feat(dashboard): refresh operator workspace and public site

Author: eblackrps

.github/workflows/pages.yml

@@ -0,0 +1,41 @@
+name: Pages
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/pages.yml"
+      - "site/**"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+
+      - name: Configure GitHub Pages
+        uses: actions/configure-pages@v5
+
+      - name: Upload static site artifact
+        uses: actions/upload-pages-artifact@v4
+        with:
+          path: site
+
+      - name: Deploy GitHub Pages site
+        id: deployment
+        uses: actions/deploy-pages@v4

CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to Viaduct should be documented in this file.
 
 This changelog tracks published releases and the major implementation milestones that shaped the current repository state.
 
+## [1.4.0] - 2026-04-08
+
+### Dashboard Product Workflow
+- reorganized the React dashboard around a clearer app shell, navigation model, and feature-oriented page structure
+- turned migration planning into an operator workflow with intake, validation, saved-plan review, and execution-preparation states instead of a detached wizard
+- improved inventory, dependency, and remediation surfaces so planning context stays connected to the broader operator view
+
+### Operator Authentication And Configuration
+- added dashboard support for service-account API keys alongside tenant API keys
+- documented the new dashboard environment variable contract for local development and release packaging
+
+### Public Web Presence
+- added a standalone static `site/` for the public project surface
+- added a GitHub Pages workflow to publish the site independently from the product dashboard build
+
 ## [1.3.0] - 2026-04-07
 
 ### Tenant Isolation And Operability

README.md

@@ -10,7 +10,7 @@ Viaduct is an open source control plane for discovering, migrating, and operatin
 Broadcom's VMware licensing changes forced many teams into urgent platform decisions, but most migration tooling still assumes a one-time move into a single destination. Viaduct is built for operators who need a durable mixed-platform operating model: discover what exists, understand the blast radius, move workloads safely, preserve backup coverage, and keep managing cost, policy, and drift after cutover.
 
 ## Project Status
-Viaduct is ready for broad evaluation, operator pilots, and community contribution. The repository includes multi-platform discovery, dependency graphing, declarative migration orchestration, warm-migration primitives, lifecycle remediation, backup portability, multi-tenancy with service accounts and quota controls, plugin hosting, a web dashboard, reproducible release packaging, and a shared release gate for CI and local verification.
+Viaduct is ready for broad evaluation, operator pilots, and community contribution. The repository includes multi-platform discovery, dependency graphing, declarative migration orchestration, warm-migration primitives, lifecycle remediation, backup portability, multi-tenancy with service accounts and quota controls, plugin hosting, a web dashboard, a standalone public site, reproducible release packaging, and a shared release gate for CI and local verification.
 
 ## Supported Capabilities
 - Discovery engine: Collects normalized inventory from VMware, Proxmox, Hyper-V, KVM, Nutanix, and Veeam-related backup systems into a universal schema.
@@ -91,6 +91,7 @@ make release-gate
 
 ## Documentation Index
 - Repository docs index: [docs/README.md](docs/README.md)
+- Public site source: [site/README.md](site/README.md)
 - Architecture overview: [docs/architecture.md](docs/architecture.md)
 - Support matrix: [docs/reference/support-matrix.md](docs/reference/support-matrix.md)
 - Plugin author guide: [docs/reference/plugin-author-guide.md](docs/reference/plugin-author-guide.md)

RELEASE.md

@@ -31,6 +31,8 @@ The release bundle should include:
 - release manifest, dependency manifest, and checksums
 - deployment reference assets
 
+The standalone public site under [`site/`](site/README.md) is published through GitHub Pages and is not bundled into the tagged release artifacts.
+
 ## Release Notes Guidance
 - summarize operator-visible changes
 - document compatibility, migration, or upgrade concerns

docs/reference/configuration.md

@@ -58,6 +58,7 @@ Fields:
 
 ## Dashboard Environment Variables
 - `VITE_VIADUCT_API_KEY`: tenant API key injected into dashboard requests
+- `VITE_VIADUCT_SERVICE_ACCOUNT_KEY`: scoped service-account key injected into dashboard requests; when set, the dashboard prefers this header over `VITE_VIADUCT_API_KEY`
 
 The dashboard reads this through Vite. See [`../../web/.env.example`](../../web/.env.example).
 

site/404.html

@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Page Not Found | Viaduct</title>
+    <meta name="theme-color" content="#08151d" />
+    <link rel="icon" href="favicon.svg" type="image/svg+xml" />
+    <link rel="preconnect" href="https://fonts.googleapis.com" />
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+    <link
+      href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500&family=Public+Sans:wght@400;500;600;700&family=Space+Grotesk:wght@500;700&display=swap"
+      rel="stylesheet"
+    />
+    <link rel="stylesheet" href="styles.css" />
+  </head>
+  <body>
+    <div class="page-shell">
+      <main class="not-found">
+        <p class="eyebrow">404</p>
+        <h1>This route is not part of the current Viaduct site.</h1>
+        <p>
+          Head back to the landing page, or jump straight into the repository and quickstart docs.
+        </p>
+        <div class="hero-actions">
+          <a class="button button-primary" href="./">Return home</a>
+          <a class="button button-secondary" href="https://github.com/eblackrps/viaduct">
+            Open GitHub
+          </a>
+        </div>
+      </main>
+    </div>
+  </body>
+</html>

site/README.md

@@ -0,0 +1,71 @@
+# Public Site
+
+This directory contains the standalone static site for GitHub Pages. It is separate from the product dashboard in `web/` so the public marketing surface can deploy cleanly without pulling in the application build.
+
+## Files
+- `index.html`: primary landing page
+- `404.html`: lightweight custom not-found page
+- `styles.css`: shared site styles
+- `favicon.svg`: simple site icon
+
+## Local Preview
+
+For a quick visual check, open `site/index.html` directly in a browser.
+
+If you prefer to serve it over HTTP, use any static file server. For example, if Python is installed, run this from the repository root:
+
+```powershell
+python -m http.server 4173 --directory site
+```
+
+Then open `http://localhost:4173`.
+
+## Deployment
+
+GitHub Pages deploys this directory through `.github/workflows/pages.yml`. The workflow uploads `site/` as the Pages artifact whenever `main` changes in this directory, or when the workflow is run manually.
+
+This Pages deployment is separate from GitHub Releases. Release tags package the product artifacts; the public site publishes from the `main` branch workflow.
+
+The repository's default Pages URL will be:
+
+`https://eblackrps.github.io/viaduct/`
+
+All asset links in this site are relative so the same build works both on the default project Pages URL and on a custom domain.
+
+## Custom Domain
+
+For the current repository owner, make `viaducthq.com` the primary domain and point `www.viaducthq.com` at GitHub Pages.
+
+1. In GitHub, open `Settings -> Pages` for `eblackrps/viaduct`.
+2. Set the publishing source to `GitHub Actions` if it is not already set.
+3. In the `Custom domain` field, enter `viaducthq.com`.
+4. In DNS, configure either:
+
+| Host | Type | Value |
+| --- | --- | --- |
+| `@` | `ALIAS` or `ANAME` | `eblackrps.github.io` |
+
+Or the explicit GitHub Pages apex records:
+
+| Host | Type | Value |
+| --- | --- | --- |
+| `@` | `A` | `185.199.108.153` |
+| `@` | `A` | `185.199.109.153` |
+| `@` | `A` | `185.199.110.153` |
+| `@` | `A` | `185.199.111.153` |
+| `@` | `AAAA` | `2606:50c0:8000::153` |
+| `@` | `AAAA` | `2606:50c0:8001::153` |
+| `@` | `AAAA` | `2606:50c0:8002::153` |
+| `@` | `AAAA` | `2606:50c0:8003::153` |
+| `www` | `CNAME` | `eblackrps.github.io` |
+
+With `viaducthq.com` set as the custom domain in GitHub, GitHub Pages should redirect `www.viaducthq.com` to the apex domain once both record sets resolve correctly.
+
+## Verification And HTTPS
+
+For takeover protection, verify the domain in the account or organization Pages settings and keep the TXT verification record in DNS. After GitHub finishes issuing the certificate, enable `Enforce HTTPS` in the repository Pages settings.
+
+## Notes
+
+- Do not use wildcard DNS records for this site.
+- A `CNAME` file is not required for this workflow because custom domains are configured through GitHub Pages settings when deploying via GitHub Actions.