Move project landings into the main site

Publish every registered project’s visitor-facing landing page at /projects// from the main site instead of a dedicated subdomain, and retire the per-project Pages repository, CNAME, and Terraform DNS stage that existed only to serve one page derived from the project README.

Each project owns its landing content in projects//site/content/ as pure content: no layouts, styles, or build rules. The main site packages those directories into content/projects// from the registry in projects/projects.bzl, so membership is declared once. The landing is a short hand-written page for visitors while the README keeps its /docs/projects// URL for repository reference documentation, and landing front matter now feeds the statuses, languages, and tags taxonomies.

Merge the reusable hugo_landing project into the main site: its shared canvas and accent styles and its landing page rules move into the apex tree, and its landing macro, generated configuration, standalone publisher, and repository-relative rewrite layouts are removed. The theme keeps owning the taxonomy and term layouts, which are richer than the heading-only versions the reusable project carried. Remove the now-unused apex deploy_project.sh and deploy_all.sh landing publishers with it.

Retire the per-project publication and DNS ownership: the project landing targets and the landing deployment command, each landing project’s dnsconfig.json and Terraform root, the build plumbing that served only those stages, and the landing repository and Pages membership in the repository catalog. The apex Terraform root is retained because it also declares VM resources, and no Vault configuration is changed.

Replace the provider-snapshot zone files with generated declaration pages, one per destination view, that project the checked-in declarations and are verified for freshness by the DNS offline check. The DNS linter, both destination pages, the apex site, the skills projection, and the repository quality suite pass, and the whole repository builds.

OpenSpec-Change: projects/alwaldend.com/openspec/changes/consolidate-project-landings-into-apex

LLM-disclaimer: This commit was generated by an LLM.

Manage forge resources with hermetic Terraform rules

Centralize organization, repository, and named access configuration in infra/repos. Adopt existing GitHub resources, protect master defaults while retaining Pages publication on pages, and preserve existing repository identities. Manage GitLab one-time imports, the F-Droid metadata fork, and default-branch protections through Vault-backed authentication. Forgejo consumes the same catalog. Ongoing repository synchronization is deferred.

Retire the eleven Bazel rule landing sites through their owning Terraform workflows, removing their DNS records, Pages repositories, and landing configuration. Move all twelve existing standalone rule modules into tools/ and retain their public interfaces and documentation on the main site.

Add tools/rules_terraform with verified provider downloads, packed mirrors in runfiles, and reusable Terraform execution rules. Enforce one version per provider source at an extensible resolution boundary. Migrate every Terraform consumer to thirteen shared provider pins in third_party/terraform. Execution and command maps belong to rules_terraform; consumers explicitly select generic AL wrappers for authentication and Vault injection. Remove tools/terraform and all 43 checked-in Terraform provider locks. Validate installed providers against the declared archives before execution.

Validation covers all fourteen workspace builds, all thirteen standalone test suites, Terraform consumers, offline real-provider regressions, rendered documentation, formatting, and semantic lint. The full root test run has 295 passing tests and one skip; its only failure is the historical secret scan, reduced to four pre-existing synthetic fixture matches. Earlier live imports and the exact landing retirement scope have verified postconditions; the Terraform rules migration uses only offline implementation checks.

OpenSpec-Change: infra/repos/openspec/changes/archive/2026-09-13-adopt-shared-repository-catalog OpenSpec-Change: infra/src/openspec/changes/archive/2026-09-13-retire-bazel-rule-landings OpenSpec-Change: tools/rules_terraform/openspec/changes/archive/2026-09-14-add-hermetic-terraform-rules OpenSpec-Change: tools/rules_terraform/openspec/changes/archive/2026-09-14-correct-terraform-ownership

LLM-disclaimer: This commit was generated by an LLM.

Deploy project DNS through Terraform modules

Move DNS ownership into each project’s Terraform state using shared modules. Load dnsconfig.json files at runtime, reject conflicting domain ownership, and render their records as a table. Add missing project AppRoles and scoped DNS policies, and document grouping related Terraform resources in modules.

Deploy all 45 owners sequentially: adopt 155 existing records and create 13 missing OpenHands records. Preserve every pre-existing provider record and verify no-op follow-up plans and DNS answers. Add DNS-scoped plan/show/apply wrappers with a saved-plan guard for roots that also manage services. Allow bounded aggregate path inventories large enough to deliver this migration while retaining truncation refusal in the delivery tool.

Validate runtime ownership, provider imports and preservation with isolated fixtures, Terraform formatting, wrapper builds, repository quality checks, semantic lint, and project documentation/specification builds.

OpenSpec-Change: infra/dns/openspec/changes/archive/2026-09-13-migrate-project-dns-to-terraform

LLM-disclaimer: This commit was generated by an LLM.

Fix Android review feedback

Add a shared androidPlugins version catalog so both Android apps declare the AGP, Kotlin, Compose, and protobuf plugin versions once, and derive their versions from it instead of duplicating literals per root Gradle file.

Align the launcher and ingester app versions with the repository versioning contract: development builds use 0.0.0-dev with versionCode 1 in both the Gradle default config and the Bazel manifest_values.

Ignore the whole materialized .agents/skills directory in Prettier because every entry is either a source-tree symlink or a byte-pinned external archive copy.

Apply the ingester’s themed surface background to the main content surface so the status bar area follows the system theme, not a default white surface.

Token: z-ai-glm-flash-latest

LLM-disclaimer: This commit was generated by an LLM.

Reorganize Gradle, fdroid, and android skill layout

Collapse the maven_install_gradle_converter and tools/gradle Starlark layers into flat defs.bzl files per the project-layout skill. Replace the fdroid shell wrapper with a Go binary. Rewrite the Android smoke test as a Go test. Move the android skill from the launcher project to tools/android and register it in the skill discovery map.

Token: claude-opus-4-6 LLM-Disclaimer: Generated with Claude, reviewed by Simeon Warren

Prefer signed APK in Android smoke test

The android_binary rule produces both a signed and unsigned APK; the smoke test script picked whichever find returned first, which could be the unsigned one and fail installation. Explicitly skip unsigned APKs.

Token: claude-opus-4-6 LLM-Disclaimer: Generated with Claude, reviewed by Simeon Warren

Use pinned Gradle and add Android smoke test

Replace the curl-based Gradle wrapper with a Bazel-pinned Gradle archive and the existing rules_java remote JDK, exposed through a Starlark wrapper rule. Add a manual Android launcher instrumentation smoke test for runtime APK verification, and document the test and pinned JDK usage. Exclude Gradle-generated verification metadata from Prettier by filename glob and remove the unnecessary third_party ignore entry.

LLM-disclaimer: This commit was generated by an LLM.

Simplify OpenSpec workspace globs

Collapse OpenSpec source globs to specs and changes, drop redundant package visibility blocks already covered by REPO.bazel, and regenerate the affected catalogs.

LLM-disclaimer: This commit was generated by an LLM.

Publish project sites and reproducible infrastructure diagrams

Build and deploy all 30 remaining project sites with the standard Docsy header, project descriptions and a linked documentation directory. Omit the repeated page title and generated language heading. Remove the unused cgit and xray_manager projects and retire their site resources.

Add a repeatable GitHub Pages publisher, staged Terraform bootstrap and direct GitHub Pages DNS records. Preserve repeated publication when pages is the remote default branch, and include Rules ISO in the main documentation. Document site onboarding in a registered, validated skill. Keep AL introduction short with useful links and preserve its lifecycle details in a dedicated documentation page.

Render all 15 existing infrastructure Drawio pages with pinned Drawio and Chrome inputs, sandboxed export actions, an update target and freshness checks, and include the maintained diagrams in infra/arch documentation. Paint an opaque white canvas to preserve readability in dark themes.

Validation covers project and apex builds, rendered pages, publisher tests, diagram repeatability and freshness, DNS configuration, Terraform formatting, semantic lint and repository quality.

Goal-Ref: build-and-deploy-every-project-landing-page-a782b800 Attempt-ID: attempt-00941092c164

LLM-disclaimer: This commit was generated by an LLM.

Extract DNSControl setup into rules_dnscontrol

Extract the DNSControl setup into rules_dnscontrol, generate its Bazel dependency bundle from project-owned record files, and update the DNS guidance. Move Hugo rules and the worker to role-based package paths, and give each non-nested project a locally owned Hugo landing target that reuses the shared README-to-landing macro.

Clean all landing and Pages DNS records so GitHub Pages serves each project subdomain directly without Cloudflare proxying. Improve the main site with a three-panel home layout, complete project links, documentation explore links, and current deployment guidance.

All affected root-workspace landing, DNS, and site targets pass, along with the nested rules_hugo tests, Buildifier, and repository quality checks.

LLM-disclaimer: This commit was generated by an LLM.

Add hermetic repository-wide formatting and linting

Integrate upstream formatters for the repository’s meaningful tracked source and configuration file types through Bazel, and add Buildifier, Ruff, and ShellCheck lint aspects for correctness-oriented repository-wide checks.

Pin all new external tools through Bzlmod or the existing pnpm lock, add thin cache/runfiles adapters where required, expose format and check targets, and wire the checks into the pre-commit workflow. Format the existing tree and fix the correctness defects uncovered by the new checks. Preserve generated sources and exact-content fixtures that are not safely rewritable, and clarify that ordinary infrastructure build output is safe to display.

Validation:

• all 21 repository quality and compatibility formatter tests pass
• Buildifier test passes
• lint aspects analyze all 4,629 ordinary root targets without findings
• the complete 18-command root and nested full-repository audit was exercised; remaining failures are documented environment or pre-existing test limits

LLM-disclaimer: This commit was generated by an LLM.

Add standalone documentation rules

Move docs_filegroup into a reusable rules_docs nested Bzlmod workspace and migrate every root and nested consumer to it. Add a module-aware Gazelle language that creates docs targets only for existing README packages while preserving manual mappings.

Wire the workspace into module resolution, documentation aggregation, and the ten-command full-repo-check. Add the bazel-nested-module skill so future nested workspaces follow the repository’s rc, lockfile, docs, toolchain, Gazelle, and validation conventions.

Keep reviewed Gazelle dependency canonicalization, while protecting the hand-maintained Go proto, Python resource, Android, embedded-site, and skill runner definitions that generic language plugins would otherwise break.

This commit was generated by an LLM.

Migrate documentation packaging to docs_filegroup

Preserve custom prefixes, renames, strip prefixes, and standalone workspace behavior.\n\nThis commit was generated by an LLM.

Add spellcheck skill

This commit was generated by an LLM.

Restore light and dark site canvases and set the shared accent

The shared Docsy canvas set the same Bootstrap dark palette and the same black page background on :root, [data-bs-theme="light"], and [data-bs-theme="dark"], so the light/dark toggle changed nothing. The site also rendered Bootstrap’s stock blue instead of its intended accent.

Split the shared palette so light mode uses a pure white canvas with the light-mode palette and dark mode uses a pure black canvas with the dark-mode palette, and keep the pre-stylesheet paint and footer on the active mode. Assign $primary to #7c3aed before Bootstrap compiles, so links, buttons, badges, focus rings, and the dark-mode link tint all derive from one value rather than from a site-local copy.

Both files stay in the reusable shell; the apex site consumes them through the existing declared exports and no longer carries the footer’s own blue.

OpenSpec-Change: projects/hugo_landing/openspec/changes/restore-light-dark-canvas-and-accent

LLM-disclaimer: This commit was generated by an LLM.