[immakermatty]

Status: ready for review. Rebased on main 68f22f288 (#65 merged); fork CI is green on the exact head d2d85a96c (run 38448504813: format, lint 0 errors, typechecks, the overlay's tests with branding.test.ts 10/10, contract 29/29, the image, both CLI archives and the launcher install). Before the rebase it was green on d8f60bd76 too (run 38383261563, run 38444949761). The look needs LazurioPlatform pingdotgg#375, which is merged and in v0.1.8-rc.65 on the canary Environment; on an older Platform this release looks like upstream and is only named "T3 Code (Lazurio)". The issue form's security sentence has its private route: private vulnerability reporting was enabled on 2026-10-13 (plan decision D6).

Why

Root decision 0200 (HumanAndMachines/Lazurio#539) makes Chat the distribution Lazurio T3 Code, a modified distribution of T3 Code, the way Lazurio/vaultwarden is Lazurio Vaultwarden:

• T3 Code's mark stays: wordmark, icons and the product name in the app are upstream's;
• in the app it is "T3 Code (Lazurio)", with a "Lazurio" label beside the wordmark, and previews stop calling themselves "Nightly";
• releases, images and archives carry the distribution's name;
• on a Lazurio Environment the web client's standard light look takes the design system's colours, type and radii from tokens the Environment's shell declares on the document's root. A theme the person picks and dark mode stay T3 Code's, and without Lazurio's shell T3 Code looks as upstream.

What changes, commit by commit

1. release: releases, the image and an issue form carry the name Lazurio T3 Code (distribution files only)
   • Releases are titled Lazurio T3 Code v<version>, previews too.
   • The notes open "Lazurio T3 Code, a modified distribution of T3 Code <upstream tag> for Lazurio Environments", speak of Environments, and end with a line that links the exact source commit and says the release is MIT licensed like T3 Code, with T3 Code's LICENSE in each archive and the image.
   • OCI labels title, description, licenses=MIT, url and vendor, the same in lazurio-release.yml and Dockerfile.lazurio.
   • A new issue form, .github/ISSUE_TEMPLATE/1-lazurio-t3-code.yml, first in the chooser. Upstream's forms, their config and SECURITY.md are unchanged.
   • The release contract asserts the title, the notes' first and last lines, that the notes never say Machine or vanilla, the five labels in both places and the form. The guard that forbade a branding overlay now forbids a mount path and any hosted app variable (VITE_HOSTED_APP_CHANNEL would switch the client into app.t3.codes mode).
2. feat(web): the in-app name T3 Code (Lazurio) (new Overlay row 16)
   • branding.ts: a production build's stage label is Lazurio where upstream's is Alpha. The display name becomes "T3 Code (Lazurio)" in the tab, the pairing, 404 and error pages and the error report. Development stays "T3 Code (Dev)", and desktop branding and upstream's hosted channels still win.
   • branding.logic.ts: only X.Y.Z-nightly.YYYYMMDD.N reads as a nightly, so a fork preview keeps the build's label and loses the nightly artwork.
   • SidebarChrome.tsx: the label stands beside the wordmark, in the slot upstream gives its Dev and Nightly pills, with upstream's own badge, in every identification mode. This seam is needed because the stage label alone never reaches the sidebar. Upstream identifies only Dev and Nightly there: artwork (the default mode), a pill (pill mode) or nothing (none). For any other label (Alpha, Latest, Lazurio) it shows nothing in all three modes.
   • index.html: the page title, the splash's label and its image's alt text.
   • manifest.webmanifest: name "T3 Code (Lazurio)", short_name "T3 Code". Upstream's manifest had neither.
   • branding.test.ts covers a production build, a development build and a preview, and unstubs envs after each test.
   • Allowlist: a group for the name. index.html moves to the shared seams (shell slot and name).
   • The contract pins the label, the logic, the seam, the title, the splash and the manifest. It also checks that the wordmark, the web client's icons and assets/ are byte for byte upstream's.
3. feat(web): the design system's light look on a Lazurio Environment (new Overlay row 17)

   • apps/web/src/lazurio/theme.css holds two rules, both behind :root[data-lazurio-theme="light"]:not([data-theme-id]):not(.dark): one on the root and one on T3's sidebar palette scope [data-app-sidebar], which the shell's rail joins.

   • What the mapping gives:

     • white surfaces and a paper sidebar, ink text and black buttons;
     • gray selections one step darker, hairline lines and neutral focus;
     • the signal colours, and the one blue for links and the update notice;
     • Inter Tight and Geist Mono (the shell declares their faces);
     • --control-radius 6 px and no grain;
     • the switch's active tab (white) apart from its track (gray-100).

   • It writes only T3's raw tokens: no --contrast-*, --app-theme-* or --lazurio-*, and no colour literal. The contrast setting keeps deriving from the new values, a picked theme and the theme editor stay T3's, the shell's colour roles follow by themselves, and a font chosen in Appearance still wins.

   • main.tsx imports it right after index.css and moves to the allowlist's shared seams (prepared prompt and look).

   • The contract keeps:

     • the import's place;
     • both rules' gate and its value;
     • only raw tokens that index.css declares in the same scope;
     • only var(--lz-*) values of the 23 names the mapping reads (or no grain);
     • the fonts, the radius and the grain;
     • the switch's tokens apart;
     • T3's theme mapping behind data-theme-id.

     The colour roles' test is unchanged.

   • Tokens read (23, exactly the names the shell's interface v1 promises at LazurioPlatform Plan mode, alternative answer for clarifying questions. Text cursor is stuck pingdotgg/t3code#375 head e8060d1a): --lz-surface, --lz-paper, --lz-ink, --lz-ink-muted, --lz-line, --lz-accent, --lz-accent-button, --lz-accent-button-hover, --lz-on-accent, --lz-gray-50, --lz-gray-100, --lz-red-500, --lz-danger, --lz-danger-bg, --lz-warning, --lz-warning-bg, --lz-green-500, --lz-success, --lz-info, --lz-info-bg, --lz-font-sans, --lz-font-mono, --lz-radius-sm.

4. docs: the fork runbook records the distribution's name and the light look
   • The intro names the distribution, a modified distribution of T3 Code for Lazurio Environments. The Overlay table gets rows 16 and 17, and row 5 adds the issue form.
   • The Cílový stack lists the new rows and marks index.html and main.tsx as shared.
   • A new section "Jméno a vzhled" covers the distribution, the name, the look, what stays T3's, what holds without the shell and the release order. The canary check gains the name and the look.
   • The text that the fork does not recolour or rename T3 Code is replaced.

Each commit passes the contract test and the allowlist guard on its own.

What deliberately does not change

• The fork's README (.github/README.md, PR docs: a README and a security policy that say what Lazurio T3 Code is and where to report its problems #67) and its security policy: separate. The repository description, homepage and private vulnerability reporting were set outside this PR (plan decisions D6 and D7). The root README.md stays upstream's.
• T3 Code's wordmark, icons, product name (APP_BASE_NAME stays "T3 Code") and the prose strings that say "T3 Code".
• CLI texts, identifiers (t3, t3code.service, T3CODE_*, storage keys) and archive names.
• Dark mode, every picked or imported theme, the theme editor, the official desktop and mobile apps, and MausBot.
• Shadows, glass, the wider radius scale, size preferences and icons stay T3's; the design system has no dark UI yet.

Verification

Local, in the worktree at d2d85a96c (Node 26.5, pnpm 11.10 via vp):

• node --test scripts/lazurio-release-contract.test.mjs: 29 pass, 0 fail at the head (lazurio: the managed Folder behaves as upstream without its variable and lives in the overlay folder; overlay cleanup; Czech welcome #65's Folder seam test included), and green at each of the four commits (27, 28, 29, 29 tests). The CI allowlist guard, run locally on each commit, passes. Each new guard was broken on purpose once and the contract failed every time: 10 mutations for the distribution, 10 for the name (including a byte change in assets/ and in the wordmark), 18 for the look.
• vp test run --project unit src/branding.test.ts: 10 passed. Reverting the stage label to Alpha, or the preview rule, fails one test each.
• vp fmt --check: all 4228 files formatted. vp lint --report-unused-disable-directives (the Lint step lazurio: the managed Folder behaves as upstream without its variable and lives in the overlay folder; overlay cleanup; Czech welcome #65 added): exit 0, with upstream's existing warnings and none in a file this PR touches.
• vp run --filter @t3tools/web typecheck and vp run --filter t3 typecheck: exit 0.
• Image and archives: CI builds and checks the image (t3 v0.0.45-lazurio.0, the session TTL, LICENSE, the production favicon) and both CLI archives with their smoke and launcher install. Locally, CI's image step passed as linux/amd64 (the release's platform; an arm64 build fails before this change too, since @effect/tsgo ships no linux-arm64 binary). docker image inspect read back the five labels, and the built client has the title, the manifest names and the stylesheet. The archives need a Rust toolchain this machine does not have, so they are CI's.

In a browser (root decision 0178), Chrome 155 headless at 1440×900 @2x:

• Builds: production web builds of the old main (35a31c03e, "before") and of this branch before its rebase (d8f60bd76, "after"). The files this PR changes in the web client, and index.css, are byte-identical at the rebased head.
• Server: T3's server from source with an isolated base dir and HOME. It runs upstream's synthetic showcase data with Czech titles, at 0.0.45-lazurio.0 and at 0.0.45-preview.20261013.1.
• Simulated shell: the vendored --lz-* tokens of LazurioPlatform Plan mode, alternative answer for clarifying questions. Text cursor is stuck pingdotgg/t3code#375 (7d7e3b74) in one style first in <head>, the shell's font faces served from /.lazurio/fonts/, and <html data-lazurio-theme="light">. All of it lived in a scratch harness outside the repository.

Results:

• Light without the mark: before and after differ only in a 44×16 px box at the top of the sidebar, the new "Lazurio" label. The sampled computed values (background, ink, primary, border, sidebar, the switch's two tokens, radius, grain, body font) are equal.
• Light with the mark: the Lazurio look on the branch. Surface rgb(255,255,255), sidebar rgb(251,250,249), primary rgb(9,9,9), Inter Tight Variable with both faces and Geist Mono loaded, control radius 6px, no grain. The switch's active row is rgb(255,255,255) against its track rgb(236,235,234). In the main build the mark changes nothing (0 px, light and dark).
• Dark with the mark, and a picked theme (ocean) with the mark: before and after differ only in the label. On the branch, dark with and without the mark are pixel-identical (0 px).
• Contrast 50 and 200: foregrounds and lines fade and darken on the Lazurio palette, as on T3's.
• Menu, diff and terminal: a menu (Git actions), the diff list and its expanded hunks, and the terminal drawer all read well. Code shows in Geist Mono; T3's diff and terminal colours are kept.
• Czech in fixed-height rows: titles such as "Čtvrtletní přehled účtů ĚŠČŘŽÝÁÍÉÚŮ" and "Řízení přístupů…" render in Inter Tight in the same row heights as before. Glyph boxes are 15/17 px in 16/20 px lines, nothing clipped.
• Name: on a stable server the title was "T3 Code (Alpha)" with nothing beside the wordmark; now it is "T3 Code (Lazurio)" with the label. On a preview server it was "T3 Code (Nightly)" with the nightly sky in artwork mode, a "Nightly" pill in pill mode and nothing in none; now it is "T3 Code (Lazurio)" with the "Lazurio" label in all three modes and no artwork.

Screenshots and the metrics (results.json) are local, in ~/Lazurio/drafts/DEV-6646-polish/shots/pb-t/:

• 01–10: before/after pairs of each state;
• 08-diff-hunks-with-mark-*: the expanded diff hunks;
• 11-sidebar-czech*: the sidebar at 3x;
• 12-name-* and 12-name-montage.png: the name on stable and preview servers;
• 13-identification-* and 13-identification-montage.png: the three identification modes on a preview server.

What to check on a canary

On an Environment whose Platform has pingdotgg#375, after a preview of this branch:

• The tab title and the label beside the wordmark read "T3 Code (Lazurio)" / "Lazurio", and the preview is not called Nightly.
• The light look is the design system's: white main area, paper sidebar and rail as one surface, black buttons and Inter Tight.
• Menus, the diff, the terminal and Settings read well.
• In the shell's Chat · Apps · Automate switch, the active tab stands apart from its track.
• Dark mode and a picked theme look exactly as before.
• Contrast 50 and 200 work.
• A font chosen in Appearance still wins.
• Czech titles in the sidebar are not clipped.

On an Environment with an older Platform, T3 looks as upstream with the new name. Also check the release itself:

• The release title and notes read as above.
• docker image inspect shows the five OCI labels.
• The new issue form appears first in the chooser.

Risks

• Release order. The look depends on the Platform's shell declaring the tokens. If this releases first, nothing breaks; the look simply waits.
• Font loading. Faces load with font-display: swap, so a first load may flash the fallback font.
• New upstream tokens. Tokens upstream adds later show T3's defaults until mapped; the guard catches renames, not additions.
• Theme card. The "T3 Code" default theme card in Settings previews T3's colours while Lazurio's apply.
• Chat and Automate differ. Automate (MausBot) keeps its own look until it opts in.
• Rebase on lazurio: the managed Folder behaves as upstream without its variable and lives in the overlay folder; overlay cleanup; Czech welcome #65. Two runbook hunks were resolved: the paragraph under the Overlay table keeps lazurio: the managed Folder behaves as upstream without its variable and lives in the overlay folder; overlay cleanup; Czech welcome #65's removal of the Folder's known deviation and adds the look and the name, and row 15 in Cílový stack keeps lazurio: the managed Folder behaves as upstream without its variable and lives in the overlay folder; overlay cleanup; Czech welcome #65's file list with rows 16 and 17 after it. The allowlist and the contract test merged cleanly; lazurio: the managed Folder behaves as upstream without its variable and lives in the overlay folder; overlay cleanup; Czech welcome #65's Folder seam guard, Lint step and allowlist changes stay.

🤖 Generated with Claude Code

[agentrozjedemeai]

Blocking public-security-reporting prerequisite on exact head d2d85a9: .github/ISSUE_TEMPLATE/1-lazurio-t3-code.yml tells people with a security problem to use Security → Report a vulnerability, but the repository currently reports private-vulnerability-reporting: {"enabled":false} via the GitHub API. Merging this PR immediately publishes the form and sends reporters to a private route that does not exist; the issue chooser also disables blank issues. Please have an Admin enable private vulnerability reporting and verify the route before merging, or change the form to direct reporters to a working private channel. Once that is resolved, request a fresh exact-head review. The stylesheet gate excludes dark mode and any data-theme-id (including the editor preview), contrast is still derived from the raw tokens, the sidebar label seam and allowlist are scoped, the 23 token names match Platform interface v1, and the public prose contains no person or organization names beyond product/provider branding. Local release contract: 29/29 passed; the exact-head CI checks are green. I did not independently run the Vite branding suite in this isolated clone because dependencies are not installed; the exact-head CI reports it green.

[agentrozjedemeai]

@immakermatty Re-review of exact head d2d85a9: APPROVED. The prior blocker was external configuration, not code: GitHub now reports private-vulnerability-reporting enabled=true, so the issue form’s Security → Report a vulnerability instruction has its private route. The repository description and homepage also match D7. No commit changed. I reran the release contract in an isolated clone (29/29 pass), checked git diff --check, and confirmed exact-head CI run 38448504813 succeeded, all four required checks pass, no unresolved review threads, current base 68f22f2, and mergeable=true. Platform pingdotgg#375 remains a release-order dependency; the canary visual checks remain for preview. Please refresh the PR description’s now-stale statement that private vulnerability reporting is off before merge.