Website maintenance and privacy boundaries

The public entry points have different deployment sources:

The landing design and copy have one editable source: docs/home_template.html, docs/site.css and docs/site.js. Preserve the footer dedication and the release notice and keep it current: the 12.x line reached end of life on 16 October 2026, v13 is in prerelease until 13.0.0, and v5 is end of life. The install command must pin the current cargo-rullst version; the validator checks it. Use actual source and release evidence for claims; do not hardcode aspirational coverage, scorecard, speed or certification values.

Validate before deployment

From the framework checkout, using Node 24 and a locally installed Chromium (google-chrome, or set CHROME_BIN):

mdbook build docs
python3 .github/validate-site.py
python3 .github/test-llms-txt.py
node --check docs/site.js
node .github/site-browser-smoke.mjs

The Pages build also writes llms.txt (an index of every book page in SUMMARY.md order) and llms-full.txt (their Markdown, with mdBook include directives expanded; pages over 64 KiB other than the spec and the CLI reference are listed under ## Optional) to the site root with .github/generate-llms-txt.py. They are generated on every deployment and never edited by hand; preview them with python3 .github/generate-llms-txt.py --out <directory>. validate-site.py generates both files and fails when either is missing a SUMMARY.md page or exceeds its size bound (128 KiB and 8 MiB).

The browser test checks desktop and 390/320-pixel layouts, keyboard and mobile navigation, clipboard success/denial, privacy disclosure, reduced motion, no-JavaScript navigation, resource failures, CSP errors, external requests and browser storage. It is not a complete accessibility audit or cross-browser certification. Optional --screenshots /absolute/output/directory records viewport previews without adding binary artifacts to the repository.

Keep cached assets in sync with the page

The landing references CSS and JavaScript with a content version, such as ./assets/site.css?v=<first-16-hex-digits-of-SHA-256>. After editing either asset, compute its SHA-256 and update its reference in home_template.html. The validator and organization exporter reject stale versions. This is cache invalidation, not an artifact-signing or browser integrity guarantee.

The browser regression check first stores an old unversioned stylesheet and script in a real four-hour browser cache, confirms they are reused, then loads the new landing and checks the three illustrated module cards’ actual styles. The organization privacy page shares the versioned stylesheet. Keep query parameters in any CDN cache key; an intermediary configured to ignore them requires a cache-policy change or content-hashed asset filenames instead. Previously cached HTML can still show the previous design until refreshed.

The source landing has no analytics, social embeds, remote fonts, cookies or local/session storage. CSS and JavaScript are local; ambient, hero, workflow and scroll-reveal motion is finite, progressively enhanced and disabled by the reduced-motion preference. Content stays visible when JavaScript is unavailable. Clipboard access follows an explicit button click and copies only the displayed command.

Hosting still processes requests. The privacy notice links GitHub’s statement and does not promise control of its logs or retention. Benchmark dashboards load integrity-pinned Chart.js from jsDelivr; documentation can store display preferences and contain external content. Do not extend the landing’s narrower description to those surfaces or to user-built applications. New tracking, embeds, forms or storage require a fresh privacy review before deployment.

Keep the organization website synchronized

Preserve any work in the separate website checkout before running the exporter:

node .github/export-organization-site.mjs /path/to/clean/Rullst.github.io
node .github/site-browser-smoke.mjs --organization-site /path/to/Rullst.github.io

The exporter refuses a dirty tree or wrong repository. It replaces only the five known website files, derives privacy.html from the landing notice and does not commit, push or deploy. Review the diff and deploy matching framework documentation first, then the organization website. Keep independent commit and deployment receipts for each repository. A framework push alone does not update the organization’s root landing page.

The footer’s thirteen destination links are the owner’s supplied community list. Instagram, TikTok and YouTube handles are normalized to full profile URLs. These are normal links, not embedded feeds or a claim that account availability has been independently verified. Recheck ownership and links when the owner changes that list.