authzed · samkim · Sep 30, 2026 · Sep 29, 2026 · Sep 29, 2026 · Sep 29, 2026
diff --git a/.gitignore b/.gitignore
@@ -19,6 +19,8 @@ TODO
 .claude/
 .worktrees/
 .superpowers/
+# Superpowers design specs and plans: working notes, kept out of the repo.
+docs/superpowers/
 
 # mage desktop:* build outputs (rootfs.img, images-minimal.tar.zst, ap.app)
 # and downloaded upstream artifacts (Ubuntu cloud image, k3s release) — see

diff --git a/AGENTS.md b/AGENTS.md
@@ -348,9 +348,10 @@ mage manifests  # always after gen:api, OR after any config/ edit
 
 ## Documentation regeneration
 
-`mage docs:cli` and `mage docs:crd` regenerate the showcase docs site's
-reference pages — one from the live cobra tree, one from the CRD schemas under
-`config/crds`. Both are plain deterministic generators; neither invokes an LLM.
+`mage docs:cli` and `mage docs:crd` regenerate the docs site's reference pages —
+one from the live cobra tree, one from the CRD schemas under `config/crds` —
+writing into `site/content/docs`. Both are plain deterministic generators;
+neither invokes an LLM.
 
 `PRIMITIVES.md` (repo root) and `docs/owasp-agentic-top10-coverage.html` are
 both hand-maintained: update them by hand when a primitive's code moves or the
@@ -625,7 +626,7 @@ invisible in the mode everyone tests.** See
 
 ## Ship gate: all three test suites must pass before anything merges
 
-**Nothing ships — no merge to `master`, no push, no "done" — until all three
+**Nothing ships — no merge to `main`, no push, no "done" — until all three
 suites are green:**
 
 ```bash
@@ -809,7 +810,7 @@ false confidence. The integration and e2e tests are gated behind
 A change can leave the entire e2e suite red — or not even compiling — and the
 default `go test` run stays green.
 
-This is not hypothetical: the owner-derived approver refactor merged to `master`
+This is not hypothetical: the owner-derived approver refactor merged to `main`
 with the whole e2e suite broken (stale `started_by` model, a `pipeline.Authz`
 stub missing new methods, approval scenarios that no longer had a valid
 approver) because only the unit suite was run. Fixing it after the fact cost far
@@ -1029,7 +1030,7 @@ log): here "audit" means _review the code_, not _the append-only ledger_.
 ### What a pass does
 
 1. **Scope the target.** Default is the **whole repo** (`pkg/` + `cmd/`). Narrow
-   it when asked: "recent changes" → `git diff master...HEAD`; one or more named
+   it when asked: "recent changes" → `git diff main...HEAD`; one or more named
    packages → just those. The whole-repo pass is expensive by design — it
    partitions the 330+ leaf packages into subsystem groups and fans out — so use
    the narrowed forms for routine work and reserve the full sweep for a periodic
@@ -1089,13 +1090,13 @@ it):
 
 ```bash
 mage audit:all              # whole repo (pkg/ + internal/ + cmd/)
-mage audit:recent           # git diff master...HEAD (no-op if empty)
+mage audit:recent           # git diff main...HEAD (no-op if empty)
 mage audit:pkg pkg/memory   # a named package/dir
 ```
 
 Env overrides: `AUDIT_DRY_RUN=1` prints the prompt/command without invoking
 Claude; `AUDIT_CLAUDE_MODEL` (default `opus`) and `AUDIT_DIFF_BASE` (default
-`master`) override the model and the "recent" diff base. Or trigger a pass in
+`main`) override the model and the "recent" diff base. Or trigger a pass in
 plain language — "run an audit on `pkg/memory`" — following the steps above.
 
 ### Rules of thumb

diff --git a/README.md b/README.md
@@ -52,15 +52,15 @@ with many different owners.
 Every control in OAP therefore sits outside the model. The platform decides
 before the call, and the decision does not depend on the agent's cooperation.
 
-|                                     | Typical agent platform             | OAP                                  |
-| ----------------------------------- | ---------------------------------- | ------------------------------------ |
-| What an agent can reach             | Whatever its credentials allow     | Exactly what you granted             |
-| Who decides an action is allowed    | The model, in the moment           | The platform, before the call        |
-| An injected instruction mid-session | Can redirect the agent             | Cannot exceed the approved plan      |
-| Tool credentials                    | Shared across tools in one sandbox | Held only by the tool that uses them |
-| Restricting an MCP server           | Needs a narrow upstream token      | Declared by you, enforced per call   |
-| Revoking access                     | Rotate credentials, redeploy       | One permission graph call            |
-| The audit log                       | Append-only, enforced by the store | Signed, chained, verifiable offline  |
+|                                     | Typical agent platform             | OAP                                     |
+| ----------------------------------- | ---------------------------------- | --------------------------------------- |
+| What an agent can reach             | Whatever its credentials allow     | Exactly what you granted                |
+| Who decides an action is allowed    | The model, in the moment           | The platform, before the call           |
+| An injected instruction mid-session | Can redirect the agent             | Cannot widen what it's authorized to do |
+| Tool credentials                    | Shared across tools in one sandbox | Held only by the tool that uses them    |
+| Restricting an MCP server           | Needs a narrow upstream token      | Declared by you, enforced per call      |
+| Revoking access                     | Rotate credentials, redeploy       | One permission graph call               |
+| The audit log                       | Append-only, enforced by the store | Signed, chained, verifiable offline     |
 
 ## What makes it secure
 
@@ -192,9 +192,8 @@ On first launch, pick a model provider, enter its API key, and set a local admin
 password. OAP provisions the VM, configures the platform, and installs a demo
 agent.
 
-Desktop is single-player: good for trying OAP, developing and demoing agents, or
-running production agents one person owns and operates. Use Kubernetes when
-agents need a shared environment.
+Desktop is single-player: good for trying OAP and for developing and demoing
+agents. Use Kubernetes for anything durable or shared.
 
 **Local Kubernetes** installs onto a `kind` cluster for development:
 
@@ -340,10 +339,13 @@ outside it.
 
 ## Read the docs
 
+The docs are at [openap.org/docs](https://openap.org/docs). To run them locally
+instead:
+
 ```bash
-cd showcase
+cd site
 pnpm install
-pnpm docs:dev
+pnpm dev
 ```
 
 Then open [http://localhost:5179](http://localhost:5179) for installation

diff --git a/cmd/oap/clidocs_gen_test.go b/cmd/oap/clidocs_gen_test.go
@@ -7,7 +7,7 @@ import (
 	"github.com/authzed/openagentprimitives/pkg/gen/clidocs"
 )
 
-// TestGenerateCLIReference regenerates the showcase docs' CLI reference from the
+// TestGenerateCLIReference regenerates the site's CLI reference from the
 // live oap command tree. It is the gated driver for pkg/gen/clidocs (NewRootCmd
 // is in package main and can't be imported there). Runs only when
 // OAP_GEN_CLI_DOCS names an output dir — `mage docs:cli` sets it; a normal

diff --git a/cmd/oap/internal/channelcmd/root.go b/cmd/oap/internal/channelcmd/root.go
@@ -12,7 +12,7 @@ func NewCmd(g *apcmd.Globals) *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "channel",
 		Aliases: []string{"channels", "ch"},
-		Short:   "Manage Channel CRs (Slack, future webhook/cron, ...).",
+		Short:   "Manage Channel CRs (Slack, browser, GitHub webhooks, schedules, ...).",
 	}
 	cmd.AddCommand(
 		newChannelListCmd(g),

diff --git a/docs/assets/brand/README.md b/docs/assets/brand/README.md
@@ -34,6 +34,7 @@ the inlined copies too:
 | `pkg/platform/identityd/handlers_password.go`            | The icon on the sign-in page                                                                                                                       |
 | `cmd/oap/internal/desktop/setupui/static/index.html`     | The logomark in the desktop setup header, plus the icon                                                                                            |
 | `cmd/oap/internal/desktop/menubaricons/render/tunnel.go` | Not a copy: the menu-bar icons are drawn in code. `menuMarkCutout` carries the menu icon's cut-out; regenerate the PNGs with `mage desktop:icons`. |
+| `site/components/OapMark.tsx`                            | `OapMark`, the logomark inlined for the landing page and site footer so it inherits `currentColor` and needs no light/dark asset pair.             |
 
-The repo README and the showcase docs site (`showcase/docs/app`) reference the
-files here directly.
+The repo README and the docs + landing site (`site/`: the `Wordmark` component
+and the root layout icons) reference the files here directly.