Canonical silentmode.st URLs no longer carry a trailing slash (/tools, not
/tools/). nginx (tracked now in VPS/SilentMode/silentmode-st.nginx) 301s
the old form and serves <dir>/index.html; sub-sites deployed from other
repos with relative asset paths (deviant, sirius-x, theseus-x, hephaestus.x,
fly.x, code) keep their directory URLs. Every page's internal links are
now site-root-relative, which resolves correctly both at /x on nginx and
under the BNS gateway's injected <base href="/bns/silentmode.bch/"> — the
old ../x/ links were already broken on the gateway route.
/theseus becomes the Silent Mode-headered Theseus page (what it is, what's
inside, Windows + Android downloads with manifest hashes, verify), linking
out to the sovereign theseus.x whose VPS mirror moves to /theseus-x/, the
same split as /sirius vs /sirius-x/. /tools is repurposed as the overview:
every site, the on-chain twins, the other clients (relay, Firefox, the
standalone Ariadne Resolver) and the machine endpoints. The old tools page
carried stale APK and resolver hashes; the new pages use the manifest's,
verified against the files on dl.silentmode.st.
scripts/serve-site.mjs mirrors the nginx rules for local preview.
Browsers held a stale shared.css (no Cache-Control on .css, weeks-old
Last-Modified → long heuristic freshness), so the .brand .logo rule added
on 2026-09-07 never applied for returning visitors and the brand wrapped
onto its own nav row on every page except Hephaestus. All 13 pages now
link shared.css?v=YYYYMMDD; bump it on every shared.css change (GOTCHAS).
- inline chain-link logo in every top nav and the two chain-emoji hero marks
(index, sirius/register); shared.css sizes/colours it via .l1/.l2
- homepage hero figure: Theseus opening hello.bch (BCDN badge, no DNS)
- Open Graph + Twitter card meta on all 13 silentmode.st pages, image
brand/og.png (1200x630, rendered from the brand kit)
- contrast: --dim 5e6678 -> 7a8496 (3.4:1 -> 5.1:1); default .btn no longer
off-palette blue with 3.9:1 white text, now panel2/ink; nav links 9px pad
- figure.shot styles for screenshots; tools/img/ holds the Theseus and
Ariadne-Android shots for the download cards (wired in a follow-up, the
tools page is mid-ship in another session)
- scripts/serve-site.mjs: zero-dep static server for previewing site/
Two brand kits, one design language. Each site now has a /brand/ page + a
favicon; every page I own on silentmode.st links the SVG favicon (parallel
sessions can add the same line to Sirius/Hephaestus/Choose when they touch
those files).
Silent Mode kit (site/brand/, site/favicon.svg):
Mark — two interlocking chain links, one muted (#8b98a9) + one acid
(#d6ff3d). The umbrella family mark.
Logo, wordmark, avatar (400x400 social), banner (1500x500 social header).
Brand page shows every asset with SVG download, colour palette
(tokens matching shared.css), usage do's and don'ts.
navigate.st kit (navigate.st/brand/, navigate.st/favicon.svg):
Mark — compass rose (N acid, other points muted) inside a chain-link
ring. Ring keeps it in the Silent Mode family without cloning the
SilentMode mark; compass says what this specific site is (the
wayfinding front door).
Same asset set: logo, wordmark, avatar, banner. Standalone brand page
(no shared.css — navigate.st runs single-file).
nginx (VPS): added two locations to sites-enabled/navigate-st so /favicon.svg
and /brand/* resolve from /opt/silent-mode/navigate-brand/. Rollback point
at sites-enabled/navigate-st.bak.1788146513. silentmode.st serves both from
disk under /opt/silent-mode/site/ — no vhost change needed.
Verified live: all favicon + brand URLs return 200 on both hosts.
Site:
- Rename the "Tools" nav label to "Theseus" on every subpage. URL slug
/tools/ is kept intact so bookmarks and cross-links survive; the page's
own title + h1 rename to Theseus; homepage product card retitled.
- Remove the /tlds/ self-nav entry so its 7-item header matches every
other subpage (was 8 items, causing the same "header rearranges" glitch
Hephaestus had before).
Auth-proxy (fixes reported by a concurrent session working with a chipnet
wallet):
- verify.ts now auto-detects the CashAddr prefix (bitcoincash, bchtest,
bchreg) instead of hardcoding "bitcoincash". Chipnet wallets sign the
same message with the same key but display bchtest: addresses; the old
code compared their claim against a re-encoded bitcoincash: version and
always rejected. Same key material, different envelope.
- /challenge accepts any of the three known prefixes at the input gate.
- /verify accepts an optional `state` param in the request body — used as
a fallback if the challenge record didn't carry one (which happens when
a scripted caller runs the /verify step without passing state through
/challenge). Ensures RFC 6749 §4.1.2 compliance: the OAuth callback URL
always echoes state when the client provided one.
Every silentmode.st subpage was missing Hephaestus in its topnav, so clicking
Hephaestus from the homepage led to a page whose nav had a different item set —
looked like the header "rearranged and dropped tabs" mid-navigation.
- Add <a href="../hephaestus/">Hephaestus</a> between Sirius and Helios on:
tools, prometheus, sirius, helios, hermes, releases, tlds
- Normalize hephaestus/index.html to use relative paths (../foo/) matching the
convention used by every other subpage — was absolute (/foo/)
- Result: every page has 7 identical nav items in the same order, with
class="here" on whichever section you're viewing. /hephaestus/ keeps its
"Open forge →" CTA appended (an addition, not a reorder).
Was only .bch. The daemon and CA already handle these four TLDs; the NRPT
rule was the missing piece that made .p2p / .bit / .nav queries never reach
the daemon at all (they went to ICANN's normal DNS and NXDOMAIN'd).
Dual TLDs (.de .ru .dev .ltd) intentionally NOT here. They need the
daemon's DNS-forwarding path to work reliably for unregistered names,
and there's still an open EDNS/AAAA forwarding bug in bnsd.js that
would break most German/Russian sites if we NRPT'd .de.
Adding more native TLDs (.x .sia .dgb .nt from Theseus's expanded set)
needs a CA rotation first — the current CA's nameConstraints only permit
bch/p2p/bit/deviant/nav/test/bcnr. Deferred.
