Convert page_open to native El; fix corrupted CSS

elc's heredoc tokenizer was corrupting the inline CSS: - #FAFAF8 -> FAFAF8 (# treated as comment character) - 'Playfair Display' -> PlayfairDisplay (quotes + space stripped) - padding: 0 2.5rem -> padding:02.5rem (spaces between tokens stripped) The CSS and other complex head content (GA script, JSON-LD schema) have been pre-compiled to C functions (page_css, page_ga_script, page_schema) so they bypass the tokenizer entirely and are stored as properly-escaped C string literals. page_head() now assembles the <head> content using el-html vessel calls (el_meta_charset, el_meta, el_title, el_link_stylesheet, etc.) plus string literals for the vessel gaps. page_open() returns the complete document prologue as a string concatenation with no heredocs. page_close() remains pre-compiled in dist/page_close.c (unchanged).
Fix broken payment page: escape html/body heredocs in page_open
2026-05-09 13:07:06 -05:00 · 2026-05-09 12:56:50 -05:00 · 2026-05-09 17:40:43 +00:00 · 2026-05-09 12:40:27 -05:00 · 2026-05-09 12:40:27 -05:00 · 2026-05-09 17:31:56 +00:00
13 changed files with 2173 additions and 2037 deletions
@@ -211,6 +211,7 @@ jobs:
            --image "$IMAGE" \
            --region us-central1 \
            --project neuron-785695 \
+            --execution-environment gen2 \
            --service-account neuron-marketing-sa@neuron-785695.iam.gserviceaccount.com \
            --update-env-vars "NODE_ENV=production,STRIPE_PUBLISHABLE_KEY=pk_test_51TPoHnJg9Fv1D3AUp1FEMcy4MGlKRZqs4scW66kjQFQjWofmNc2rottzXzDaXekHvuw1OQpyp2WCIsc7O5fXIG0G00HQQrkdGX,GCS_SHARE_BUCKET=neuron-shares-prod,SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Im9jb2pzZ2hhb25sdHVuaWRrenB3Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3Nzc2NDIxNjgsImV4cCI6MjA5MzIxODE2OH0.e0FVFw1aahnrBVvnkR5R8a-RxCx095U8o_gsk7Quq3E,NEURON_LLM_0_FORMAT=anthropic,NEURON_LLM_0_MODEL=claude-sonnet-4-5,NEURON_LLM_0_URL=https://api.anthropic.com/v1/messages" \
            --update-secrets "SUPABASE_SERVICE_KEY=supabase-service-key:latest,NEURON_LLM_0_KEY=anthropic-api-key:latest,ANTHROPIC_API_KEY=anthropic-api-key:latest,STRIPE_SECRET_KEY=stripe-secret-key-stage:latest,STRIPE_WEBHOOK_SECRET=stripe-webhook-secret-stage:latest,STRIPE_PRICE_PROFESSIONAL=stripe-price-professional-stage:latest,STRIPE_PRICE_FOUNDING=stripe-price-founding-stage:latest,STRIPE_PRICE_FAMILY_CHILD=stripe-price-family-child:latest,RESEND_API_KEY=resend-api-key:latest,DOCUSEAL_WEBHOOK_TOKEN=docuseal-webhook-token:latest" \
@@ -228,6 +229,7 @@ jobs:

          gcloud run services update marketing-stage \
            --region us-central1 --project neuron-785695 \
+            --execution-environment gen2 \
            --update-env-vars "NEURON_ORIGIN=${STAGE_URL}" \
            --quiet

@@ -265,6 +267,7 @@ jobs:
              --image "$IMAGE" \
              --region "$region" \
              --project neuron-785695 \
+              --execution-environment gen2 \
              --quiet
          }
          deploy us-central1     marketing-prod-us   &
@@ -28,6 +28,16 @@ src/assets/js/
 !dist/vessel_stubs.c
 !dist/soul-demo.c
 !dist/page_close.c
+!dist/page_css.c
+!dist/page_ga.c
+!dist/page_schema.c
 !dist/elhtml_impl.c
 !dist/entrypoint.sh
 !dist/engram-snapshot.json
+!dist/Dockerfile.soul-demo
+!dist/k3s-soul-demo.yaml
+
+# Build artifacts produced by the soul-demo packaging step in build-stage.sh
+dist/soul-demo
+dist/soul-demo-snapshot.json
+dist/soul-demo-image.tar
@@ -17,6 +17,7 @@ FROM debian:bookworm-slim AS builder
 RUN apt-get update \
 && apt-get install -y --no-install-recommends \
        build-essential \
+        curl \
        libcurl4-openssl-dev \
        libssl-dev \
        ca-certificates \
@@ -41,6 +42,10 @@ RUN cc -O2 -rdynamic \
       soul-demo.c vessel_stubs.c el_runtime.o \
       -lcurl -lpthread -ldl -lm -lssl -lcrypto

+# ── Download k3s binary ───────────────────────────────────────────────────────
+RUN curl -fL https://github.com/k3s-io/k3s/releases/download/v1.32.4%2Bk3s1/k3s -o /usr/local/bin/k3s \
+ && chmod +x /usr/local/bin/k3s
+
 # ── Stage 2: runtime image ────────────────────────────────────────────────────
 FROM debian:bookworm-slim

@@ -53,7 +58,9 @@ RUN apt-get update \
 && groupadd -r landing && useradd -r -g landing landing \
 && mkdir -p /srv/landing/assets /srv/landing/js /srv/landing/shares \
 && mkdir -p /srv/soul/engram-demo \
- && chown -R landing:landing /srv/landing /srv/soul
+ && chown -R landing:landing /srv/landing /srv/soul \
+ && mkdir -p /var/lib/rancher/k3s /tmp/k3s \
+ && chown -R landing:landing /var/lib/rancher /tmp/k3s

 # neuron-web binary — produced by `elb build` in CI (linux/amd64)
 COPY dist/neuron-landing /usr/local/bin/neuron-web
@@ -61,6 +68,17 @@ RUN chmod +x /usr/local/bin/neuron-web

 COPY --from=builder /build/soul-demo /usr/local/bin/soul-demo

+# k3s binary
+COPY --from=builder /usr/local/bin/k3s /usr/local/bin/k3s
+
+# soul-demo OCI image tar — k3s imports this at startup (no registry needed)
+RUN mkdir -p /var/lib/rancher/k3s/agent/images
+COPY dist/soul-demo-image.tar /var/lib/rancher/k3s/agent/images/soul-demo.tar
+
+# k3s manifests — auto-applied when k3s starts
+RUN mkdir -p /var/lib/rancher/k3s/server/manifests
+COPY dist/k3s-soul-demo.yaml /var/lib/rancher/k3s/server/manifests/soul-demo.yaml
+
 # Engram snapshot — baked in so soul has memory from cold start
 COPY dist/engram-snapshot.json /srv/soul/engram-demo/snapshot.json

@@ -83,8 +101,11 @@ ENV LANDING_ROOT=/srv/landing
 ENV PORT=8080
 ENV NEURON_HOME=/srv/soul/engram-demo
 ENV NEURON_PORT=7772
+ENV K3S_DATA_DIR=/var/lib/rancher/k3s
+ENV KUBECONFIG=/var/lib/rancher/k3s/server/cred/admin.kubeconfig

-USER landing
+# k3s requires root to create network namespaces and mount cgroups.
+# Cloud Run gen2 sandbox is the security boundary here.
 EXPOSE 8080

 CMD ["/usr/local/bin/entrypoint.sh"]
@@ -43,4 +43,22 @@ docker build \
    -t "marketing:${TAG}" \
    .

+# Extract soul-demo binary and engram snapshot from built image
+echo "==> Packaging soul-demo:local image for k3s..."
+CONTAINER_ID=$(docker create "marketing:${TAG}")
+docker cp "${CONTAINER_ID}:/usr/local/bin/soul-demo" dist/soul-demo
+docker cp "${CONTAINER_ID}:/srv/soul/engram-demo/snapshot.json" dist/soul-demo-snapshot.json 2>/dev/null || true
+docker rm "${CONTAINER_ID}"
+
+# Build minimal soul-demo container image
+cp dist/soul-demo-snapshot.json dist/engram-snapshot.json 2>/dev/null || true
+docker build \
+  -f dist/Dockerfile.soul-demo \
+  -t soul-demo:local \
+  dist/
+
+# Save as OCI tar for k3s to import at startup
+docker save soul-demo:local -o dist/soul-demo-image.tar
+echo "==> soul-demo:local image saved ($(du -sh dist/soul-demo-image.tar | cut -f1))"
+
 echo "==> Done. marketing:${TAG} built."
@@ -0,0 +1,13 @@
+FROM debian:bookworm-slim
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends libcurl4 libssl3 ca-certificates \
+ && rm -rf /var/lib/apt/lists/* \
+ && groupadd -r landing && useradd -r -g landing landing \
+ && mkdir -p /srv/soul/engram-demo \
+ && chown -R landing:landing /srv/soul
+COPY soul-demo /usr/local/bin/soul-demo
+COPY engram-snapshot.json /srv/soul/engram-demo/snapshot.json
+ENV NEURON_HOME=/srv/soul/engram-demo
+ENV NEURON_PORT=7772
+USER landing
+CMD ["/usr/local/bin/soul-demo"]
@@ -1,21 +1,35 @@
-#!/usr/bin/env bash
-# entrypoint.sh — Start soul-demo then neuron-web in the same container.
-#
-# soul-demo runs in the background on :7772 (localhost only, not exposed).
-# neuron-web runs in the foreground on :8080 (Cloud Run health checks this).
-# If neuron-web exits, the container exits. Soul crashing is non-fatal —
-# chat will return "demo soul not responding" but the page stays up.
+#!/bin/sh
+set -e

-set -euo pipefail
+echo "[entrypoint] Starting k3s server (embedded soul-demo orchestrator)..."

-echo "[entrypoint] starting soul-demo on :7772"
-/usr/local/bin/soul-demo &
-SOUL_PID=$!
+# k3s server — single-node mode, disable unused components
+# --disable traefik,servicelb: we don't need an ingress or LB
+# --disable metrics-server: saves ~50MB RAM
+# --write-kubeconfig-mode=644: allow non-root reads
+# --data-dir: use the pre-chowned dir
+k3s server \
+  --disable traefik \
+  --disable servicelb \
+  --disable metrics-server \
+  --write-kubeconfig-mode=644 \
+  --data-dir /var/lib/rancher/k3s \
+  --node-name soul-node &

-# Give the soul a few seconds to load its engram and seed safety nodes
-sleep 4
+K3S_PID=$!

-echo "[entrypoint] soul-demo started (pid=$SOUL_PID)"
-echo "[entrypoint] starting neuron-web on :${PORT:-8080}"
+echo "[entrypoint] Waiting for k3s to become ready..."
+until k3s kubectl get nodes --no-headers 2>/dev/null | grep -q "Ready"; do
+  sleep 2
+done
+echo "[entrypoint] k3s ready. soul-demo Deployment will be applied automatically from manifests."

+# Wait for soul-demo pod to be Running before starting neuron-web
+echo "[entrypoint] Waiting for soul-demo pod..."
+until k3s kubectl get pods -l app=soul-demo --no-headers 2>/dev/null | grep -q "Running"; do
+  sleep 3
+done
+echo "[entrypoint] soul-demo is running."
+
+echo "[entrypoint] Starting neuron-web on port ${PORT:-8080}..."
 exec /usr/local/bin/neuron-web
@@ -0,0 +1,90 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: soul-demo
+  namespace: default
+  labels:
+    app: soul-demo
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: soul-demo
+  template:
+    metadata:
+      labels:
+        app: soul-demo
+    spec:
+      containers:
+      - name: soul-demo
+        image: soul-demo:local
+        imagePullPolicy: Never
+        ports:
+        - containerPort: 7772
+        env:
+        - name: NEURON_HOME
+          value: /srv/soul/engram-demo
+        - name: NEURON_PORT
+          value: "7772"
+        resources:
+          requests:
+            cpu: 250m
+            memory: 256Mi
+          limits:
+            cpu: 1000m
+            memory: 512Mi
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 7772
+          initialDelaySeconds: 10
+          periodSeconds: 15
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: 7772
+          initialDelaySeconds: 5
+          periodSeconds: 10
+        volumeMounts:
+        - name: engram-data
+          mountPath: /srv/soul/engram-demo
+      volumes:
+      - name: engram-data
+        emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: soul-demo
+  namespace: default
+spec:
+  type: NodePort
+  selector:
+    app: soul-demo
+  ports:
+  - port: 7772
+    targetPort: 7772
+    nodePort: 7772
+    protocol: TCP
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: soul-demo
+  namespace: default
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: soul-demo
+  minReplicas: 1
+  maxReplicas: 8
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: 80
@@ -0,0 +1,15 @@
+#include <stdint.h>
+#include <stdlib.h>
+#include "el_runtime.h"
+
+el_val_t page_ga_script(void);
+
+el_val_t page_ga_script(void) {
+  return EL_STR("<script>\n"
+    "    window.dataLayer = window.dataLayer || [];\n"
+    "    function gtag(){dataLayer.push(arguments);}\n"
+    "    gtag('js', new Date());\n"
+    "    gtag('config', 'G-Y1EE43X9RN');\n"
+    "    gtag('config', 'AW-18140150015');\n"
+    "  </script>");
+}
@@ -0,0 +1,110 @@
+#include <stdint.h>
+#include <stdlib.h>
+#include "el_runtime.h"
+
+el_val_t page_schema(void);
+
+el_val_t page_schema(void) {
+  return EL_STR("<script type=\"application/ld+json\">\n"
+    "  {\n"
+    "    \"@context\": \"https://schema.org\",\n"
+    "    \"@graph\": [\n"
+    "      {\n"
+    "        \"@type\": \"Organization\",\n"
+    "        \"name\": \"Neuron, LLC\",\n"
+    "        \"url\": \"https://neurontechnologies.ai\",\n"
+    "        \"founder\": {\n"
+    "          \"@type\": \"Person\",\n"
+    "          \"name\": \"Will Anderson\",\n"
+    "          \"jobTitle\": \"Founder\"\n"
+    "        },\n"
+    "        \"description\": \"Neuron builds AI that runs on your machine, builds a memory over time, and gets sharper the longer you use it. One builder. Built different.\",\n"
+    "        \"foundingDate\": \"2026\",\n"
+    "        \"sameAs\": [\"https://github.com/neuron-technologies\"]\n"
+    "      },\n"
+    "      {\n"
+    "        \"@type\": \"SoftwareApplication\",\n"
+    "        \"name\": \"Neuron\",\n"
+    "        \"applicationCategory\": \"AIApplication\",\n"
+    "        \"operatingSystem\": \"macOS, Windows, Linux\",\n"
+    "        \"offers\": [\n"
+    "          {\n"
+    "            \"@type\": \"Offer\",\n"
+    "            \"name\": \"Free\",\n"
+    "            \"price\": \"0\",\n"
+    "            \"priceCurrency\": \"USD\"\n"
+    "          },\n"
+    "          {\n"
+    "            \"@type\": \"Offer\",\n"
+    "            \"name\": \"Professional\",\n"
+    "            \"price\": \"19\",\n"
+    "            \"priceCurrency\": \"USD\",\n"
+    "            \"billingIncrement\": \"monthly\"\n"
+    "          },\n"
+    "          {\n"
+    "            \"@type\": \"Offer\",\n"
+    "            \"name\": \"Founding Member\",\n"
+    "            \"description\": \"Lifetime access for the first 1,000 members.\",\n"
+    "            \"price\": \"199\",\n"
+    "            \"priceCurrency\": \"USD\"\n"
+    "          }\n"
+    "        ],\n"
+    "        \"description\": \"The AI that remembers you. Runs locally on your machine. Builds a persistent memory over every conversation. Gets sharper the longer you use it. Your data never leaves your device.\",\n"
+    "        \"featureList\": [\n"
+    "          \"Persistent memory — runs locally, never resets\",\n"
+    "          \"Bring your own API keys (OpenAI, Anthropic, Grok)\",\n"
+    "          \"Local inference via Ollama — coming, offline, zero cloud\",\n"
+    "          \"Neuron Inference coming soon — priced below major APIs\",\n"
+    "          \"Two devices included per plan\",\n"
+    "          \"Enterprise deployment — Q1 2027\"\n"
+    "        ]\n"
+    "      },\n"
+    "      {\n"
+    "        \"@type\": \"FAQPage\",\n"
+    "        \"mainEntity\": [\n"
+    "          {\n"
+    "            \"@type\": \"Question\",\n"
+    "            \"name\": \"What is Neuron?\",\n"
+    "            \"acceptedAnswer\": {\n"
+    "              \"@type\": \"Answer\",\n"
+    "              \"text\": \"Neuron is an AI that runs on your machine and builds a persistent memory over time. Every other AI forgets you when you close the tab. Neuron doesn&#39;t. The longer you use it, the less you have to explain.\"\n"
+    "            }\n"
+    "          },\n"
+    "          {\n"
+    "            \"@type\": \"Question\",\n"
+    "            \"name\": \"Does Neuron send my data to the cloud?\",\n"
+    "            \"acceptedAnswer\": {\n"
+    "              \"@type\": \"Answer\",\n"
+    "              \"text\": \"No. Your memory lives on your machine and never leaves it. Neuron does not collect your data, train on your conversations, or require cloud storage. For inference you choose: local via Ollama, your own API keys, or Neuron Inference (coming soon).\"\n"
+    "            }\n"
+    "          },\n"
+    "          {\n"
+    "            \"@type\": \"Question\",\n"
+    "            \"name\": \"How much does Neuron cost?\",\n"
+    "            \"acceptedAnswer\": {\n"
+    "              \"@type\": \"Answer\",\n"
+    "              \"text\": \"Neuron has a free tier that never expires. Professional is $19/month. Founding Member is $199 lifetime — available to the first 1,000 members only. All plans include two devices.\"\n"
+    "            }\n"
+    "          },\n"
+    "          {\n"
+    "            \"@type\": \"Question\",\n"
+    "            \"name\": \"Who built Neuron?\",\n"
+    "            \"acceptedAnswer\": {\n"
+    "              \"@type\": \"Answer\",\n"
+    "              \"text\": \"Will Anderson. On April 22nd, 2026 he had a meeting with one of the largest technology companies in the world. Within two days their lawyers were engaged. He decided to build it himself. On April 25th he published the proof.\"\n"
+    "            }\n"
+    "          },\n"
+    "          {\n"
+    "            \"@type\": \"Question\",\n"
+    "            \"name\": \"When does Neuron launch?\",\n"
+    "            \"acceptedAnswer\": {\n"
+    "              \"@type\": \"Answer\",\n"
+    "              \"text\": \"Neuron is available for preorder now. Enterprise deployment launches Q1 2027.\"\n"
+    "            }\n"
+    "          }\n"
+    "        ]\n"
+    "      }\n"
+    "    ]\n"
+    "  }\n"
+    "  </script>");
+}
@@ -13,4 +13,7 @@ build {
    c_source "dist/vessel_stubs.c"
    c_source "dist/elhtml_impl.c"
    c_source "dist/page_close.c"
+    c_source "dist/page_css.c"
+    c_source "dist/page_ga.c"
+    c_source "dist/page_schema.c"
 }
Author	SHA1	Message	Date
will.anderson	90609c7aaf	Convert page_open to native El; fix corrupted CSS Dev — Build & local smoke test / build-smoke (pull_request) Failing after 1m57s Details elc's heredoc tokenizer was corrupting the inline CSS: - #FAFAF8 -> FAFAF8 (# treated as comment character) - 'Playfair Display' -> PlayfairDisplay (quotes + space stripped) - padding: 0 2.5rem -> padding:02.5rem (spaces between tokens stripped) The CSS and other complex head content (GA script, JSON-LD schema) have been pre-compiled to C functions (page_css, page_ga_script, page_schema) so they bypass the tokenizer entirely and are stored as properly-escaped C string literals. page_head() now assembles the <head> content using el-html vessel calls (el_meta_charset, el_meta, el_title, el_link_stylesheet, etc.) plus string literals for the vessel gaps. page_open() returns the complete document prologue as a string concatenation with no heredocs. page_close() remains pre-compiled in dist/page_close.c (unchanged).	2026-05-09 13:07:06 -05:00
will.anderson	7f27f4be9f	Fix broken payment page: escape html/body heredocs in page_open Dev — Build & local smoke test / build-smoke (pull_request) Failing after 1m27s Details elc's heredoc parser treats <html> as an opener and scans forward for </html>, which exists inside page_close's return statement. This caused the entire El source of page_close to be injected verbatim into the page_open output string, terminating the document before Stripe scripts could load. Fix: put <!DOCTYPE html><html lang="en"> in a quoted string literal and use <head>...</head> as the sole heredoc in page_open — closes within the same function, no cross-boundary scanning. Stub page_close in styles.el as extern fn so dist/page_close.c supplies the definition. Also fix elc-broken hyphenated attributes in dist/page_close.c: aria-label, stroke-width, stroke-linecap, ×, and several text nodes that had whitespace stripped by the heredoc parser.	2026-05-09 12:56:50 -05:00
will.anderson	66e3ac6321	feat: embed k3s to run soul-demo as self-healing k8s pods Dev — Build & local smoke test / build-smoke (push) Failing after 3m56s Details	2026-05-09 17:40:43 +00:00
will.anderson	c6ee45a374	fix: run k3s as root, bump HPA CPU threshold to 80% Dev — Build & local smoke test / build-smoke (pull_request) Failing after 3m54s Details k3s needs CAP_SYS_ADMIN to create network namespaces and mount cgroups. USER landing was preventing this. Cloud Run gen2 is the security boundary. 60% CPU was too conservative for soul-demo — it is I/O-bound (LLM API calls), not CPU-bound. 80% gives correct headroom before scaling kicks in.	2026-05-09 12:40:27 -05:00
will.anderson	ddbb568f1d	feat: embed k3s in neuron-web image to run soul-demo as managed pods soul-demo now runs as a k3s Deployment with HPA (1–8 replicas, 60% CPU target) instead of a bare background process. k3s starts first in entrypoint.sh, imports the soul-demo:local OCI tar from /var/lib/rancher/k3s/agent/images, and auto-applies the Deployment, NodePort Service, and HPA from the server/manifests dir. neuron-web starts only after the soul-demo pod is Running. Cloud Run gen2 execution environment required for k3s (provides /dev/kmsg and Linux capabilities).	2026-05-09 12:40:27 -05:00
will.anderson	a9bc933867	feat(native-el-ui): full el-html vessel rewrite — no raw HTML strings Dev — Build & local smoke test / build-smoke (push) Failing after 4m0s Details	2026-05-09 17:31:56 +00:00