Prepare production rollout with omarchy.org styling and isolated OpenRouter reviews

[ryanrhughes]

Prepare the plugin and theme site for deployment at plugins-2.omarchy.org while retaining main’s omarchy.org styling. Bring themes, compatibility records, multi-screenshot support, and isolated AI/media processors across from the separate redesign branch; keep the HANCORE terminal redesign separate.

• Add OpenRouter review through the credential-holding gateway, using meta/muse-spark-1.3-contributor. Clean first releases can publish automatically only after deterministic checks and two complete, archive-bound AI passes: instruction integrity and source security. Findings, capability growth, dynamic call sites, incomplete coverage and provider failures remain blocked.
• Stop model calls on the first suspicious result. Add prompt-injection tripwires across source/docs/metadata and strict model verdict parsing. Keep source and output as data; the reviewer has no tools or execution dispatch, and the gateway rejects tools, plugins, external content and incomplete completions. These controls do not claim prompt-injection immunity.
• Show the actual deterministic checks, results, model, per-pass chunk coverage and review time in the admin report. Mark skipped/unrecorded checks explicitly and require current review evidence again at automatic publication.
• Show author Omarchy version bounds and exact-release compatibility evidence on plugin/theme pages. Link new reports to public comments, preserve private reproduction details and moderation on edits, and reuse deduplicated publishing-team alerts. Add the comment/report foreign key with an additive migration. Aggregate compatibility counts per page. Document that automatic enforcement belongs to the companion client and is not yet shipped in stock Omarchy.
• Require explicit production R2 configuration, remove personal infrastructure defaults and tracked deployment credentials, and document the private deployment repository.
• Add an idempotent three-plugin demo catalog using normal review, plus an R2 deployment probe.
• Keep plugins at / and themes at /themes, including search, popular/recent rows, facets, statistics, pagination and mobile/keyboard search. Group publisher listings by type and give publisher JSON distinct collections. Reject wrong-type detail URLs and redirect legacy theme filters. Retain /packages.json as the explicit combined client catalog.
• Align the shared header/footer with omarchy.org. Paint scrolling surfaces on the inner bar, use the mobile wordmark and split section boundaries, and keep the menu/account actions usable on smaller screens. Make Plugins/Themes links local, fix search shortcuts and language links, and repair copy controls and narrow-screen command wrapping.
• Fix production theme asset URLs, CSP nonce/preview permissions, arrow navigation and preview sizing. Match omarchy.org’s responsive deck, mobile swipe, backdrop dismissal, selected-theme label colors and split-wipe transition, with nonce and browser regression coverage.

Validation: 434 application tests (2,255 assertions), 14 browser tests (102 assertions), RuboCop, Brakeman (zero new warnings), dependency audits, Docker application/processor builds, container isolation inspection, and synthetic AI/media round trips. Review regressions cover automatic first releases, immediate stops, missing evidence, malformed verdicts, unavailable models and report escaping. Compatibility regressions cover both package types, public/private text, repeated edits, moderation, escaping, declared ranges, author alerts and mobile layout. Production-storage boot checks cover complete, missing, explicit-local and insecure-endpoint settings.

The site is live over HTTPS. Real R2 write/read/delete, signed-feed verification, and OpenRouter Muse Contributor reviews have passed. Live injection canaries stopped before model I/O or during the first AI pass, with the remaining pass skipped and no command execution. Three published demos passed fresh deterministic checks and both Muse passes; their reports were updated while retaining human approval provenance. SMTP TLS/authentication passed; admin TOTP enrollment is complete. Login-email delivery was not independently tested by deployment automation. Deployment settings and Rails-encrypted credentials live in the private operations repository, which pins the application SHA.

Three original demo themes (two dark, one light) were also published through the existing production API. Each passed 22 deterministic checks and both real Muse passes without manual approval. Public signed indexes, archive hashes, two-image galleries, lightboxes and mobile rendering were verified. Their compatibility ranges are author declarations; no runtime compatibility reports were fabricated.