fix(website): audit sweep (legal, docs, rendering, accuracy)

website/content/docs/guides/meta.json

@@ -2,9 +2,15 @@
   "title": "Guides",
   "pages": [
     "eu-ai-act-compliance",
+    "eu-compliance-walkthrough",
     "risk-classification",
     "reputation",
     "integration-guide",
+    "langchain",
+    "openai-agents-sdk",
+    "crewai",
+    "offline-verify",
+    "base-l2-anchor",
     "architecture"
   ]
 }

website/content/docs/reference/meta.json

@@ -2,6 +2,7 @@
   "title": "Reference",
   "pages": [
     "api-reference",
+    "mcp-tools",
     "concepts",
     "configuration",
     "glossary",

website/content/research-paper.mdx

@@ -30,9 +30,13 @@ The full paper is available at [attestix.io/research](/research).
 If you find Attestix useful in your research, please cite us:
 
 ```bibtex
-@article{dubasi2026attestix,
+@online{dubasi2026attestix,
   title={Attestix: Attestation Infrastructure for AI Agents},
   author={Dubasi, Pavan Kumar},
-  year={2026}
+  organization={VibeTensor Private Limited},
+  year={2026},
+  url={https://attestix.io/research}
 }
 ```
+
+A formal conference / journal entry will replace this online citation once the paper is accepted for publication.

website/src/app/(marketing)/demo/compliance-checker/step-result.tsx

@@ -14,6 +14,16 @@ interface StepResultProps {
 export function StepResult({ result, onStartOver }: StepResultProps) {
   return (
     <div className="space-y-6">
+      {/* Top-of-page legal advisory (not a footer disclaimer) */}
+      <div className="rounded-lg border border-amber-500/40 bg-amber-500/10 p-4 text-sm text-amber-200">
+        <div className="font-semibold">Educational tool, not legal advice.</div>
+        <div className="mt-1 leading-relaxed">
+          The classification below is a first-pass heuristic. It does not
+          replace a qualified EU AI Act lawyer. Your actual obligations depend
+          on your full system design, deployment context, and intended use.
+        </div>
+      </div>
+
       {/* Risk Level Card */}
       <motion.div
         initial={{ opacity: 0, scale: 0.95 }}

website/src/app/(marketing)/sbom/page.tsx

@@ -5,7 +5,7 @@ import Link from "next/link";
 export const metadata = constructMetadata({
   title: "SBOM",
   description:
-    "Attestix software bill of materials. Mirror of pyproject.toml plus the authoritative CycloneDX SBOM published with every GitHub release.",
+    "Attestix software bill of materials. Mirror of pyproject.toml at the v0.3.0 release. See GitHub for the machine-readable CycloneDX artefact when published.",
 });
 
 interface Dep {
@@ -241,17 +241,18 @@ export default function SbomPage() {
         >
           pyproject.toml
         </Link>{" "}
-        at the v0.3.0 release. For the authoritative machine-readable SBOM
-        (CycloneDX), see the{" "}
+        at the v0.3.0 release. Generated CycloneDX artefacts are available
+        alongside published GitHub releases when attached; for the most
+        current pinned set, read{" "}
         <Link
-          href="https://github.com/VibeTensor/attestix/releases"
+          href="https://github.com/VibeTensor/attestix/blob/main/pyproject.toml"
           target="_blank"
           rel="noopener noreferrer"
           className="text-atx-accent hover:underline"
         >
-          GitHub release artefacts
-        </Link>
-        .
+          pyproject.toml
+        </Link>{" "}
+        on main.
       </p>
 
       <DepTable title="Runtime dependencies" deps={RUNTIME} />

website/src/app/(marketing)/security/page.tsx

@@ -8,9 +8,11 @@ export const metadata = constructMetadata({
     "Responsible disclosure, security fixes, and vulnerability handling for Attestix.",
 });
 
-// Disclosure dates reflect when the fix landed on main, not when the
-// report was received. All four shipped together in the v0.3.0 security
-// batch after coordinated internal review.
+// ATX-* are internal tracking IDs, not CVE IDs. Dates reflect when the
+// fix landed on main. All four shipped together in the v0.3.0 security
+// batch after coordinated internal review. Upstream dependency CVEs are
+// linked directly; project-scoped findings are tracked internally and
+// will be promoted to CVE IDs when disclosed externally.
 const DISCLOSURES = [
   {
     id: "ATX-2026-04",
@@ -19,14 +21,17 @@ const DISCLOSURES = [
     title: "Delegation chain auth bypass",
     fix: "Parent token verification + capability attenuation enforced in UCAN chain.",
     version: "0.3.0",
+    reference: null,
   },
   {
     id: "ATX-2026-03",
     date: "2026-04-15",
     severity: "HIGH",
-    title: "PyJWT CVE mitigation (CVE-2026-32597)",
+    title: "PyJWT upstream CVE mitigation",
     fix: "Pinned PyJWT >= 2.12.0 with dependency lock.",
     version: "0.3.0",
+    reference:
+      "https://github.com/jpadilla/pyjwt/security/advisories",
   },
   {
     id: "ATX-2026-02",
@@ -35,6 +40,7 @@ const DISCLOSURES = [
     title: "Server-side request forgery in agent-card fetch",
     fix: "URL allowlist, private-IP block, redirect limit.",
     version: "0.3.0",
+    reference: null,
   },
   {
     id: "ATX-2026-01",
@@ -43,6 +49,7 @@ const DISCLOSURES = [
     title: "API timing side-channel on credential verify",
     fix: "Constant-time signature comparison.",
     version: "0.3.0",
+    reference: null,
   },
 ];
 
@@ -108,6 +115,12 @@ export default function SecurityPage() {
       <h2 className="mt-16 font-mono-atx text-[11px] uppercase tracking-[0.14em] text-atx-ink-dim">
         Recent disclosures
       </h2>
+      <p className="mt-3 max-w-[720px] text-[13.5px] leading-[1.6] text-atx-ink-mid">
+        ATX-* are internal tracking IDs assigned during the coordinated fix
+        cycle, not CVE numbers. Upstream dependency fixes link to the
+        upstream advisory. Project-scoped findings are promoted to CVE
+        assignments when disclosed externally.
+      </p>
       <div className="mt-6 overflow-hidden rounded-atx-md border border-atx-line-soft">
         <table className="w-full border-collapse text-left text-[13px]">
           <thead className="bg-atx-bg-sunken">

website/src/app/docs/layout.tsx

@@ -11,7 +11,7 @@ export default function Layout({ children }: { children: ReactNode }) {
         title: (
           <div className="flex items-center gap-2">
             <Icons.logo className="h-5 w-5" />
-            <span className="font-serif text-[18px] leading-none">
+            <span className="font-semibold text-[15px] leading-none">
               Attestix
             </span>
           </div>

website/src/app/globals.css

@@ -572,10 +572,15 @@
   }
 }
 
-/* Fumadocs sidebar: mono uppercase eyebrows on section labels.
- * Fumadocs renders folder headings with data-folder="true". */
+/* Fumadocs sidebar: mono uppercase eyebrows on folder section labels.
+ * Fumadocs v15.8 renders folder headings either with data-folder="true"
+ * (older markup) or as collapsible buttons within [data-collapse]; cover
+ * both so the selector stays valid across minor upgrades. */
 #nd-sidebar [data-folder="true"] > button,
-#nd-sidebar [data-folder="true"] > span {
+#nd-sidebar [data-folder="true"] > span,
+#nd-sidebar [data-collapse] > button,
+#nd-sidebar button[data-sidebar-folder],
+#nd-sidebar [data-sidebar-folder] > span {
   font-family: var(--font-mono-atx);
   font-size: 10.5px;
   letter-spacing: 0.14em;

website/src/components/mermaid.tsx

@@ -4,6 +4,23 @@ import { useEffect, useRef, useState } from "react";
 
 let mermaidInitialized = false;
 
+// Palette mirrors the v2 atx token set so Mermaid diagrams read as part of
+// the Attestix design, not a foreign indigo overlay. Colours are resolved
+// at module load from CSS custom properties when available; otherwise the
+// literals below are the same oklch values expressed as hex fallbacks.
+const PALETTE = {
+	bg: "#1e2426",            // --atx-bg-sunken
+	panel: "#2a3236",         // --atx-panel
+	panelHi: "#33393d",       // --atx-panel-hi
+	line: "#454c50",          // --atx-line
+	lineSoft: "#373d41",      // --atx-line-soft
+	ink: "#f0ebde",           // --atx-ink
+	inkMid: "#c4b9a5",        // --atx-ink-mid
+	inkDim: "#8b8170",        // --atx-ink-dim
+	accent: "#c49455",        // --atx-accent (gold)
+	accentDeep: "#a67a41",    // --atx-accent-deep
+};
+
 export function Mermaid({ chart }: { chart: string }) {
 	const ref = useRef<HTMLDivElement>(null);
 	const [svg, setSvg] = useState<string>("");
@@ -17,56 +34,50 @@ export function Mermaid({ chart }: { chart: string }) {
 			if (!mermaidInitialized) {
 				mermaid.initialize({
 					startOnLoad: false,
-					theme: "dark",
+					theme: "base",
 					themeVariables: {
-						/* Global text and background */
-						background: "#1e1b4b",
-						mainBkg: "#312e81",
-						textColor: "#e2e8f0",
+						background: PALETTE.bg,
+						mainBkg: PALETTE.panel,
+						textColor: PALETTE.ink,
 						fontSize: "14px",
 
-						/* Primary palette */
-						primaryColor: "#4f46e5",
-						primaryTextColor: "#fff",
-						primaryBorderColor: "#6366f1",
-						lineColor: "#94a3b8",
-						secondaryColor: "#1e1b4b",
-						secondaryTextColor: "#e2e8f0",
-						tertiaryColor: "#1e293b",
-						tertiaryTextColor: "#e2e8f0",
-
-						/* Notes */
-						noteBkgColor: "#1e293b",
-						noteTextColor: "#e2e8f0",
-						noteBorderColor: "#475569",
-
-						/* Sequence diagram actors and signals */
-						actorBkg: "#4f46e5",
-						actorTextColor: "#fff",
-						actorBorder: "#818cf8",
-						actorLineColor: "#94a3b8",
-						signalColor: "#e2e8f0",
-						signalTextColor: "#e2e8f0",
-
-						/* Labels and loops */
-						labelBoxBkgColor: "#1e293b",
-						labelBoxBorderColor: "#475569",
-						labelTextColor: "#e2e8f0",
-						loopTextColor: "#e2e8f0",
-
-						/* Activation bars */
-						activationBorderColor: "#6366f1",
-						activationBkgColor: "#312e81",
-						sequenceNumberColor: "#fff",
-
-						/* Flowchart nodes */
-						nodeBorder: "#6366f1",
-						clusterBkg: "#1e1b4b",
-						clusterBorder: "#475569",
-						titleColor: "#e2e8f0",
-						edgeLabelBackground: "#1e293b",
+						primaryColor: PALETTE.accent,
+						primaryTextColor: PALETTE.bg,
+						primaryBorderColor: PALETTE.accentDeep,
+						lineColor: PALETTE.inkDim,
+						secondaryColor: PALETTE.panelHi,
+						secondaryTextColor: PALETTE.ink,
+						tertiaryColor: PALETTE.panel,
+						tertiaryTextColor: PALETTE.ink,
+
+						noteBkgColor: PALETTE.panelHi,
+						noteTextColor: PALETTE.ink,
+						noteBorderColor: PALETTE.line,
+
+						actorBkg: PALETTE.panel,
+						actorTextColor: PALETTE.ink,
+						actorBorder: PALETTE.accent,
+						actorLineColor: PALETTE.inkDim,
+						signalColor: PALETTE.inkMid,
+						signalTextColor: PALETTE.ink,
+
+						labelBoxBkgColor: PALETTE.panelHi,
+						labelBoxBorderColor: PALETTE.line,
+						labelTextColor: PALETTE.ink,
+						loopTextColor: PALETTE.ink,
+
+						activationBorderColor: PALETTE.accent,
+						activationBkgColor: PALETTE.panel,
+						sequenceNumberColor: PALETTE.bg,
+
+						nodeBorder: PALETTE.accent,
+						clusterBkg: PALETTE.bg,
+						clusterBorder: PALETTE.line,
+						titleColor: PALETTE.ink,
+						edgeLabelBackground: PALETTE.panel,
 					},
-					fontFamily: "var(--font-geist-sans), system-ui, sans-serif",
+					fontFamily:
+						"var(--font-sans), var(--font-geist-sans), system-ui, sans-serif",
 					fontSize: 14,
 					flowchart: { curve: "basis", padding: 16 },
 					sequence: { mirrorActors: false, bottomMarginAdj: 2 },
@@ -84,12 +95,14 @@ export function Mermaid({ chart }: { chart: string }) {
 		}
 
 		render();
-		return () => { cancelled = true; };
+		return () => {
+			cancelled = true;
+		};
 	}, [chart]);
 
 	if (!svg) {
 		return (
-			<div className="my-6 flex items-center justify-center rounded-lg border border-border bg-muted/50 p-8 text-sm text-muted-foreground">
+			<div className="my-6 flex items-center justify-center rounded-atx-md border border-atx-line-soft bg-atx-bg-sunken p-8 text-sm text-atx-ink-dim">
 				Loading diagram...
 			</div>
 		);
@@ -99,7 +112,7 @@ export function Mermaid({ chart }: { chart: string }) {
 		<div
 			ref={ref}
 			data-mermaid=""
-			className="my-6 flex justify-center overflow-x-auto rounded-lg border border-border bg-fd-card p-4 [&_svg]:max-w-full"
+			className="my-6 flex justify-center overflow-x-auto rounded-atx-md border border-atx-line-soft bg-atx-bg-sunken p-4 [&_svg]:max-w-full"
 			dangerouslySetInnerHTML={{ __html: svg }}
 		/>
 	);

website/src/components/sections/v2/benchmarks.tsx

@@ -25,10 +25,10 @@ const BENCHES: Bench[] = [
   },
   {
     label: "VC issuance end-to-end",
-    value: "3.2",
+    value: "17",
     unit: "ms median",
-    detail: "Canonicalise (JCS) + sign (Ed25519) + persist",
-    spark: [18, 17, 16, 17, 15, 16, 15, 15, 14, 15, 14, 14],
+    detail: "Canonicalise (JCS) + sign (Ed25519) + persist JSON store",
+    spark: [19, 18, 17, 18, 17, 17, 16, 17, 16, 17, 16, 17],
   },
   {
     label: "Audit chain verify",

website/src/components/sections/v2/hero-cert.tsx

@@ -49,6 +49,10 @@ export function HeroCert() {
           <div className="k">Basis</div>
           <div className="v">{c.basis}</div>
         </div>
+        <div className="atx-cert-row">
+          <div className="k">Sample</div>
+          <div className="v">illustrative \u00B7 not a real certificate</div>
+        </div>
         <div className="atx-cert-row">
           <div className="k">Issued</div>
           <div className="v">{c.issued}</div>

website/src/components/sections/v2/hero-v2.tsx

@@ -10,8 +10,8 @@ export function HeroV2() {
       <div className="mb-10 inline-flex flex-wrap items-center gap-3 rounded-atx-sm border border-atx-line-soft bg-atx-bg-sunken px-3.5 py-2 font-mono-atx text-[11.5px] text-atx-ink-mid">
         <span className="inline-block h-1.5 w-1.5 rounded-full bg-atx-err" />
         <span>
-          Enforcement in <AtxCountdown /> &middot; Fines up to &euro;35M or 7%
-          global revenue
+          Main enforcement wave in <AtxCountdown /> (high-risk systems, Aug 2,
+          2026) &middot; Fines up to &euro;35M or 7% global revenue
         </span>
       </div>
       <div className="grid items-start gap-14 lg:grid-cols-[1.15fr_1fr]">