Implement repository-driven theme rendering

README.md

@@ -1,20 +1,20 @@
 # Labyricorn Website Engine Control Plane
 
-A React control plane and Express backend for discovering Git-hosted Markdown, validating canonical site configuration, and producing deterministic static website releases.
+A React control plane and Express backend for resolving Git-owned site inputs and producing deterministic, immutable static website releases.
 
 ## Engine capabilities
 
 The build engine now:
 
-- validates routes, route collisions, content state, raw-HTML policy, and media references;
-- renders published content and navigation indexes into static HTML;
-- escapes source HTML and renders a safe CommonMark-style subset;
-- emits deterministic `build-manifest.json` and `checksums.json` files;
-- calculates an artifact checksum from generated file checksums;
-- writes releases atomically beneath the configured build root;
-- activates releases through an atomic `current` symlink/junction;
-- survives process restarts without reusing existing build numbers; and
-- serves the active generated release through the live-preview endpoint.
+- resolves the site definition and theme to exact 40-character Git commits;
+- materializes detached snapshots before reading configuration, projects, templates, or assets;
+- validates the closed `labyricorn-theme/v1` and project schemas without executing repository code;
+- renders explicit template keys through LiquidJS in strict mode with engine-owned safe-content filters;
+- copies only declared assets, verified fonts, and configuration-authorized standalone files;
+- emits deterministic provenance-rich `build-manifest.json` and `checksums.json` files;
+- writes immutable releases atomically beneath `releases/<artifact-build-id>/`;
+- stages and promotes the same checksum-verified release through atomic pointers; and
+- serves only a selected release through the preview endpoint, with no synthesized fallback.
 
 ## Development
 
@@ -46,15 +46,18 @@ By default, releases are written to the platform temporary directory under `laby
 
 Each successful release contains:
 
-- generated route directories with `index.html`;
+- theme-rendered route directories with `index.html`;
+- declared static assets and standalone publications;
 - `404.html`;
 - `build-manifest.json`; and
 - `checksums.json`.
 
-Validation failures produce a failed build record but never publish a partial release directory.
+Validation failures produce a failed build record but never publish a partial release directory. Configuration and theme state are Git-owned and read-only in control-plane v1. `PUT /api/site-config` returns `405 E_CONFIG_READ_ONLY`.
 
 ## Current boundaries
 
-- The built-in renderer is used until repository-provided theme templates are implemented.
-- Git source synchronization supports HTTP(S), SSH-style Git URLs, and local paths; other source types remain unavailable.
+- Theme packages are presentation data only; Node, shell, WASM, package-manager scripts, custom Liquid tags, and custom filters are not executed.
+- The reference loader resolves the configured site-definition repository and supports separately pinned source snapshots through the typed boundary; source-management UX remains follow-up work.
 - Remote rsync deployment is still represented by the existing control-plane simulation and must not be treated as a completed production deploy path.
+
+See [docs/OPERATIONS.md](docs/OPERATIONS.md) for snapshot, release, promotion, failure, and rollback procedures.