Protect a site once. Autopilot stays on.

GhostHue seals authorized public releases, correlates Witness Mesh evidence, and coordinates Preserve, Reflex, and Mirage when a mismatch is confirmed. Connect once. Deploy normally. GhostHue handles the rest.

GhostHue verifies configured public assets and supported browser behavior. It does not replace account security, secure development, a WAF, vulnerability management, backups, or incident investigation.

1. Create an account and start the trial flow.
2. Add a production hostname and prove domain control.
3. Add a payment method. The trial clock starts only after certification and the first current release.
4. Connect GitHub and one certified hosting profile.
5. Complete the one-time edge or DNS requirement if Mirage is eligible.
6. Deploy normally. Autopilot arms after the first verified release.

You are not asked to enable Autopilot or choose a manual/automatic mode.

A configuration that cannot complete Observe → Confirm → Preserve → Restore → Contain if needed → Verify → Recover cannot start billing.

Policy is always on for protected sites. The dashboard shows capability readiness: Seal, Monitor, Sentinel, Preserve, Reflex, Mirage, and automatic re-entry.

If one capability is unavailable, Autopilot remains always-on. Remaining safe capabilities continue. GhostHue reports the precise degraded capability instead of switching you to a monitor-only plan.

Emergency pause is an incident tool. It stops new Reflex, Mirage, and return actions for up to 24 hours. Monitoring and alerts continue. Existing safe Mirage routing is not abandoned merely because actions are paused.

Automatic restoration and Mirage edge routing stay fail-closed until owned-site acceptance tests pass. Capability flags are server-controlled.

GitHub is required for every protected site. GhostHue requests repository metadata, contents, and deployments read access. Pull request write is used only for the one-time configuration PR. Organization administration and secrets read are not requested.

Authentication from GitHub Actions uses OIDC. Release tokens are single-use, short-lived, and bound to repository ID, production branch, and a one-time nonce. Fork pull requests cannot obtain a production signature.

GhostHue correlates GitHub, the hosting control plane, the live site, and an independent ledger. Agreement between two compromised systems is never enough.

Source and build witnesses come from GitHub. Provider witnesses come from the hosting control plane. Live witnesses come from independent fetches of production. Ledger witnesses are GhostHue’s signed event chain, stored outside GitHub and the customer host.

The PNG seal is a passive live-site carrier. Pixels do not execute code, call GhostHue, or activate Mirage.

Every protected site uses one GitHub repository, one production branch, and one hosting profile. A combination is advertised as available only after production certification. AWS means Amplify Hosting or S3 + CloudFront. Google Cloud means Firebase Hosting or Cloud Run. Azure means Static Web Apps.

The eight combinations are GitHub with Vercel, Firebase Hosting, Cloudflare Pages, AWS Amplify Hosting, AWS S3 + CloudFront, Netlify, Google Cloud Run, and Azure Static Web Apps.

AWS does not mean arbitrary AWS. Google Cloud does not mean arbitrary GCP. Azure does not mean App Service, Functions, Blob static websites, or Container Apps. Firebase Hosting does not include Functions, Firestore, or other Firebase products.

A profile remains Coming on the public site until its production certification flag is enabled. AWS Amplify Hosting and Azure Static Web Apps stay unavailable until exact-restoration spikes pass.

Seal the final build output after Vercel’s compile step and before the production deploy of those artifacts. If Vercel image optimization rewrites the carrier PNG, setup fails closed until you select an unprocessed static PNG or disable that transform for the carrier.

Build locally or in GitHub Actions, run the GhostHue seal against the output directory, then deploy the sealed directory with Firebase Hosting. Do not hash source files. Hash the bytes that will be served.

Each authorized release is bound to a signed manifest and an invisible PNG marker. The PNG does not execute code. Copying or replacing an old seal does not authorize a fraudulent release.

Sentinel is separate JavaScript and may be blocked or removed. It never collects form values, keystrokes, or authentication tokens. It begins in Observe and can advance to Guard only after compatibility requirements pass. It cannot authorize Reflex or Mirage by itself.

Observe-only ingestion is not generally available until the Sentinel flag is enabled.

When GhostHue confirms an integrity incident, it writes a signed, text-only Incident Record of expected-versus-observed fingerprints and the response. Altered website files are never stored. Restoring production does not erase the record.

Reflex restores the exact last verified provider release after Preserve commits. It does not identify attackers, restore databases, or lock anyone out of customer accounts. Automatic Reflex remains fail-closed until acceptance tests pass.

Mirage v1 is a static, read-only continuity mode. Visitors receive the last verified shadow. Forms and payments do not run. GhostHue does not scrape the live site to create that shadow after an incident begins.

Use the public verification utility to check schema, digest, signature, key version, and timestamps. A valid record proves GhostHue signed that record, not the identity of an attacker.

If a capability shows DEGRADED or ACTION REQUIRED, Autopilot policy is still always-on. Fix the listed permission, shadow verification, or provider connection. Do not look for a mode selector.

Existing monitor-only sites see one migration request when new provider or edge authority is required. Monitoring continues until that authorization is complete.

GhostHue can automatically restore supported verified provider releases and serve an eligible verified static shadow. It is not a general database backup, malware-removal service, or full disaster-recovery platform.

GhostHue verifies configured public assets and supported browser behavior. It does not replace account security, secure development, a WAF, vulnerability management, backups, or incident investigation.