docs: republish Pages and match shipped Rhizome

.github/workflows/pages.yml

@@ -2,6 +2,12 @@ name: Landing page
 
 # Publishes website/ to GitHub Pages. Release workflows run the same
 # website/build.sh, so a release deploy keeps the landing page.
+#
+# This job only queues when one of the paths below changes. That is why
+# it last ran on 2026-09-27 (8ed9817) while main kept moving: no later
+# commit touched website/, the hero assets, or this file. GitHub did not
+# disable Pages and the last run succeeded. A merge that touches these
+# paths deploys; Actions → Landing page → Run workflow also deploys.
 on:
   push:
     branches: [main]

README.md

@@ -1,14 +1,14 @@
-# Rhizome Agent
+# Rhizome
 
 [![repowise](https://api.repowise.dev/badge/wiki/tuckcode/rhizome-agent.svg)](https://repowise.dev/repo/tuckcode/rhizome-agent)
 [![Code health](https://api.repowise.dev/badge/health/tuckcode/rhizome-agent.svg)](https://repowise.dev/repo/tuckcode/rhizome-agent)
 
-![Rhizome Agent — Your work. Your memory.](src/assets/brand/rhizome-organic-hero.png)
+![Rhizome mark. Branching nodes over dark earth.](src/assets/brand/rhizome-organic-hero.png)
 
 **A harness that doesn't forget.**
-Built around [Prime Agent](https://github.com/PrimeIntellect-ai/prime-agent), with useful tools from Claude Code, Hermes Agent, and DeepSeek. The built-in vault is your memory, wiki, and second brain, beside a research panel. What you save stays as plain Markdown on your disk, where you and the agent can both read it.
+Rhizome runs its own agent loop. Chat works without [Prime Agent](https://github.com/PrimeIntellect-ai/prime-agent). Notes stay as plain Markdown in a local vault you own. You read and diff those notes in the app. The agent cannot search the vault or old Mycelium sessions yet.
 
-This is a developer preview. Prime Agent and Node are not bundled. There is no signed download.
+This is a developer preview. There is no signed download. Prime is an optional engine. Hermes is a planned adapter, not a usable engine in the app today.
 
 | | |
 |---|---|
@@ -24,29 +24,31 @@ cd rhizome-agent
 pnpm tauri dev
 ```
 
-`./install.sh` installs this repo and fetches Prime Agent when that program is not already on the machine. Chat needs Prime. The script downloads the command-line tool Prime publishes. There is no smaller copy inside Rhizome.
+`./install.sh` installs this repo and fetches Prime Agent when that program is not already on the machine. Settings still starts Chat on Prime until you switch **Chat engine** to Rhizome's own engine. Native chat does not need Prime. The script still downloads the Prime command-line tool because that default is Prime.
 
 The full list of tools, the first minute in the app, and what to do when it fails: [Getting started](docs/start/README.md).
 
-`prime-agent` stops when that terminal closes. To leave it running:
+`prime-agent` stops when that terminal closes. To leave it running (only if you use the Prime engine):
 
 ```bash
 (prime-agent --mode daemon >/dev/null 2>&1 &) && sleep 2 && prime-agent status
 ```
 
 Quit `/Applications/Rhizome Agent.app` before `pnpm tauri dev`. Both use the bundle id `ai.rhizome.agent`, and a second launch attaches to the one already open.
 
-To look at the interface without a live Prime session: `pnpm dev`, then http://localhost:5202.
+To look at the interface without a live engine: `pnpm dev`, then http://localhost:5202.
 
 ### First minute
 
-1. The first launch may ask **Help improve Rhizome**. You can decline. Telemetry stays off until you accept, and a build without a Sentry or PostHog key sends nothing.
-2. Chat opens. The sessions list opens with it on a first launch.
+1. The first launch may ask **Help improve Rhizome**. You can decline. Telemetry stays off until you accept, and a build without a Sentry or PostHog key sends nothing. Earth dark is the default theme. Earth light, Loam, and Match system are in Settings.
+2. Chat opens. The sessions list opens with it on a first launch. The left rail holds sessions, Views (Research, Graph, Mycelium, History), and Settings. Changes sits next to Notes. Views use Ctrl+Cmd+1–4 on Mac and Ctrl+Shift+1–4 on Windows.
 3. Create a local vault, or open a folder you already have.
-4. Send one message. You should get an answer, or a clear failure: Prime is missing, the provider login expired, or the connection dropped.
+4. Send one message. On Rhizome's engine you should get an answer, a notice if a non-fatal error occurred, or a clear failure (no provider key, for example). Prime-targeted chats still need Prime installed.
 5. Show Notes (View menu, or Cmd+2). Save a note, quit, and reopen the same file.
 
-Notes live in the vault folder you opened. Chat transcripts live with Prime, under `~/.prime/agent/sessions/`.
+Notes live in the vault folder you opened. Native chat logs live in the app config folder (`com.rhizome.app/native-sessions`). Prime transcripts live under `~/.prime/agent/sessions/` when you use that engine.
+
+Provider keys live in the system keychain. Do not edit a JSON key file.
 
 If something fails, the longer recovery page is [`docs/PUBLIC-PREVIEW.md`](docs/PUBLIC-PREVIEW.md). Ports and tests are in [`docs/GETTING-STARTED.md`](docs/GETTING-STARTED.md).
 
@@ -58,14 +60,14 @@ The copy-paste block, and a one-line version, live on their own page: [Agent ins
 
 The full rules for an agent that edits this tree are in [AGENTS.md](AGENTS.md).
 
-Prime Agent runs the chat: session, tools, skills, and provider login. Rhizome reaches the vault through MCP when a vault is attached.
+Rhizome owns the chat loop. Prime is an optional engine. Rhizome reaches the vault through MCP when a vault is attached and Prime is the engine. The native engine can create a note; it cannot search the vault yet.
 
 | | |
 |---|---|
-| Product | Rhizome Agent |
+| Product | Rhizome |
 | Bundle id | `ai.rhizome.agent` |
 | Package | `rhizome-agent` |
-| Chat | Prime Agent, plus tools from Claude Code, Hermes Agent, and DeepSeek |
+| Chat | Rhizome's engine, or Prime if you switch to it |
 | Notes | Plain Markdown, in a local vault you open |
 
 Names and remotes: [`docs/IDENTITY.md`](docs/IDENTITY.md).
@@ -79,6 +81,6 @@ Security reports: [SECURITY.md](SECURITY.md). Do not file a vulnerability as a p
 
 AGPL-3.0-or-later. See [LICENSE](LICENSE).
 
-Rhizome Agent is a modified version of
+Rhizome is a modified version of
 [Tolaria](https://github.com/refactoringhq/tolaria) by Luca Rossi (AGPL-3.0).
 The Mycelium view embeds Mindwalk (MIT) © 2026 Ricko Yu.

docs/GETTING-STARTED.md

@@ -1,17 +1,28 @@
 # Getting Started
 
-How to navigate the **Rhizome Agent** codebase, run the app, and find what you need.
+How to navigate the **Rhizome** codebase, run the app, and find what you need.
 
-> This is Rhizome Agent (`ai.rhizome.agent`, `tuckcode/rhizome-agent`), not Rhizome Desktop (`knispo/rhizome`, `ai.rhizome.desktop`). See [`IDENTITY.md`](IDENTITY.md). Product overview: [README.md](../README.md). Some filenames still use older internal names (`tolaria_*`). Those names are implementation identifiers, not the product name.
+> This is Rhizome (`ai.rhizome.agent`, `tuckcode/rhizome-agent`), not Rhizome Desktop (`knispo/rhizome`, `ai.rhizome.desktop`). See [`IDENTITY.md`](IDENTITY.md). Product overview: [README.md](../README.md). Some filenames still use older internal names (`tolaria_*`). Those names are implementation identifiers, not the product name.
 >
 > First-run install and recovery: [`PUBLIC-PREVIEW.md`](PUBLIC-PREVIEW.md). This page is the developer path.
 
+## What ships now
+
+User-facing name is **Rhizome**. The bundle is still `ai.rhizome.agent` / `Rhizome Agent.app`.
+
+- Rhizome owns the agent loop (ADR-0180). Native chat works without Prime. Settings still starts Chat on Prime until you switch **Chat engine**. Hermes is not a usable engine in the app today.
+- Free-tier routing appears as **Free tier (auto)**. The name Taproot is not on main.
+- Earth dark is the default theme. Earth light, Loam, and Match system are in Settings.
+- Left rail Views are Research, Graph, Mycelium, and History (Ctrl+Cmd+1–4 on Mac, Ctrl+Shift+1–4 on Windows). Changes sits next to Notes.
+- You read and diff notes in the vault. Mycelium replays builds. The agent cannot search the vault or old Mycelium sessions yet.
+- Provider keys live in the system keychain. A leftover `ai-provider-secrets.json` migrates on first read. Do not tell a user to edit that file.
+
 ## Prerequisites
 
 - **Node.js** `^20.19.0` or `>=22.12.0` (Vite 7) and **pnpm**
 - **Rust** 1.77.2+ (for the Tauri backend)
 - **git** CLI (required by the git integration features)
-- **Prime Agent** on `PATH` for live Chat. `./install.sh` fetches it when it is missing. Not vendored.
+- **Prime Agent** on `PATH` only if Chat stays on the Prime engine. Native chat does not need it. `./install.sh` still fetches Prime because Settings still defaults to that engine. Not vendored.
 
 ### Linux system dependencies
 
@@ -561,7 +572,8 @@ Verified against source 2026-09-14. Longer landmine list:
   `glpat-`. It still does not scrub `ghr_` or `sk_test_` / `sk_live_` —
   do not widen rust this window.
 - **Settings and secrets writes** go through `secure_fs::write_owner_only_atomic`.
-  Do not write the real app-support settings or key file in tests.
+  Provider keys live in the OS keychain (ADR-0185). Do not write the real
+  app-support settings or the legacy key file in tests.
 - **Session-list import** stays blocked until Atticus types **`1`**.
   Do not speak `import_jsonl`. Vault `Imports/` writer already exists.
 - **Chat still mounts with no vault** (`ChatHome.test.tsx`). Preflight

docs/PUBLIC-PREVIEW.md

@@ -1,6 +1,6 @@
 # Public preview
 
-Rhizome Agent is a macOS chat app for [Prime Agent](https://github.com/PrimeIntellect-ai/prime-agent). You bring your own model. You can open a note beside the chat and save the result as plain Markdown in a vault on your disk.
+Rhizome is a macOS chat app with its own agent loop. You can switch Chat to [Prime Agent](https://github.com/PrimeIntellect-ai/prime-agent). You can open a note beside the chat and save the result as plain Markdown in a vault on your disk.
 
 This page is the install and recovery guide. Developer commands live in [`GETTING-STARTED.md`](GETTING-STARTED.md).
 
@@ -10,9 +10,12 @@ This page is the install and recovery guide. Developer commands live in [`GETTIN
 |---|---|---|
 | Platform | macOS, from source or from an app you already built | A signed download. Windows as a daily driver. A verified Linux install for a stranger. |
 | Language | English | Other languages |
-| Chat | Prime Agent. You install Prime yourself. | Prime or Node bundled inside the app |
-| Notes | Open a local vault, save a note, reopen the same file | A remote starter vault |
-| Layout | Chat opens on launch. Notes open from Show Notes, the View menu, or Cmd+2. | Portfolio, Today, kanban, or extra destinations |
+| Chat | Rhizome's own engine. Prime if you switch to it. Native chat works without Prime. | Prime or Node bundled inside the app. Hermes as a usable engine. Agent search of the vault or old Mycelium sessions. |
+| Notes | Open a local vault, save a note, reopen the same file, read and diff notes | A remote starter vault |
+| Layout | Chat opens on launch. Left rail: sessions, Views (Research, Graph, Mycelium, History), Settings. Notes and Changes sit in the sidebar. Show Notes, the View menu, or Cmd+2 still open Notes. Views use Ctrl+Cmd+1–4 on Mac and Ctrl+Shift+1–4 on Windows. | Portfolio, Today, kanban, or extra destinations |
+| Theme | Earth dark (default), Earth light, Loam, and Match system | |
+| Models | Free tier (auto), plus catalog providers you add a key for | The name Taproot (that rename is not on main) |
+| Keys | System keychain (macOS Keychain, Windows Credential Manager, or Secret Service) | A JSON key file you edit by hand |
 | Updates | Replace the `.app`, or rebuild from source | An in-app updater |
 
 The app reports version `0.1.0`. That number is the bundle version, not a promise about every macOS release.
@@ -26,7 +29,7 @@ These tools have to be on the machine before the app will build:
 3. pnpm.
 4. Rust `1.77.2` or newer.
 5. git.
-6. Prime Agent on `PATH`. The app does not include it.
+6. Prime Agent on `PATH` only if you keep the default Prime Chat engine. Native chat does not need it.
 
 ```bash
 git clone https://github.com/tuckcode/rhizome-agent.git
@@ -35,7 +38,7 @@ cd rhizome-agent
 pnpm tauri dev
 ```
 
-`./install.sh` installs this repo and fetches Prime Agent when that program is not already on the machine. Chat needs Prime. The script downloads the command-line tool Prime publishes.
+`./install.sh` installs this repo and fetches Prime Agent when that program is not already on the machine. Settings still starts Chat on Prime until you switch **Chat engine**. The script downloads the command-line tool Prime publishes.
 
 `prime-agent` on macOS stops when that terminal closes. To leave the daemon running:
 
@@ -45,7 +48,7 @@ pnpm tauri dev
 
 Quit `/Applications/Rhizome Agent.app` before `pnpm tauri dev`. Both use the bundle id `ai.rhizome.agent`, and a second launch attaches to the one that is already open.
 
-To look at the interface without a live Prime session:
+To look at the interface without a live engine:
 
 ```bash
 pnpm dev
@@ -55,25 +58,25 @@ Open http://localhost:5202. The dev server does not use port 5173.
 
 ## First minute
 
-1. The first launch may ask **Help improve Rhizome**. Telemetry is explained below.
-2. Chat opens. Notes stay closed until you show them.
+1. The first launch may ask **Help improve Rhizome**. Telemetry is explained below. Earth dark is the default theme.
+2. Chat opens. Notes stay closed until you show them. Views sit on the left rail.
 3. You can create a local vault or open a folder you already have. Nothing is cloned from the network unless you set `RHIZOME_GETTING_STARTED_REPO_URL`.
-4. Send one message. You should get an answer, or a clear failure: Prime is missing, the provider login expired, or the connection dropped.
+4. Send one message. On Rhizome's engine you should get an answer, a notice if a non-fatal error occurred, or a clear failure. Prime-targeted chats fail clearly when Prime is missing, the provider login expired, or the connection dropped.
 5. Show Notes, open or create a note, save, quit, and reopen the same file.
 
 ## If something fails
 
 | What you see | What to do |
 |---|---|
-| Prime is missing | Run Prime's installer, run `prime-agent` once, start the daemon, then reopen Chat. |
-| Prime is installed and Chat still says it is missing | Wait a few seconds. The status check repeats. |
-| Provider or login failure | Settings → Agents. Prime owns that login. |
+| Prime is missing | Switch **Chat engine** to Rhizome's engine, or install Prime, run `prime-agent` once, start the daemon, then reopen Chat. |
+| Prime is installed and Chat still says it is missing | Wait a few seconds. The status check repeats. Or switch to Rhizome's engine. |
+| Provider or login failure | Settings → AI Agents. Native keys go in the system keychain. Prime owns Prime login. |
 | macOS blocks the vault folder | Grant access to Documents, Desktop, or Downloads, or move the vault. |
 | No network, or no model | Notes on disk still open. Chat cannot answer. |
-| The red window button | It hides the window. It does not quit. Cmd+Q quits. |
+| The red window button | It quits, unless **Keep in taskbar** is on. Then it hides. Cmd+Q quits. |
 | The window is gone | Click the Dock icon. |
 
-Notes live in the vault folder you opened. Chat transcripts live with Prime, under `~/.prime/agent/sessions/`. Rhizome settings prefer `~/.config/com.rhizome.app/settings.json`.
+Notes live in the vault folder you opened. Native chat logs live in the app config folder (`com.rhizome.app/native-sessions`). Prime transcripts live under `~/.prime/agent/sessions/` when you use that engine. Rhizome settings prefer `~/.config/com.rhizome.app/settings.json`.
 
 ## Permissions
 
@@ -102,6 +105,6 @@ Analytics do not record the page, do not record the session, and do not use auto
 
 AGPL-3.0-or-later. See [LICENSE](../LICENSE).
 
-Rhizome Agent is a modified version of Rhizome Desktop, which builds on [Tolaria](https://github.com/refactoringhq/tolaria) by Luca Rossi (AGPL-3.0). The Mycelium view embeds Mindwalk (MIT) © 2026 Ricko Yu.
+Rhizome is a modified version of Rhizome Desktop, which builds on [Tolaria](https://github.com/refactoringhq/tolaria) by Luca Rossi (AGPL-3.0). The Mycelium view embeds Mindwalk (MIT) © 2026 Ricko Yu.
 
 This page is a product description, not legal advice.

docs/for-agents/README.md

@@ -5,15 +5,16 @@ Hand this repo to an agent with the block below. The full rules for an agent tha
 ## Paste this
 
 ```text
-This is Rhizome Agent, repo tuckcode/rhizome-agent, bundle id ai.rhizome.agent.
+This is Rhizome, repo tuckcode/rhizome-agent, bundle id ai.rhizome.agent.
 It is not Rhizome Desktop. Do not add knispo/rhizome as a remote.
 Read AGENTS.md before you change code. English only.
 The vault is plain Markdown on disk. You and the person can both read it.
-Prime Agent runs the chat. Rhizome reaches the vault through MCP when a vault is attached.
+Rhizome runs its own agent loop. Prime is an optional engine. Hermes is not a usable engine today.
+The native engine can create a note. It cannot search the vault or old Mycelium sessions yet.
 ```
 
 ## One line
 
 ```text
-Rhizome Agent (tuckcode/rhizome-agent, ai.rhizome.agent) is not Rhizome Desktop. Read AGENTS.md first. English only. The vault is plain Markdown on disk.
+Rhizome (tuckcode/rhizome-agent, ai.rhizome.agent) is not Rhizome Desktop. Read AGENTS.md first. English only. The vault is plain Markdown on disk. Rhizome owns the chat loop; Prime is optional.
 ```

docs/plans/handoffs/2026-10-11-1115-cursor-grok-4-6-pages-docs.md

@@ -0,0 +1,50 @@
+---
+session: 2026-10-11T11:15Z
+model: Cursor Grok 4.6
+description: >-
+  Pages stopped because pages.yml path filters never matched after
+  2026-09-27. Landing and user docs now match shipped Rhizome (own
+  engine, Earth, Views 1–4, keychain). No app code.
+commits: HEAD
+---
+
+**Origin:** Cursor Grok 4.6 · 2026-10-11 · Pages and user docs
+
+## Why Pages stopped
+
+`.github/workflows/pages.yml` runs on `push` to `main` only when
+`website/**`, `docs/assets/**`, `src/assets/brand/rhizome-organic-hero.png`,
+or the workflow file change. Last success: 2026-09-27 11:36 UTC on
+`8ed9817`. Later main commits did not touch those paths, so GitHub
+queued no run. The repo is public. Pages is `build_type: workflow`.
+The last run succeeded. This is not a disabled workflow and not a
+Pages setting.
+
+A merge that touches `website/` deploys. If a run does not appear,
+Actions → Landing page → Run workflow.
+
+## Verified on main, then written
+
+- Native engine exists and sends without Prime. Settings still default
+  Chat to Prime until **Chat engine** is switched.
+- Hermes is not in `PRODUCT_AI_AGENT_DEFINITIONS`. Not a usable engine.
+- Free-tier UI label is **Free tier (auto)**. Taproot is not on main.
+- Earth dark default, Earth light, Loam, Match system.
+- Views: Research, Graph, Mycelium, History. Ctrl+Cmd+1–4 /
+  Ctrl+Shift+1–4. Changes next to Notes. Not 1–5.
+- Native loop tool that writes a note is `create_note`. No agent
+  vault search or Mycelium-session search.
+- Provider keys: OS keychain (ADR-0185). Legacy JSON migrates.
+
+## Files
+
+`website/index.html`, `website` workflow comment, `README.md`,
+`docs/start/README.md`, `docs/PUBLIC-PREVIEW.md`,
+`docs/GETTING-STARTED.md`, `docs/for-agents/README.md`,
+`src/lib/leftover-website-copy.test.ts`. Did not edit `HANDOFF.md`.
+Did not change app code.
+
+## knispo
+
+Merge. No Pages click required. After merge, confirm the Landing page
+workflow runs. If it does not, Run workflow.