Generate daemon plan artifacts

docs/configuration.md

@@ -25,6 +25,7 @@ canonical_url = "https://wownero.org"
 
 [site.outputs]
 root = "/var/www/ampg/wownero"
+plan_root = "/var/lib/ampg/plans"
 
 [site.interactions]
 default_tier = "static"
@@ -43,6 +44,8 @@ daemon = "tor"
 daemon_policy = "auto"
 local_port = 18080
 onion_location = "auto"
+max_asset_bytes = 1048576
+script_policy = "strip"
 
 [site.protocols.i2p]
 enabled = false
@@ -50,6 +53,10 @@ renderer = "privacy-html"
 daemon = "i2pd"
 daemon_policy = "auto"
 local_port = 18081
+keys_file = "wownero-web.dat"
+tunnel_name = "wownero-web"
+max_asset_bytes = 1048576
+script_policy = "strip"
 
 [site.protocols.gemini]
 enabled = false
@@ -88,6 +95,8 @@ workflow.
 - remote fonts, analytics, and third-party embeds.
 - localStorage/sessionStorage assumptions.
 - non-local asset references unless explicitly allowed.
+- JavaScript files when `script_policy = "strip"`.
+- assets larger than `max_asset_bytes`.
 
 `gemtext` defaults:
 
@@ -163,6 +172,54 @@ max_tier = "forms"
 `max_tier` is a hard cap. If a route needs a higher tier than the protocol allows, AMPG
 omits it or renders a safe alternate page.
 
+## Protocol-only deployments
+
+Enabled protocols are independent. A config can omit clearnet entirely and publish only
+to I2P, Tor, Gemini, Reticulum, or any combination of supported targets.
+
+For an existing HTML site that should publish only to I2P:
+
+```toml
+[[site]]
+id = "example_i2p_only"
+domain = "example.org"
+
+[site.source]
+kind = "static-html"
+path = "../example.org"
+
+[site.outputs]
+root = "/var/www/ampg/example"
+plan_root = "/var/lib/ampg/plans"
+
+[site.protocols.i2p]
+enabled = true
+renderer = "privacy-html"
+daemon = "i2pd"
+daemon_policy = "auto"
+local_port = 18081
+keys_file = "example-web.dat"
+tunnel_name = "example-web"
+max_asset_bytes = 524288
+script_policy = "strip"
+```
+
+This builds only the I2P output root and only the I2P/nginx plan snippets.
+
+## Plan artifacts
+
+`ampg plan` prints expected artifact paths. `ampg plan --write-artifacts` writes
+reviewable snippets under `site.outputs.plan_root`.
+
+Generated snippets are not installed by `plan`:
+
+- nginx server blocks for static HTTP roots.
+- Tor hidden-service snippets for loopback HTTP targets.
+- i2pd server tunnel snippets for I2P web publishing.
+
+I2P web tunnels should use a web-specific key file such as `wownero-web.dat`; AMPG does
+not reuse daemon RPC/P2P tunnel keys for web publishing.
+
 ## Reusable checklist
 
 - [ ] Keep paths explicit in production configs.

docs/daemon-management.md

@@ -79,6 +79,7 @@ from transport-interface readiness.
 ## Safety requirements
 
 - Show every config write before applying it.
+- Generate snippets into the plan root before any install or reload step.
 - Back up any adopted-daemon snippet AMPG touches.
 - Never delete hidden-service keys, I2P keys, or Reticulum identities without an explicit
   destructive command.

docs/generated/config-schema.md

@@ -12,9 +12,12 @@ This file is generated from code. Do not edit it by hand.
 | site.source | `path` | path | yes | - | Source tree path. |
 | site.source | `canonical_url` | url | no | - | Canonical clearnet URL. |
 | site.outputs | `root` | path | yes | - | Generated output root. |
+| site.outputs | `plan_root` | path | no | ../dist/ampg-plan | Generated plan artifact root. |
 | site.interactions | `default_tier` | enum | no | static | Default interaction tier for routes. |
 | site.interactions | `deny_routes` | array<string> | no | [] | Route patterns that must not be published. |
 | site.protocols.<name> | `enabled` | boolean | no | false | Whether this protocol target is built and planned. |
 | site.protocols.<name> | `renderer` | enum | no | <protocol> | Renderer profile to use for this protocol. |
 | site.protocols.<name> | `daemon` | enum | no | protocol default | Ingress daemon adapter. |
 | site.protocols.<name> | `daemon_policy` | enum | no | protocol default | Whether AMPG adopts, manages, or only renders config. |
+| site.protocols.<name> | `max_asset_bytes` | integer | no | 1048576 | Maximum asset size copied by privacy-html render targets. |
+| site.protocols.<name> | `script_policy` | enum | no | strip | Script handling policy for privacy-html render targets. |

docs/wownero-integration.md

@@ -107,7 +107,7 @@ enabled = true
 daemon_policy = "auto"
 
 [site.protocols.i2p]
-enabled = false
+enabled = true
 daemon_policy = "auto"
 
 [site.protocols.gemini]
@@ -133,6 +133,8 @@ daemon_policy = "auto"
 ```sh
 python3 -m ampg --config examples/wownero.gateway.toml plan
 python3 -m ampg --config examples/wownero.gateway.toml build
+python3 -m ampg --config examples/i2p-only.gateway.toml plan
+python3 -m ampg --config examples/i2p-only.gateway.toml build
 ```
 
 ## Reusable checklist