@caelo-cms/provisioning 0.10.50 → 0.10.52

package/stacks/aws/index.ts

@@ -32,6 +32,12 @@ import * as aws from "@pulumi/aws";
 import * as awsx from "@pulumi/awsx";
 import * as pulumi from "@pulumi/pulumi";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
+import {
+  AWS_SERVICE_SECRETS,
+  type AwsSecret,
+  type AwsTaskService,
+  secretsReadPolicy,
+} from "../../dist/aws-task-roles.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
 import { ADMIN_MEMORY_DEFAULT, memoryQuantityMiB } from "../../dist/stack-contract.js";
 
@@ -89,9 +95,11 @@ function randomHex(bytes: number): string {
 }
 
 const postgresPassword = pulumi.secret(randomHex(32));
-// #613 — one password per database role, so the gateway (public_role +
-// gateway_role) never holds admin_role's. bootstrap.sh creates the roles
-// with these (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD).
+// #613 — one password per database role, so the gateway (public_role only,
+// #635) never holds admin_role's. bootstrap.sh creates the roles with these
+// (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD). gateway_role is no longer
+// any service's login; its password stays until the contract release that
+// drops the role (#635).
 const publicRolePassword = pulumi.secret(randomHex(32));
 const gatewayRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
@@ -163,13 +171,6 @@ const publicDatabaseUrl = pulumi
     ([host, port, pw]) =>
       `postgresql://public_role:${pw}@${host}:${port}/cms_public?sslmode=require`,
   );
-// The gateway's cms_admin login (#613): grants from migration 0248 only.
-const gatewayDatabaseUrl = pulumi
-  .all([db.address, db.port, gatewayRolePassword])
-  .apply(
-    ([host, port, pw]) =>
-      `postgresql://gateway_role:${pw}@${host}:${port}/cms_admin?sslmode=require`,
-  );
 
 // === 4. S3 buckets ===
 const mediaBucket = new aws.s3.BucketV2(`${namePrefix}-media`, {
@@ -296,7 +297,14 @@ const distribution = new aws.cloudfront.Distribution(`${namePrefix}-cdn`, {
     minimumProtocolVersion: "TLSv1.2_2021",
   },
   restrictions: { geoRestriction: { restrictionType: "none" } },
+  // #802 — unknown URLs get the site's own 404 page (the generator writes
+  // `/404.html` from the designated page) with status 404. The S3 origins
+  // are OAI-only with `s3:GetObject` and no `s3:ListBucket`, so S3 answers
+  // a missing key with 403, not 404; without the 403 entry visitors saw
+  // S3's AccessDenied XML. Both origins on this distribution are private
+  // buckets, so a 403 here always means "no such object".
   customErrorResponses: [
+    { errorCode: 403, responseCode: 404, responsePagePath: "/404.html", errorCachingMinTtl: 60 },
     { errorCode: 404, responseCode: 404, responsePagePath: "/404.html", errorCachingMinTtl: 60 },
   ],
 });
@@ -349,38 +357,48 @@ const cluster = new aws.ecs.Cluster(`${namePrefix}-ecs`, {
   settings: [{ name: "containerInsights", value: "enabled" }],
 });
 
-const taskRole = new aws.iam.Role(`${namePrefix}-task-role`, {
-  assumeRolePolicy: JSON.stringify({
-    Version: "2012-10-17",
-    Statement: [
-      {
-        Effect: "Allow",
-        Principal: { Service: "ecs-tasks.amazonaws.com" },
-        Action: "sts:AssumeRole",
-      },
-    ],
-  }),
-});
+// One task role per service (#635): the gateway's may read only the
+// public_role password, never a secret that unlocks a cms_admin login
+// (src/aws-task-roles.ts AWS_SERVICE_SECRETS, asserted by
+// gateway-env-isolation.test.ts). The admin keeps the logical names the
+// former shared role had, so upgrading replaces nothing on its side.
+const secretArns: Record<AwsSecret, pulumi.Output<string>> = {
+  "postgres-password": pgSecret.arn,
+  "public-role-password": publicRoleSecret.arn,
+  "gateway-role-password": gatewayRoleSecret.arn,
+  "csrf-secret": csrfSecretRes.arn,
+  "cookie-secret": cookieSecretRes.arn,
+  "anthropic-api-key": anthropicSecretRes.arn,
+  "resend-api-key": resendSecretRes.arn,
+};
 
-new aws.iam.RolePolicy(`${namePrefix}-task-secrets`, {
-  role: taskRole.id,
-  policy: pulumi
-    .all([
-      pgSecret.arn,
-      publicRoleSecret.arn,
-      gatewayRoleSecret.arn,
-      csrfSecretRes.arn,
-      cookieSecretRes.arn,
-      anthropicSecretRes.arn,
-      resendSecretRes.arn,
-    ])
-    .apply((arns) =>
-      JSON.stringify({
-        Version: "2012-10-17",
-        Statement: [{ Effect: "Allow", Action: "secretsmanager:GetSecretValue", Resource: arns }],
-      }),
-    ),
-});
+function taskRole(service: AwsTaskService): aws.iam.Role {
+  const prefix = service === "admin" ? namePrefix : `${namePrefix}-${service}`;
+  const role = new aws.iam.Role(`${prefix}-task-role`, {
+    assumeRolePolicy: JSON.stringify({
+      Version: "2012-10-17",
+      Statement: [
+        {
+          Effect: "Allow",
+          Principal: { Service: "ecs-tasks.amazonaws.com" },
+          Action: "sts:AssumeRole",
+        },
+      ],
+    }),
+  });
+  new aws.iam.RolePolicy(`${prefix}-task-secrets`, {
+    role: role.id,
+    policy: pulumi
+      .all(AWS_SERVICE_SECRETS[service].map((name) => secretArns[name]))
+      .apply(secretsReadPolicy),
+  });
+  return role;
+}
+
+const taskRoles: Record<AwsTaskService, aws.iam.Role> = {
+  admin: taskRole("admin"),
+  gateway: taskRole("gateway"),
+};
 
 const execRole = new aws.iam.Role(`${namePrefix}-exec-role`, {
   assumeRolePolicy: JSON.stringify({
@@ -421,7 +439,6 @@ const dnsRecordsRequired: DnsRecord[] = [
 const out: CloudAdapterOutputs = {
   adminDatabaseUrl: adminDatabaseUrl as unknown as string,
   publicDatabaseUrl: publicDatabaseUrl as unknown as string,
-  gatewayDatabaseUrl: gatewayDatabaseUrl as unknown as string,
   mediaStorageUrl: pulumi.interpolate`s3://${mediaBucket.bucket}` as unknown as string,
   mediaCdnBaseUrl:
     pulumi.interpolate`https://${distribution.domainName}/media` as unknown as string,
@@ -436,7 +453,6 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
-export const gatewayDatabaseUrlOut = out.gatewayDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;
@@ -448,6 +464,9 @@ export const cloudfrontDomainOut = distribution.domainName;
 export const redirectKvsArnOut = redirectKvs.arn;
 export const ecsClusterArnOut = cluster.arn;
 export const rdsAddressOut = db.address;
+// The task roles the admin-side and gateway task definitions run as.
+export const adminTaskRoleArnOut = taskRoles.admin.arn;
+export const gatewayTaskRoleArnOut = taskRoles.gateway.arn;
 
 // Note: the bootstrap token (and other secrets like postgres-password,
 // CSRF/cookie secrets, Anthropic key) are stored in Pulumi's encrypted

package/stacks/azure/README.md

@@ -10,13 +10,15 @@ Pulumi stack provisioning Caelo on Azure managed services. Implements the shared
 | Blob storage | Storage Account with a private `media` container and static-website hosting (`$web`) |
 | CDN / Edge | Azure Front Door Standard: the primary domain serves the static website as files, with a Front Door managed certificate; no edge compute on the request path |
 | Container runtime | Four Container Apps (admin / gateway / orchestrator / runner) in one managed environment |
-| Secret store | Key Vault (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway container gets `GATEWAY_DATABASE_URL` + `PUBLIC_DATABASE_URL`, never an admin credential (#613). |
+| Secret store | Key Vault (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway container gets `PUBLIC_DATABASE_URL` only, never a cms_admin credential of any role (#613, #635). |
 | Edge-log sink | Log Analytics workspace receives Container Apps logs (queryable by P12A analytics plugin via Azure Monitor) |
 
 The Caelo runtime never knows it's on Azure — every Container App consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.
 
 ## First-time install
 
+Run this stack from a checkout of the Caelo repository after `bun install` at its root. `@pulumi/azure-native` is a devDependency of `@caelo-cms/provisioning`: the CLI wizard does not provision Azure yet, so the published package does not make every GCP and self-hosted install download it (the one-click install from Cloud Shell runs in a 5 GB home directory). It moves back to `dependencies` when the Azure wizard ships.
+
 ```bash
 cd packages/provisioning/stacks/azure
 pulumi stack init prod

package/stacks/azure/index.ts

@@ -81,9 +81,11 @@ function randomHex(bytes: number): string {
 }
 
 const postgresPassword = pulumi.secret(randomHex(32));
-// #613 — one password per database role, so the gateway (public_role +
-// gateway_role) never holds admin_role's. bootstrap.sh creates the roles
-// with these (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD).
+// #613 — one password per database role, so the gateway (public_role only,
+// #635) never holds admin_role's. bootstrap.sh creates the roles with these
+// (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD). gateway_role is no longer
+// any service's login; its password stays until the contract release that
+// drops the role (#635).
 const publicRolePassword = pulumi.secret(randomHex(32));
 const gatewayRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
@@ -162,14 +164,11 @@ const adminDatabaseUrl = pulumi
 const publicAdminDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, postgresPassword])
   .apply(([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_public?sslmode=require`);
-// The gateway's two logins (#613): public_role on cms_public and
-// gateway_role on cms_admin, each with its own password.
+// The gateway's only login (#613, #635): public_role on cms_public. It has
+// no cms_admin login at all (CLAUDE.md §2).
 const publicDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, publicRolePassword])
   .apply(([host, pw]) => `postgresql://public_role:${pw}@${host}:5432/cms_public?sslmode=require`);
-const gatewayDatabaseUrl = pulumi
-  .all([pgServer.fullyQualifiedDomainName, gatewayRolePassword])
-  .apply(([host, pw]) => `postgresql://gateway_role:${pw}@${host}:5432/cms_admin?sslmode=require`);
 
 // === 4. Storage account + containers ===
 const storage = new azure.storage.StorageAccount(`${namePrefix}-st`, {
@@ -419,10 +418,7 @@ const adminApp = containerApp({
 });
 const _gatewayApp = containerApp({
   serviceName: "gateway",
-  databaseEnv: [
-    { name: "GATEWAY_DATABASE_URL", value: gatewayDatabaseUrl },
-    { name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl },
-  ],
+  databaseEnv: [{ name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl }],
 });
 const _orchestratorApp = containerApp({
   serviceName: "orchestrator",
@@ -446,7 +442,6 @@ const dnsRecordsRequired = pulumi
 const out: CloudAdapterOutputs = {
   adminDatabaseUrl: adminDatabaseUrl as unknown as string,
   publicDatabaseUrl: publicDatabaseUrl as unknown as string,
-  gatewayDatabaseUrl: gatewayDatabaseUrl as unknown as string,
   mediaStorageUrl:
     pulumi.interpolate`https://${storage.name}.blob.core.windows.net/media` as unknown as string,
   mediaCdnBaseUrl: pulumi.interpolate`https://${domain}/media` as unknown as string,
@@ -460,7 +455,6 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
-export const gatewayDatabaseUrlOut = out.gatewayDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/gcp/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on GCP managed services. Implements the shared `
 | Blob storage | Two GCS buckets (`<project>-caelo-<env>-media`, `<project>-caelo-<env>-static`) with uniform bucket-level access |
 | CDN | Global HTTPS load balancer + Cloud CDN backend bucket: `<domain>` serves the static bucket as files, `/api/*` goes to the gateway, `admin.<domain>` to the IAP-gated admin |
 | Container runtime | Four Cloud Run services (admin / gateway / orchestrator / runner) |
-| Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret, public-role-password and gateway-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only the two gateway role passwords (#613); `gateway_role` itself is created by migration 0248 and gets its password from the CLI after migrations. |
+| Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret, public-role-password and gateway-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only `public-role-password` (#613, #635: the gateway has no cms_admin login); `gateway_role`, created by migration 0248, is no service's login any more. |
 | Edge-log sink | Cloud Logging project sink → BigQuery dataset `<env>_edge_logs` (queryable by P12A analytics plugin) |
 
 The Caelo runtime never knows it's on GCP — every Cloud Run service consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.

package/stacks/gcp/index.ts

@@ -662,7 +662,6 @@ const envContractInputs = {
     admin: dbUrls.admin,
     publicAdmin: dbUrls.publicAdmin,
     public: dbUrls.public,
-    gateway: dbUrls.gateway,
   },
 } as const;
 
@@ -753,8 +752,8 @@ const gatewaySvc = cloudRunService({
   minInstances: gatewayMinInstances,
   maxInstances: 100,
   memory: "512Mi",
-  // public_role on cms_public + gateway_role on cms_admin, each with its
-  // own password; never admin_role (#613, CLAUDE.md §2).
+  // public_role on cms_public only: no cms_admin login of any role
+  // (#613, #635, CLAUDE.md §2).
   contractEnv: gatewayEnvContract(envContractInputs),
 });
 
@@ -1158,7 +1157,6 @@ const out: CloudAdapterOutputs = {
   // Password-less — the password lives only in Secret Manager.
   adminDatabaseUrl: dbUrls.admin as unknown as string,
   publicDatabaseUrl: dbUrls.public as unknown as string,
-  gatewayDatabaseUrl: dbUrls.gateway as unknown as string,
   mediaStorageUrl: pulumi.interpolate`gs://${mediaBucket.name}` as unknown as string,
   mediaCdnBaseUrl: pulumi.interpolate`https://${domain}/media` as unknown as string,
   bootstrapUrl:
@@ -1172,7 +1170,6 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
-export const gatewayDatabaseUrlOut = out.gatewayDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/gcp-firebase/index.ts

@@ -606,7 +606,6 @@ const envContractInputs = {
     admin: dbUrls.admin,
     publicAdmin: dbUrls.publicAdmin,
     public: dbUrls.public,
-    gateway: dbUrls.gateway,
   },
 } as const;
 
@@ -988,7 +987,6 @@ const out: CloudAdapterOutputs = {
   // Password-less — the password lives only in Secret Manager.
   adminDatabaseUrl: dbUrls.admin as unknown as string,
   publicDatabaseUrl: dbUrls.public as unknown as string,
-  gatewayDatabaseUrl: dbUrls.gateway as unknown as string,
   mediaStorageUrl: pulumi.interpolate`gs://${mediaBucket.name}` as unknown as string,
   // Firebase Hosting serves media via its own CDN; we proxy through
   // the Firebase site's apex domain for canonical URLs.
@@ -1005,7 +1003,6 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
-export const gatewayDatabaseUrlOut = out.gatewayDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/static/welcome.html

@@ -5,151 +5,133 @@
   Uploaded by the provisioning wizard the first time it brings up the
   static bucket. Replaced the moment the operator publishes their
   first deploy via the admin app's "Publish" flow.
+
+  #781 — the first arrival screen: the Caelatum sky with the message on
+  a relief plate, matching the admin's sign-in screens. Fully
+  self-contained on purpose: inline CSS, inline SVG mark, no web fonts
+  and no other external requests (the page is served from a bucket that
+  has nothing else in it yet). Schibsted Grotesk is used when installed
+  locally; otherwise the fallback stack renders.
 -->
 <html lang="en">
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width,initial-scale=1">
   <meta name="robots" content="noindex">
+  <meta name="color-scheme" content="light dark">
   <title>Caelo CMS — your install is ready</title>
   <style>
     *,*::before,*::after { box-sizing: border-box; margin: 0; padding: 0; }
     :root {
-      --fg: #0c0d12;
-      --muted: #4a4e5e;
-      --accent: #4f46e5;
-      --accent-glow: #818cf8;
-      --card-bg: rgba(255,255,255,0.78);
-      --card-border: rgba(255,255,255,0.55);
-      --shadow: 0 30px 60px -20px rgba(15,17,40,0.18), 0 8px 18px -8px rgba(15,17,40,0.10);
+      --ink: #0e1a2e;
+      --muted: #4a576b;
+      --card: #ffffff;
+      --line: #e0e5ee;
+      --code-bg: #f2f5fa;
+      --sky-label: #1f5299;
+      --sky: linear-gradient(180deg, #c3dbf2 0%, #dce9f6 40%, #efe7ef 72%, #f8e6d8 100%);
+      --plate-ring: rgba(255, 255, 255, 0.55);
+    }
+    /* The sky is light-mode only; dark mode is the admin's night blue. */
+    @media (prefers-color-scheme: dark) {
+      :root {
+        --ink: #e6ecf5;
+        --muted: #9fb0c8;
+        --card: #111c2e;
+        --line: #22314a;
+        --code-bg: #16233a;
+        --sky-label: #7fb4ff;
+        --sky: none;
+        --plate-ring: rgba(255, 255, 255, 0.08);
+      }
     }
-    html, body { height: 100%; }
+    html, body { min-height: 100%; }
     body {
-      font: 16px/1.55 system-ui, -apple-system, "Segoe UI", Helvetica, Arial, sans-serif;
-      color: var(--fg);
+      font: 16px/1.55 "Schibsted Grotesk", Arial, Helvetica, sans-serif;
+      color: var(--ink);
+      background: #f8f9fc var(--sky);
+      min-height: 100vh;
       display: grid;
       place-items: center;
-      padding: 2rem;
-      background: #f6f6fb;
-      overflow: hidden;
-      position: relative;
-    }
-    /* Animated mesh-gradient background. Three soft blobs orbiting at
-       different speeds; backdrop-filter on the card softens them. */
-    .blob {
-      position: fixed;
-      border-radius: 50%;
-      filter: blur(80px);
-      opacity: 0.55;
-      pointer-events: none;
-      animation: drift 22s ease-in-out infinite;
-      will-change: transform;
+      padding: 3rem 1rem;
     }
-    .blob.b1 { width: 520px; height: 520px; background: #818cf8; top: -120px; left: -160px; animation-delay: -3s; }
-    .blob.b2 { width: 460px; height: 460px; background: #f0abfc; bottom: -180px; right: -140px; animation-delay: -8s; }
-    .blob.b3 { width: 380px; height: 380px; background: #67e8f9; top: 40%; left: 55%; animation-delay: -14s; animation-duration: 27s; }
-    @keyframes drift {
-      0%, 100% { transform: translate(0, 0) scale(1); }
-      33%      { transform: translate(40px, -30px) scale(1.07); }
-      66%      { transform: translate(-30px, 35px) scale(0.96); }
+    @media (prefers-color-scheme: dark) {
+      body { background: #0b1422; }
     }
-    @media (prefers-reduced-motion: reduce) {
-      .blob { animation: none; }
-    }
-
-    main {
-      position: relative;
-      z-index: 1;
-      max-width: 36rem;
-      width: 100%;
-      background: var(--card-bg);
-      border: 1px solid var(--card-border);
-      border-radius: 22px;
-      padding: 2.5rem;
-      box-shadow: var(--shadow);
-      backdrop-filter: blur(14px) saturate(140%);
-      -webkit-backdrop-filter: blur(14px) saturate(140%);
-    }
-
-    .brand {
-      display: flex;
-      align-items: center;
-      gap: 0.65rem;
+    .frame { width: 100%; max-width: 36rem; }
+    .kicker {
+      text-align: center;
+      font-size: 0.75rem;
       font-weight: 600;
-      letter-spacing: -0.01em;
-      color: var(--muted);
-      font-size: 0.95rem;
-      margin-bottom: 1.5rem;
+      letter-spacing: 0.14em;
+      text-transform: uppercase;
+      color: var(--sky-label);
+      margin-bottom: 1rem;
     }
-    .brand .dot {
-      width: 10px; height: 10px; border-radius: 50%;
-      background: var(--accent);
-      box-shadow: 0 0 0 0 var(--accent-glow);
-      animation: pulse 1.8s ease-out infinite;
-    }
-    @keyframes pulse {
-      0%   { box-shadow: 0 0 0 0 rgba(79,70,229,0.55); }
-      70%  { box-shadow: 0 0 0 12px rgba(79,70,229,0); }
-      100% { box-shadow: 0 0 0 0 rgba(79,70,229,0); }
+    main {
+      background: var(--card);
+      border: 1px solid var(--line);
+      border-radius: 14px;
+      padding: 2.25rem 2.5rem;
+      box-shadow: 0 0 0 5px var(--plate-ring), 0 18px 40px -26px rgba(42, 64, 110, 0.45);
     }
-    @media (prefers-reduced-motion: reduce) {
-      .brand .dot { animation: none; }
+    @media (max-width: 480px) {
+      main { padding: 1.5rem 1.25rem; }
     }
-
     h1 {
-      font-size: clamp(1.65rem, 1.2rem + 1.6vw, 2.25rem);
+      display: flex;
+      align-items: center;
+      gap: 0.75rem;
+      font-size: clamp(1.5rem, 1.2rem + 1.2vw, 2rem);
       letter-spacing: -0.02em;
       line-height: 1.15;
-      margin-bottom: 0.65rem;
+      margin-bottom: 0.85rem;
     }
-    p { color: var(--muted); margin-bottom: 1rem; }
-    p:last-child { margin-bottom: 0; }
-
-    .cta {
-      display: inline-flex;
-      align-items: center;
-      gap: 0.5rem;
-      margin-top: 1.5rem;
-      padding: 0.75rem 1.1rem;
-      background: var(--fg);
-      color: #fff;
-      text-decoration: none;
-      border-radius: 12px;
-      font-weight: 500;
-      transition: transform 0.15s ease, box-shadow 0.15s ease;
-    }
-    .cta:hover { transform: translateY(-1px); box-shadow: 0 12px 24px -8px rgba(15,17,40,0.25); }
-    .cta svg { width: 14px; height: 14px; }
-
+    h1 svg { flex-shrink: 0; width: 36px; height: 36px; }
+    p { color: var(--muted); }
     .hint {
-      margin-top: 2rem;
-      padding-top: 1.5rem;
-      border-top: 1px solid rgba(15,17,40,0.08);
+      margin-top: 1.75rem;
+      padding-top: 1.25rem;
+      border-top: 1px solid var(--line);
       font-size: 0.875rem;
       color: var(--muted);
     }
     .hint code {
-      font: 0.85em ui-monospace, "SF Mono", Menlo, Consolas, monospace;
-      background: rgba(15,17,40,0.05);
+      font: 0.85em Menlo, Consolas, monospace;
+      color: var(--ink);
+      background: var(--code-bg);
       padding: 0.15em 0.45em;
       border-radius: 6px;
+      overflow-wrap: anywhere;
+    }
+    /* One entrance settle, only for people who have not asked for
+       reduced motion; no looping animation on this page. */
+    @media (prefers-reduced-motion: no-preference) {
+      main { animation: settle 0.5s ease-out both; }
+      @keyframes settle {
+        from { opacity: 0; transform: translateY(8px); }
+        to { opacity: 1; transform: none; }
+      }
     }
-    .hint a { color: var(--accent); text-decoration: none; }
-    .hint a:hover { text-decoration: underline; }
   </style>
 </head>
 <body>
-  <div class="blob b1"></div>
-  <div class="blob b2"></div>
-  <div class="blob b3"></div>
-
-  <main>
-    <div class="brand"><span class="dot"></span>Caelo&nbsp;CMS</div>
-    <h1>Your install is up. One more step.</h1>
-    <p>This is the placeholder Caelo serves on a fresh deploy. The operator who provisioned this install has a one-time bootstrap link in their terminal output — opening it walks through Owner-account setup. After publish, this page disappears.</p>
-    <div class="hint">
-      Bootstrap link expires in 24h and rotates per <code>bunx @caelo-cms/provisioning</code> run. After Owner setup, the admin lives at <code>{{ADMIN_URL}}</code> behind <code>Sign in with Google</code> (IAP allowlist).
-    </div>
-  </main>
+  <div class="frame">
+    <p class="kicker">Caelo CMS</p>
+    <main>
+      <h1>
+        <svg viewBox="0 0 32 32" aria-hidden="true" focusable="false">
+          <path d="M23.07 7.57A11 11 0 1 0 23.07 24.43" fill="none" stroke="currentColor" stroke-width="3.4" stroke-linecap="round"/>
+          <path d="M20.5 10.64A7 7 0 1 0 20.5 21.36" fill="none" stroke="#c9952f" stroke-width="1.1" stroke-linecap="round"/>
+          <circle cx="25.2" cy="16" r="2.6" fill="#e8684a"/>
+        </svg>
+        Your install is up. One more step.
+      </h1>
+      <p>This is the placeholder Caelo serves on a fresh deploy. The operator who provisioned this install has a one-time bootstrap link in their terminal output — opening it walks through Owner-account setup. After publish, this page disappears.</p>
+      <div class="hint">
+        Bootstrap link expires in 24h and rotates per <code>bunx @caelo-cms/provisioning</code> run. After Owner setup, the admin lives at <code>{{ADMIN_URL}}</code> behind <code>Sign in with Google</code> (IAP allowlist).
+      </div>
+    </main>
+  </div>
 </body>
 </html>