{
  "artifact_id": "ghostmesh-access-posture-decision-v01",
  "title": "Ghostmesh Access Posture Decision V01",
  "issue": 188,
  "date": "2026-06-30",
  "baseline_commit": "2866a7a71d6467b984fe283bbc2b6e781000ba4f",
  "decision": {
    "recommended_posture": "hybrid",
    "summary": "Keep a public landing and approved public package/corpus surface while protecting proof/API, future private artifacts, company-specific content, uploaded/session-source behavior, and external/current context lanes.",
    "do_not_protect_entire_site_now": true,
    "full_site_protection_future_condition": "private beta or controlled-access evaluation where public discoverability is intentionally paused"
  },
  "evaluated_options": [
    {
      "id": "split_public",
      "label": "Keep current split posture",
      "public_static_site": true,
      "public_approved_corpus": true,
      "protected_proof_api_routes": true,
      "recommended": false
    },
    {
      "id": "full_site_protected",
      "label": "Protect the entire site",
      "pattern": "https://ghostmesh.ai/* behind Cloudflare Access",
      "public_playbook_surface": false,
      "suitable_for_private_beta": true,
      "recommended": false
    },
    {
      "id": "hybrid",
      "label": "Hybrid",
      "public_landing_and_package_surface": true,
      "protected_artifacts_proof_api": true,
      "explicit_public_private_navigation_split": true,
      "recommended": true
    }
  ],
  "surface_recommendations": {
    "public": [
      "public landing and package orientation pages",
      "approved public playbook and package artifacts",
      "public context-pack mirror under /context-pack/",
      "public artifact manifest, hashes, and portable export links approved for controlled sharing",
      "field-guidance and non-approval boundary documentation"
    ],
    "protected": [
      "source-grounded proof page when it can trigger or demonstrate provider-backed execution",
      "/api/source-grounded-chat and any provider-backed API route",
      "future private artifacts",
      "company-specific content",
      "uploaded/session-source workflows",
      "external/current context mode when it uses live retrieval, provider execution, or less-public source sets",
      "operator receipts with external-account implementation details"
    ],
    "future_private": [
      "private artifacts",
      "company-specific content",
      "uploaded or pasted session source",
      "less-public enrichment sources",
      "current/external source lanes that require protected runtime smoke"
    ]
  },
  "required_coverage": {
    "controlled_sharing_posture": "public controlled-sharing remains for approved package material; protected sharing is required for provider-backed proof, private enrichment, company-specific content, and session-source behavior",
    "public_vs_private_artifact_identity": "public artifacts need stable identity and non-approval boundaries; private artifacts need Access requirement, source authority boundary, and receipt trail",
    "source_corpus_publication": "approved package corpus can remain public; less-public, private, company-specific, uploaded, or current/external enrichment sources must not enter the public approved corpus by default",
    "seo_discoverability": "public landing and approved package pages remain discoverable; protected proof/API and private enrichment lanes do not depend on SEO",
    "provider_backed_proof_api_risk": "proof/API stays protected by Access or equivalent control plus server-side provider boundaries",
    "future_company_specific_content": "protected by default unless a separate owner-approved public release decision lands",
    "uploaded_session_source_behavior": "session-provided material is not approved package corpus or enterprise source authority unless separately approved",
    "external_current_context_mode": "protected or Preview-gated until source authorization, runtime smoke, and validation receipts exist",
    "validation_and_smoke_checks": "public static smoke plus protected proof/API smoke are separate checks",
    "docs_and_receipts": "route inventory, decision note, validation receipt, published-site contract coverage, and PR boundary confirmations are required",
    "redirects_and_fallback_domains": "www redirect, apex authority, and GitHub Pages fallback must not bypass protected surfaces",
    "relationship_to_182": "#182 remains the later implementation lane for the hybrid protection/access-control surface"
  },
  "issue_182_guidance": {
    "should_be_next": true,
    "recommended_status": "remain open or be narrowed as implementation lane after this decision lands",
    "recommended_scope": [
      "route inventory",
      "hybrid public/private navigation split",
      "public approved package and context-pack inspection preservation",
      "proof/API protection",
      "published-site and protected-route smoke checks",
      "redirect and fallback-domain behavior",
      "validation receipt"
    ],
    "excluded_scope": [
      "broad Cloudflare rebuild",
      "provider/model change",
      "source registry change",
      "approved source-set change",
      "package-authority change",
      "uploaded/session-source implementation",
      "external/current context implementation",
      "company-specific content lane"
    ]
  },
  "boundary": {
    "no_full_site_cloudflare_access_implementation": true,
    "no_route_level_access_changes": true,
    "no_cloudflare_cli_or_api": true,
    "no_cloudflare_configuration_change": true,
    "no_company_specific_content_publication": true,
    "no_uploaded_or_session_source_behavior": true,
    "no_external_or_current_context_mode": true,
    "no_provider_or_model_configuration_change": true,
    "no_source_grounded_chat_runtime_behavior_change": true,
    "no_route_level_access_removal": true,
    "no_broad_enterprise_or_policy_approval_claims": true,
    "no_issue_relabeling": true,
    "no_issue_close_or_reopen": true,
    "no_follow_up_ticket_creation": true,
    "no_269_or_271_reopen": true,
    "no_codex_automerge": true
  },
  "validation_expectations": [
    "python3 -B scripts/build_context_pack.py",
    "python3 -B validation/scripts/check_ghostmesh_access_posture_decision.py",
    "python3 -B validation/scripts/check_context_pack.py",
    "python3 -B validation/scripts/check_minimal_external_chat_proof.py",
    "python3 -B validation/scripts/check_published_site_contract.py",
    "python3 -B validation/scripts/run_all.py",
    "git diff --check"
  ]
}