Pages are shareable (no login) until the first-customer gate. HTTPS stays.

Headline. This hour changed how the system presents itself. Pages open without login so they can be shared for review. HTTPS stays. This is not passing the first-customer gate.

This page sits under Slot Work because turning login off changed how the site presents itself, not because the hour named a customer or a path.

What the agent just did

Slot Work means a timed hour that changed how the system operates or presents itself. Not ordinary content. This is that hour.

The rule sits on the Contract page. Reply on Open asks. This card is not a second inbox.

What changed on the live site:

1. HTTPS stays. HTTP still 301s to HTTPS. Certificate stays. No new cookies.
2. Login on the pages is off until the first-customer gate. Unauthenticated GET is 200 readable.
3. The password file stays on the server so login can come back later. It is not published.
4. 401 is now a failed publish while this contract is live. A phone tap must return readable content.

I have not passed the first-customer gate. I have not unparked the customer cut. I have not rewritten the Current slot line. I have not assembled. I have not started Hermes. I have not named a path. Compile stays 0. Reach stays the blocker.

Which ring. Market. You can now share Overview without a login prompt. You cannot take shareable pages as a compiled path, a named first customer, or permission to unpark the cut.

Walk. Destination ($2.5–5bn) → first-customer gate (parked, 63e813ea) → live gate (tried compile; none compiled; blocker is reach) → this route (login off for sharing) → this hour’s finding (unauthenticated 200; HTTPS stays) → does not name a customer, does not move P, does not unpark the cut.

The slot is quoted unchanged:

Hold the 24-hour founder loop with Founder View and Agent View as peer surfaces. Use the hours for market-path compounding. Do not invent a customer. Do not unpark the customer cut.

Layer: Peer toggle: Founder View ↔ Agent View. Released 26 Aug 2026, not “today.”

A cut is a shortened next-job draft. The customer cut stays parked. UUID 63e813ea-f3ae-4cb3-9090-2025599c7854 is not installed, not released, not P, not a live Open gate.

UUID 9f3c8a21-4d7e-4b16-a8c0-5e72f19d6b44 stays parked: Hermes is not started.

p-evidence.md is still empty. P is company position toward the $2.5–5bn goal. The empty file exists so the score cannot be faked. Empty is honest, not finished.

Why this was necessary

The problem this hour removes: pages could not be shared for review because a login prompt sat in front of them. After this hour, an unauthenticated tap on Overview returns readable HTML. HTTPS is unchanged.

This hour is still mechanism: how the site presents itself. It is not a move of P. Milestone held; standing work is market-path compounding. Compile stays 0. Reach stays the blocker.

Systemic effect: you can send https://vps-9d119ef4.vps.ovh.net/founder/visibility/ and it opens. You could not do that while 401 was the gate.

Alternatives rejected

• Leave login on and share screenshots. The phone click would still fail 8c85e909.
• Pass the first-customer gate so login can stay off forever. Forbidden. The gate is not passed. The cut stays parked.
• Switch to cookies. Not this hour. Not cookies.
• Delete the server password file. Rejected. Login must be able to come back later.
• Invent a customer, a market path, or a P number so the hour looks like company progress.
• Unpark the customer cut, rewrite the live slot, start Hermes, or assemble.

Pushback invited — decide or criticise

Working set, not exhaustive. The numbered live-gate ask stays on Open asks. This card is not a second inbox. Sharing is now possible. That is not a new compile candidate.

Watch / next

Sharing is now possible. Not a new compile candidate. Compile stays 0. Reach stays the blocker. Dead link is a failed publish. Unauthenticated 200 is success while this contract is live. 401 is failure. 500 is failure.

Confirmation

Contract UUID 06657cd0-90c1-4068-a67c-eee560fb8224 is live. Pages have no login until the first-customer gate. HTTPS stays. Unauthenticated GET is 200 readable. Not cookies. No path named. Cut 63e813ea parked. P unchanged. Hermes parked. Not assembled.