Pulse + Docs on youngle.au vhost — design brief (Tam + Nova, 2026-10-18)

Access model measured TODAY (the redesign builds on real state)

Cert coverage measured: docs/pulse/eve SANs all live under one LE cert — new sections inherit cert coverage; yukonit.youngle.au's stack is the incoming tenant pre-stage.

The onset split (what changes for each site)

Pulse (public)

• Remains THE public surface (Young ruling). Everything feeding/living there stays.
• Nova lane: homepage = the public-facing brand layer: pod/brief display, market topics, contact/about; screenshot-clean; no auth intrusions.
• My lane: content pipeline stays LAB→git→site; forge output only for /pulse; daily briefs keep auto-landing.
• Constraint carried: no fleet-internal data, no agent telemetry, no research notes that aren't already public —theses anything else stays in Docs (private).

Docs (gated)

• Stays behind basic-auth TODAY; redesign may upgrade gate to O365 SSO or 2FA if Young rules (linked to the fleet 2FA question). Basic auth is the floor, not the ceiling.
• Nova lane: dashboard-as-home inside the gated area (Young's earlier dispatch) — but now the gated Docus + gate (fleet dashboard panels) becomes the private ops console; Projects + SolOS sections get client-facing rental shape.
• My lane: the only content model change is the multi-collection expansion (2→5 collections: Fleet, Projects, SolOS, Kanban, Pulse-col). Registered and working in the site TODAY for Projects/SolOS/vhost (200s).

Open rulings needed (flagged for Min/Young)

1. Final canonical names: disk now uses Docs/Fleet (SolOSV3 renamed) — organizations all agree — and Projects/{vhost,youngle,yukonit}. Any rename NOW propagates into the site nav; zero-cost if Min rules BEFORE the Nova redesign lands.
2. Is the OpsDashboard gated too? my assumption: yes — it's fleet-internal; goes under Docs or its own gated subdomain.
3. 2FA upgrade question (Young's "another feature that needs to be added as security layer") ties in here: basic-auth today; account-based 2FA needs Nuxt Auth + O365 or TOTP plugin — flagging which surface it rides (probably Docs gate + EVE tenant portals when client logins exist).

Build order (Nova leads, I support)

1. Nova specs IA + homepage cards + Pulse public layout (brief → I bring content/counts/channels).
2. My forge + git pipeline publishes the new section nav as soon as her layout lands (same 35-min build).
3. Route verify + auth boundary test after deploy (I own gates: nginx htpasswd stays; any 2FA later rides the Nuxt auth middleware).

🎯 Tam's Read: the split exists in reality — Pulse already public, Docs already gated — so the redesign is IA + visual, not infrastructure; the fleet's new sections are already serving 200 on the gated side; Nova's spec can land without infra work, and if Min locks the canonical names first, nothing renames twice.