transform: uppercase;
+    color: var(--ink-dim);
+  }
+  .bb-title {
+    font-size: 15px;
+    line-height: 1.4;
+    letter-spacing: -0.01em;
+    color: var(--ink);
+    display: -webkit-box;
+    -webkit-line-clamp: 2;
+    -webkit-box-orient: vertical;
+    overflow: hidden;
+  }
+  .bb-post:hover .bb-title { color: var(--accent); }
+  @media (max-width: 860px) {
+    .blog-bar { flex-direction: column; align-items: stretch; gap: 14px; }
+    .bb-label { flex-direction: row; align-items: baseline; justify-content: space-between; }
+  }
+  @media (max-width: 600px) {
+    .bb-posts { grid-template-columns: 1fr; }
+  }
+```