Put the executive summary on page 2, before the table of contents.

The cover stays page 1. Numbered chapters now start at What Verae
provides. The TOC lists Executive summary at page 2.

source/conf.py

@@ -9,7 +9,7 @@ version = "2.0"
 
 extensions = []
 templates_path = ["_templates"]
-exclude_patterns = ["verification.rst"]
+exclude_patterns = ["verification.rst", "executive.rst"]
 
 html_theme = "alabaster"
 html_static_path = ["_static"]
@@ -134,8 +134,6 @@ app.verae.com\par}
 \end{titlepage}
 \clearpage
 """,
-    "tableofcontents": r"""
-\tableofcontents
-\clearpage
-""",
+    # TOC is emitted from index.rst *after* the page-2 executive summary.
+    "tableofcontents": "",
 }

source/index.rst

@@ -8,20 +8,61 @@ Making yourself audit-ready with Verae DataCubes
       :alt: Verae
       :class: logo
 
-This volume is a technical briefing. It is **not** a certificate.
+.. raw:: latex
 
-The table of contents below is the document map. In the PDF edition,
-each chapter starts on a new page and the contents list includes
-**section titles with page numbers**. In HTML, each chapter is its own
-page with the Verae wordmark in the sidebar and Verae Inc contact
-information in the footer.
+   \thispagestyle{plain}
+   \vspace*{0.15cm}
+   {\LARGE\bfseries\color{veraepurple}Executive summary\par}
+   \vspace{0.85em}
+   \addcontentsline{toc}{chapter}{Executive summary}
+
+Software alone does not make an organization HIPAA certified, SOC 2
+attested, or ISO 27001 certified.
+
+That sentence is the point of this document. It is also the sentence
+that is most often skipped when a vendor, an integrator, or an internal
+champion shows encryption, hashing, or a pentest PDF and treats the
+conversation as finished. It is not finished. Encryption is a control.
+A pentest is an evaluation of a component. A certificate, an attestation,
+or a covered-entity determination is a statement about **an organization**
+--- its legal entity, its people, its written policies, its operating
+procedures, its internal controls, the evidence those controls produce,
+and the independent party that examined that evidence.
+
+The Verae DataCube Solution gives an organization tools to **store**,
+**communicate**, **timestamp**, **verify**, and **audit** for compliance.
+Those tools are real, they are specific, and they are described in the
+chapters that follow. They are still only tools. To obtain HIPAA-aligned
+status as a covered entity or business associate with a defensible
+program, a SOC 2 Type I or Type II report, or an ISO 27001 certificate,
+the organization must still:
+
+* write and live by **policies** (what the organization says it will do);
+* operate **procedures** (how staff actually do it, every day);
+* design and test **internal controls** (the checks that catch failure);
+* retain **evidence** (logs, tickets, screenshots, signed approvals,
+  restore tests, training records);
+* engage an **independent auditor**, CPA firm, or ISO registrar, as the
+  chosen program requires.
+
+Verae cannot issue those certificates. Verae cannot sit in the
+organization's chair during an OCR investigation, a SOC 2 fieldwork
+week, or an ISO Stage 2 audit. What Verae can do --- and what this
+briefing is written to make precise --- is provide the **tools**, the
+**background**, and the **software infrastructure** that make it easier
+to implement the **technical portion** of those programs.
+
+.. raw:: latex
+
+   \clearpage
+   \tableofcontents
+   \clearpage
 
 .. toctree::
    :maxdepth: 2
    :numbered:
    :caption: Contents
 
-   executive
    what-verae-provides
    datacube-server
    data-in-transit