diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 0b248f7..01ba75c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -59,9 +59,6 @@ importers:
'@astrojs/check':
specifier: ^0.9
version: 0.9.9(prettier@3.8.3)(typescript@5.9.3)
- '@types/react':
- specifier: ^19.2.16
- version: 19.2.16
typescript:
specifier: ^5
version: 5.9.3
@@ -1276,9 +1273,6 @@ packages:
'@types/node@24.12.4':
resolution: {integrity: sha512-GUUEShf+PBCGW2KaXwcIt3Yk+e3pkKwWKb9GSyM9WQVE+ep2jzmHdGsHzu4wgcZy5fN9FBdVzjpBQsYlpfpgLA==}
- '@types/react@19.2.16':
- resolution: {integrity: sha512-esJiCAnl0kfpNdE69f3So4WJUXy95dLZydX0KwK46riIHDzHM7O9Vtf9xCHW0PXIqvgqNrswl522kA/5yx+F4w==}
-
'@types/sax@1.2.7':
resolution: {integrity: sha512-rO73L89PJxeYM3s3pPPjiPgVVcymqU490g0YO5n5By0k2Erzj6tay/4lr1CHAAU4JyOWd1rpQ8bCf6cZfHU96A==}
@@ -4575,10 +4569,6 @@ snapshots:
dependencies:
undici-types: 7.16.0
- '@types/react@19.2.16':
- dependencies:
- csstype: 3.2.3
-
'@types/sax@1.2.7':
dependencies:
'@types/node': 24.12.4
diff --git a/public/brand/favicon.svg b/public/brand/favicon.svg
deleted file mode 100644
index f0ee6d1..0000000
--- a/public/brand/favicon.svg
+++ /dev/null
@@ -1 +0,0 @@
-
\ No newline at end of file
diff --git a/site/dpp-docs/README.md b/site/dpp-docs/README.md
index 3e42816..b21d898 100644
--- a/site/dpp-docs/README.md
+++ b/site/dpp-docs/README.md
@@ -39,7 +39,7 @@ site/dpp-docs/
│ └── custom.css # Starlight overrides via @odal/brand-tokens
```
-Brand assets shared with the landing site come from the workspace-root `../../public/brand/`, copied into the build by `viteStaticCopy` (see `astro.config.mjs`).
+Brand assets live in this site’s own `public/` and `src/assets/`. There is no shared asset directory — the two sites are deployed independently, and a cross-site copy step was removed because it published a duplicate favicon at a path nothing referenced.
The sidebar structure is declared in `astro.config.mjs` and mirrored by the file-system layout under `src/content/docs/`. Renamed or removed slugs keep a redirect (e.g. `/design/proof-bound` → `/getting-started/what-odal-can-and-cannot-see`); the full redirect map is in `astro.config.mjs`, which is the source of truth for the information architecture.
diff --git a/site/dpp-docs/astro.config.mjs b/site/dpp-docs/astro.config.mjs
index c73a2c0..03cb345 100644
--- a/site/dpp-docs/astro.config.mjs
+++ b/site/dpp-docs/astro.config.mjs
@@ -1,6 +1,5 @@
import { defineConfig } from 'astro/config';
import starlight from '@astrojs/starlight';
-import { viteStaticCopy } from 'vite-plugin-static-copy';
export default defineConfig({
site: 'https://docs.odal-node.io',
@@ -9,10 +8,7 @@ export default defineConfig({
// Design pages removed; redirect to the closest living equivalent.
'/design/no-touch-data': '/getting-started/what-odal-can-and-cannot-see',
'/design/proof-bound': '/getting-started/what-odal-can-and-cannot-see',
- // Points at the licence table rather than at /engine/licensing, whose
- // source is underscore-prefixed and therefore never routed. Repoint it back
- // when that page is published.
- '/design/open-core': '/introduction',
+ '/design/open-core': '/engine/licensing',
'/design/adr': '/core-concepts',
'/design/why-no-capability-gating': '/core-concepts',
// Core consolidated from per-crate/type pages into three concept pages.
@@ -82,7 +78,7 @@ export default defineConfig({
{ label: 'Operating securely', link: '/engine/security' },
{ label: 'Self-Hosting', link: '/engine/self-hosted' },
{ label: 'The CLI', link: '/engine/cli' },
- // { label: 'Licensing', link: '/engine/licensing' },
+ { label: 'Licensing', link: '/engine/licensing' },
],
},
{
@@ -108,8 +104,5 @@ export default defineConfig({
customCss: ['./src/styles/custom.css'],
}),
],
- vite: {
- plugins: [viteStaticCopy({ targets: [{ src: '../../public/brand', dest: '' }] })],
- },
output: 'static',
});
diff --git a/site/dpp-docs/src/content/docs/core/standards.mdx b/site/dpp-docs/src/content/docs/core/standards.mdx
index 615e877..d9ebee5 100644
--- a/site/dpp-docs/src/content/docs/core/standards.mdx
+++ b/site/dpp-docs/src/content/docs/core/standards.mdx
@@ -13,7 +13,13 @@ A passport is only useful if the rest of the world can read it. The core speaks
## The European system standards, tracked clause by clause
-The European DPP system standards — written by CEN/CENELEC JTC 24 — are landing in stages. Six were published in May 2026 — **EN 18216, 18219, 18220, 18221, 18222, 18223** — covering exchange, identifiers, data carriers, storage, lifecycle APIs, and interoperability. The remaining two — **EN 18239** (access rights, security, business confidentiality) and **EN 18246** (data authentication) — are at FprEN stage, expected around September 2026. Odal tracks them clause by clause in a maintained conformance matrix, and the core's identifier, carrier, API, and authentication semantics align to the published texts. One honest nuance: even a published standard is *available* but not yet *harmonised* (cited in the Official Journal) — so we build to them today and claim presumption of conformity only when that citation lands.
+The European DPP system standards — written by CEN/CENELEC JTC 24, in the EN 182xx series — are landing in stages, covering exchange, identifiers, data carriers, storage, lifecycle APIs, interoperability, access rights and data authentication.
+
+We are **tracking** that series, not claiming conformance to it, and the distinction is deliberate. These are paid standards and we have not purchased the texts. Nobody here has read them, so there is no clause-by-clause matrix and no basis on which we could assert that our identifier, carrier, API or authentication semantics align with what they actually say. We would rather state that plainly than describe an alignment nobody could check.
+
+What we have built to instead are the open, published specifications those standards draw on — GS1 Digital Link, W3C Verifiable Credentials, `did:web`, the IDTA Asset Administration Shell — all of which are readable by anyone evaluating this claim. When the EN texts are purchased and read, this page will say what was found, including where it disagrees with what we built.
+
+One further nuance that will still apply then: even a published standard is *available* but not yet *harmonised* (cited in the Official Journal), so presumption of conformity is a claim for the day that citation lands, not before.
## Read next
diff --git a/site/dpp-docs/src/content/docs/engine/_licensing.mdx b/site/dpp-docs/src/content/docs/engine/licensing.mdx
similarity index 72%
rename from site/dpp-docs/src/content/docs/engine/_licensing.mdx
rename to site/dpp-docs/src/content/docs/engine/licensing.mdx
index 2a80d0a..e114234 100644
--- a/site/dpp-docs/src/content/docs/engine/_licensing.mdx
+++ b/site/dpp-docs/src/content/docs/engine/licensing.mdx
@@ -34,16 +34,19 @@ Each `dpp-engine` release ships with a specific change date in its licence heade
## Dependency licences
-`dpp-engine` builds on `dpp-core` (Apache-2.0) and other open-source dependencies. Each crate's `Cargo.toml` declares its full dependency tree. The key third-party licences are:
-
-- **Axum / Tokio** — MIT (HTTP framework and async runtime).
-- **wasmtime** — Apache-2.0 (the sector-plugin sandbox).
-- **ed25519-dalek** — BSD 3-Clause (signing).
-- **PostgreSQL** — PostgreSQL Licence (liberal, BSD-style).
-- **Redis** — BSD 3-Clause (resolver cache).
-- **NATS** — Apache-2.0 (event bus).
-
-No dependency introduces a copyleft obligation that would propagate to `dpp-engine` users.
+`dpp-engine` builds on `dpp-core` (Apache-2.0) and a tree of open-source Rust crates.
+
+This page deliberately does **not** reproduce a table of those licences. A restated licence
+list is a claim that goes stale silently: the licence lives in the dependency's own metadata,
+changes on the dependency's schedule rather than ours, and a copy here would keep asserting the
+old terms long after they changed. That is not hypothetical — a previous version of this page
+carried a licence for one component that had been wrong since 2024.
+
+The authoritative answer for any given build is the build itself. `cargo license` or
+`cargo deny` over the workspace enumerates every crate and its licence from the resolved
+dependency graph, and `Cargo.lock` is committed, so the result is reproducible for any tagged
+release. Anyone evaluating the engine for licence compatibility should run it against the
+version they intend to deploy rather than trust a list written against some earlier one.
## Read next
diff --git a/site/dpp-docs/src/content/docs/regulatory/espr.mdx b/site/dpp-docs/src/content/docs/regulatory/espr.mdx
index 2ec2858..2159bcb 100644
--- a/site/dpp-docs/src/content/docs/regulatory/espr.mdx
+++ b/site/dpp-docs/src/content/docs/regulatory/espr.mdx
@@ -32,7 +32,7 @@ Odal covers the articles of ESPR that are technically substantive for a passport
**Articles 24 & 25** — the disclosure duty for discarded unsold consumer products (Art. 24) and the destruction ban for unsold textiles and footwear (Art. 25, Annex VII — in force for large companies since 19 July 2026). Odal carries a dedicated unsold-goods passport variant that records the disposal pathway as a verifiable record.
## Which sectors are covered
diff --git a/site/dpp-docs/src/pages/api.astro b/site/dpp-docs/src/pages/api.astro
index b676eea..d9b2d64 100644
--- a/site/dpp-docs/src/pages/api.astro
+++ b/site/dpp-docs/src/pages/api.astro
@@ -19,8 +19,10 @@ import logoDark from '../assets/logo-dark.svg';
// Same alpha banner Starlight renders on every docs page (content.config.ts
// schema default) and the same shared CSS (banner.css) — this page skips the
-// Starlight layout entirely so neither comes for free here.
+// Starlight layout entirely so neither comes for free here. The text is
+// imported from site-meta so the two banners cannot drift apart.
import '../styles/banner.css';
+import { ALPHA_BANNER_TEXT } from '../site-meta';
// Full-page OpenAPI reference, mounted client-side from the **bundled**
// @scalar/api-reference — no CDN, no third-party runtime dependency, so the
@@ -79,9 +81,11 @@ import '../styles/banner.css';
-
+
+