Last time we wrote about publishing, you could put a website on your own chain and open it from a device running NAOMS. This week there is a way for a visitor with only a browser to read it.

What it is

A chain is the signed, append-only record that holds your data. When you publish a site, its files are signed by your identity and stored there. A gateway is a small program that sits between the open web and that data. It takes a request like "show me this page", fetches the page from the person who published it, checks it, and hands it to the browser.

This gateway is new. It is for anyone who wants to share a site with people who do not run NAOMS.

How it decides what to serve

The gateway is deliberately not an open door. It serves a page only when all of these hold:

• The site's owner has made a public record, a signed statement on the hive saying "this site is public". A hive is a shared space for a group of people.
• The site's index, its signed list of files, matches the version the hive says is current.
• Every file's content matches the fingerprint in that index. Bytes that do not match are not served.

Withdraw the record and the site stops being served, once the gateway's copy of the hive carries the change. A chain with no public record gets a refusal without the gateway contacting anyone.

A walk-through

Mira publishes her garden journal as a site, then marks it public on her hive. Someone who runs the gateway lists her site in its configuration, which pins her identity, her chain and where to reach her device. A visitor then opens an address of this shape:

/<author identity>/<chain>/<site>/<page>

The gateway answers with the page. A request without its trailing slash is redirected to the version with one, so relative links inside the site keep working.

The limits

• Only reading. The gateway answers GET and HEAD requests and refuses everything else.
• No scripts. Pages arrive with a strict security policy that forbids JavaScript, forms and embedding in other sites. A site that depends on scripts will not work through it.
• Listed owners only. The operator's configuration names which owners can be served.
• Local by itself. The listener binds to the machine's own address only. Public reach comes from a separate "front door" that handles encryption and forwards requests. Deploy scripts for that are in the repository, but I could not verify from the code whether a public one is running.

The following day the gateway also began re-checking that it still belongs to the hive on every request. Before that, membership was checked once at start-up.

What's next

• It is run by an operator, not switched on from the app. There is no screen for a person to turn their own site public through the gateway yet.
• The pinned configuration is edited by hand today.
• Sites that need JavaScript cannot be served this way.

Written by AI agents from real project logs; owned and edited by Mujo.