Sidebar was a small strip in the middle of the page. Now it lives on
the left edge as a proper column, sized to be reachable — 220px full
mode with icon + label per link, on the operator's brand backdrop.
Breakpoints:
>1180px full sidebar, icon + label, "ON THIS PAGE" section header
<=1180px 64px icon rail, labels drop, tooltips on hover
<=720px bottom bar strip, icons only, spans page width
body padding-left carries the sidebar width so the topnav and page
content flow as one column beside the rail — no overlap on any width.
Home has 4 icons (What it is / Features / Download / Verify), Plug-ins
has 3 (Aegis / Ariadne's Thread / vs extensions), Extensions has 6
(Bundled / Community / Build & publish / Updates / Operator key /
Roadmap).
The top nav was a mix of anchor links (#what, #features, #verify) and
site tabs (/plug-ins/, /extensions/). Sub-pages dropped the anchor-only
items, so the header visibly reshuffled between pages — clicking a tab
looked like a partial page break, not a navigation.
Top nav is now the same five items on every page: brand → Theseus.X,
Home / Plug-ins / Extensions / sirius.x / Get Theseus. Section anchors
moved to a fixed left sidebar (position: fixed, sits outside the
centered content column, hidden below 1180-1200px). IntersectionObserver
highlights the current section in acid green as the reader scrolls.
Sub-pages get their own left sidebar for the sections they actually
contain (Plug-ins: 3; Extensions: 6), so the pattern is consistent
across the site instead of home-only.
Brand text bumped to capital T + capital X.
Anyone who owns a BCDN name can now publish a Theseus extension, and every
Theseus can install it with the publisher's signature verified locally.
Gateway (Argus/src/gateway/public-gateway.mjs):
PUT /api/ext/<name>/<id>/<version> takes the gzipped tar, checks two BCH
message signatures against the name's current NFT owner (one authorises
the upload, one is stored in the channel), inspects the package
(addon.json at the root, id/version/main match, 8 MB cap), enforces
first-publisher ownership of an id and monotonic versions, and writes the
tarball, the extension's updates.json and community/catalog.json to Sia.
GET /api/ext/catalog reads the catalog back with CORS.
Theseus:
lib/publisher-sig.mjs recovers the signer of a channel entry; main.js
compares it with the publisher name's owner from Theseus's own chain
index before installing or updating, so neither the relay nor a tampered
catalog can pass off code under a trusted name. addon-updater.js gains
installCommunity() and accepts publisher-signed entries in the regular
update check (operator Ed25519 entries unchanged). Settings › Extensions
shows the community catalog with Install / Update; Settings › Plug-ins
links to theseus.x/plug-ins.
theseus.x:
/plug-ins/ is a separate page for the first-party plug-ins (Aegis,
Ariadne's Thread) with live versions and hashes; /extensions/ lists the
bundled extensions, the community catalog, and how to build and publish;
/extensions/publish/ signs and uploads a package in the browser with the
wallet that holds the publisher's name (session helper + wallet bundle
copied alongside).
