feat(site): the AI-assistant page, and the evidence stack + MCP on the home cards

[eaitbrahim]

What

Two halves, one PR — the second is the front door for the first.

#118 — /{en,ar,fr}/assistant/ — keel's answer to JesseGPT-style hosted assistants: point your own assistant at your own keel. The engine already ships a read-only MCP server (keel mcp, 8 tools, stdio); the page documents the better version of what Jesse charges for, for free:

• What an MCP server is, in one plain sentence, then the specifics: stdio JSON-RPC 2.0, hand-rolled over the standard library (no MCP SDK, no pydantic, no asyncio, no new dependency), serverInfo = keel-read-only.
• The exact config from the engine's own docs, copied verbatim — uv run keel --db keel.db --config config.yaml mcp and the mcpServers JSON block — single-sourced as RUN_COMMAND / CLIENT_CONFIG constants so no locale can drift from the engine's words. Per the issue, no per-client configs written from memory: the engine's instruction is "point any stdio MCP client at the command", and the page says where each client keeps its config is the client's own documentation.
• The eight tools and what they let an assistant do (doctor, capabilities, profiles, orders, veto_log, purification, trials, reports) — each delegating to the same service seams an operator's front-end calls, so an assistant and a terminal cannot be shown two different accounts of one deployment.
• The cannot-do list, present and specific: cannot attest, promote, arm autonomy, or place/halt/release an order — enforced PRAGMA query_only = ON, by construction rather than by policy, plus tests/mcp/test_readonly.py (committed before keel/mcp/ existed) and the six walls from the engine's own page. The boundary is named as the feature: an assistant that could author and promote a rule would route around the ladder and the gates in a single sentence.
• The honest boundary in the site's voice: keel hosts nothing, sees nothing, relays nothing; no cloud assistant, no account, no key, nothing to log into. With the stated caveat that where the assistant's own provider processes prompts is the user's arrangement — keel is not a party to it. (Deliberately not the flat "nothing leaves your machine": the keel half never leaves the machine, and the page says exactly that much.)
• The honest fit mirrors keel#579: the assistant proposes, the gate decides.
• Nav placement after Docs; footer needs no change (it enumerates project links, not pages).

Content sync, not duplication (issue's done-when): docs/mcp-server.md joins engine-docs.manifest.json, so the full server reference is fetched at build time and renders at /en/docs/mcp-server/ (reference section, all three docs editions) — the fetch-engine-docs.mjs pattern. If the doc moves upstream, the build fails; the site never renders it stale.

#119 — the home capability cards went from three claims to five, ×3 locales, each with the Features-page verify pointer (repo path pinned to the release the build resolved — v0.12.2 today):

• The evidence stack (new): the hash-chained trials ledger (keel trials verify walks the chain and reports any break), and around it the research modules — significance against break-even priced at the fee actually paid, PBO/CSCV, Deflated Sharpe + Minimum Backtest Length, Monte Carlo + candle bootstrap, rolling-origin walk-forward — all report-only under the Strathern rail: a score may report, and may gate, but may never be a ranking key.
• The read-only MCP server (new): eight tools over stdio, cannot place/halt/attest/promote/arm, query_only at the engine level — and the card links to /assistant/ as its front door (the pairing the issue asked for).
• The existing three cards (screening / rails / gates) keep their copy unchanged and gain the same verify links.

The honest finding stays above the fold, untouched. No feature-card sprawl: five claims, all checkable.

Verify links — all against the pinned tag v0.12.2

curl -sI → 200 on every engine URL emitted by the six pages:

200  blob/v0.12.2/docs/mcp-server.md
200  blob/v0.12.2/keel/mcp/tools.py
200  blob/v0.12.2/tests/mcp/test_readonly.py
200  tree/v0.12.2/keel/research
200  blob/v0.12.2/keel/agent.py
200  blob/v0.12.2/keel/compliance/screen.py
200  blob/v0.12.2/keel/execution/guards.py
200  blob/v0.12.2/docs/experiments/2026-08-13-restated-under-a-production-faithful-engine.md
200  issues/579  (302 → pull/579, canonical redirect)

check-engine-refs passes — no branch-pinned engine URLs anywhere.

Checked

• npm run check — 0 errors, 0 warnings (5 pre-existing hints in untouched files).
• npm run build — clean; build resolved docs ref v0.12.2.
• dist/{en,ar,fr}/assistant/index.html present; all three in sitemap-0.xml; hreflang alternates + canonical per page; rev markers 2026-08-28.1 on ar/fr with no stale banner (translations current).
• dist/en/docs/mcp-server/index.html rendered from the fetched doc.
• Puppeteer, 390×844, zero horizontal overflow (page-level and element-level) on /en|ar|fr/assistant/ and /en|ar|fr/ — the only element off-canvas is the skip link, by design and identical on every pre-existing page.

Decisions worth reviewing

• /assistant/, not /en/ai — the issue body says /en/ai; this branch ships /assistant/ (reviewer's call when handing this off). Slugs stay identical across locales per FR-2; renaming later is a config + dict change.
• The "nothing leaves your machine" claim is scoped to keel's half, with the assistant-provider caveat stated — the site's register doesn't allow the flat version.
• keel#579 is a PR, not an issue; the copy says "design note" and the verify link follows the redirect.
• /en/compare was left alone — the issue defers it until this lands.

Closes #118
Closes #119

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud