[JacobStephens2]

Summary

All headed content on the Prompts and skills page starts folded closed. Click a heading to open or close it; native keyboard controls work without JavaScript. Fragment links reveal their target and its containing sections.

Prompts and skills
├── Command line ▸
├── Prompts ▸
│   └── Prompt ▸ → session text
├── Factory skills ▸
│   └── Skill ▸
│       └── Supporting file ▸ → raw text
└── Licence and credits ▸

The generated fragment is regenerated from src/prompts_page.rs. Browser tests run in CI.

Closes #683

Evidence

• Before: npm test --prefix site failed with command-title must control a closed section.
  After: all three browser tests pass: every h2/h3/h4 toggles independently, fragment links reveal nested content, and mobile keyboard controls work with JavaScript disabled.
• Before: node --test --test-name-pattern='fragment links' site/tests/prompts.test.cjs failed because the linked Resume text was hidden.
  After: the same command passes, including a repeated link to a manually closed supporting file.
• cargo test --bin thirdshift prompts_page: 10 passed. cargo check --all-targets, cargo fmt --check, and cargo clippy --all-targets -- -D warnings pass.
• cargo test: full Rust suite passed.
• Mobile screenshots checked at 390px; no horizontal overflow.

Test seams: the served /prompts/ page's heading disclosures, browser fragment navigation, and keyboard interaction without JavaScript; the existing generated-page golden test.

Merge Danger

Door: two-way

Static markup, CSS and JavaScript can be reverted; no stored data changes.

Blast Radius: Site

Shared site assets gain disclosure styles and fragment handling. CI gains a Chromium browser-test job.

Unaddressed findings

Standards

None. The sole finding, S1 (P3, duplicated browser-test lifecycle), is addressed by pageForTest and its test-context cleanup. All three tests pass after the refactor.

Spec

None; the independent review found no missing requirements, scope creep or wrong implementation.

Both axes read all 10 changed files. Changed files left unread: none.

Security

None. Guidance-mode review of 69fde3bb5b3ed9c2bd7c2132c3cfadda5173192a...HEAD found no introduced security findings requiring a fix. Reviewed all 10 changed files and supporting generator escaping, shared JavaScript, local test-server routing, and site deployment code against the client-side, HTTP, and supply-chain attack-class guidance. No repository SECURITY.md or threat-model file was present.

Validation ran locally with external networking disabled, read-only inputs, an empty allowlisted environment, scratch-only storage, and enforced resource limits: all 3 browser tests and all 10 existing Rust prompts_page tests passed. No source fixes were needed.

Built with codex · gpt-6.1-sol · high

Security review outcome

No unaddressed introduced findings.

CI notes

• site-test: flaky visibility assertion at site/tests/prompts.test.cjs:87 races the queued hashchange handler; reproduced locally with the content becoming visible without another click, while all three tests pass locally on CI's Node 24.21.0 (the unchanged CI rerun hit the same race); code and tests left unchanged.