Cinderpath

CWL

This site is written in Chrysalis Web Language — a small file that describes every page and form. Other AgenticOps tools can read it and ask: is this still the product we published?

It is not a filter on the sites you visit through the VPN. It is the DNA of this shop and account surface.

In plain words

Some VPNs bolt on a blocklist and call it threat protection. Ours is a blueprint of sign-in, the shop, and making a connection. Helix can sit in front of this website and check the HTTP shape still matches — only here, not inside your tunnel.

Status: /cwl-security. Path policy: /product/paths.

Phone and desktop

The layout adapts. Your browser tells us phone or desktop (cookie desktop). CWL does not invent a UA regex for that. Tip 1.0.35.

What it covers

Home, paths, the path, security, apps, FAQ, privacy, terms, status, sign-in, account, connection, admin — same chrome, CWL chip in the nav. Forms, cookies, health checks. Pages you see are compiled from this genome. Land and egress for each path live in the genome too.

What Go still does

The file names the hard parts on purpose: hashing passwords, minting WireGuard peers, drawing QR codes, stitching live HTML into lists. Those are holes. Go runs them. The language does not pretend to.

The file

Download cinderpath.cwl — same bytes as below.

# Cinderpath customer site CWL genome (tip 1.0.35 semantics)
# Language pillar: AgenticOp-io/chrysalis-cwl (@agenticop-io/cwl)
# cinderpath-web compiles this file to embedded JSON and renders GET pages from it.
# Holes live in this genome. Go is only the hole executor (does not invent the vocabulary).
# Product meaning (paths, SKUs, fabric, public URL, tip) lives in CWL — not in Go defaults.
# Path / SKU / fabric land+egress policy: import site-paths.cwl (GET /product/paths).

module cinderpath;
use json;
use urlencoded;
use auth session;

import "site-static.cwl";
import "site-interactive.cwl";
import "site-legal.cwl";
import "site-paths.cwl";

layout site {
  header User-Agent;
  hole unsupported:opaque-script;
  hole hub-cwl:html-fragment;
  client ui "device" {
    on resize { action "classify-device"; }
  }
  chrome html "<header class='top'><a class='brand' href='/'><img src='/static/mark.png' width='40' height='40' alt=''> Cinderpath</a><nav><a href='/shop'>Paths</a><a href='/path'>The path</a><a href='/security'>Security</a><a href='/downloads'>Apps</a><a href='/faq'>FAQ</a><a class='cwl-chip' href='/cwl' title='Chrysalis Web Language'>CWL</a>nav_auth</nav></header>";
}

@route GET "/healthz"
handler healthz {
  effects: none;
  return { ok: true, service: "cinderpath-web", genome: "cwl", tip: "1.0.35" };
}

@route GET "/cwl-security"
handler cwl_security {
  effects: none;
  header User-Agent;
  return { ok: true, product: "cwl-security", built_in: true, scope: "cinderpath-control-plane", genome: "/cinderpath.cwl", tip: "1.0.35", language: "chrysalis-cwl", secure: "Helix Mode A on account/shop/connect HTTP; traffic DNA + optional CWL bridge RFC-0022; CINDERPATH_CONTROL_PLANE_OK", helix_plane: "control-plane", tunnel_inspection: false };
}

@route POST "/login"
handler login_post {
  effects: auth.verify, session.mint, csrf.verify;
  hole hub-cwl:credential-store;
  body email;
  body password;
  body next;
  response-header Set-Cookie = "cp_session=; Path=/; HttpOnly; SameSite=Lax";
  return { ok: true };
}

@route POST "/register"
handler register_post {
  effects: db.write, session.mint;
  hole hub-cwl:credential-store;
  body email;
  body password;
  body password2;
  return { ok: true };
}

@route POST "/logout"
handler logout {
  effects: session.revoke;
  return { ok: true };
}

@route POST "/forgot"
handler forgot_post {
  effects: db.read, mail.send;
  hole hub-cwl:credential-store;
  body email;
  return { ok: true };
}

@route POST "/reset"
handler reset_post {
  effects: db.write;
  hole hub-cwl:credential-store;
  body token;
  body password;
  body password2;
  return { ok: true };
}

@route POST "/account/password"
handler account_password {
  effects: session.read, auth.require, csrf.verify, db.write;
  hole hub-cwl:credential-store;
  body csrf;
  body current;
  body password;
  body password2;
  return { ok: true };
}

@route POST "/shop/buy"
handler shop_buy {
  effects: session.read, auth.require, csrf.verify, db.write;
  body csrf;
  body sku;
  return { ok: true, sku: sku };
}

@route POST "/connect"
handler connect_post {
  effects: session.read, auth.require, csrf.verify, db.write;
  body csrf;
  body sku;
  body exit;
  body client;
  # Path land/egress vocabulary: GET /product/paths (site-paths.cwl).
  # The POP that serves a path is chosen by that policy, so the destination is
  # not a literal this route can declare — the transfer stays host-owned.
  hole hub-cwl:keypair-gen;
  hole hub-cwl:upstream-proxy;
}

@route GET "/connect/conf"
handler connect_conf {
  effects: session.read, auth.require;
  content-type "application/octet-stream";
  hole hub-cwl:binary-render;
}

@route GET "/connect/qr.png"
handler connect_qr {
  effects: session.read, auth.require;
  content-type "image/png";
  hole hub-cwl:binary-render;
}

@route POST "/admin/grant"
handler admin_grant {
  effects: session.read, auth.require, csrf.verify, db.write;
  body csrf;
  body email;
  body sku;
  return { ok: true };
}

@route POST "/admin/password"
handler admin_password {
  effects: session.read, auth.require, csrf.verify, db.write;
  hole hub-cwl:credential-store;
  body csrf;
  body email;
  body password;
  return { ok: true };
}