[JacobStephens2]

Summary

Add /how-it-works/, linked from the homepage, with a progressive engineer's guide and six responsive HTML/CSS diagrams. The page stays readable without JavaScript and follows the existing site's visual language.

Day shift → Issue URL → Worktree → Implement + review → Delivery → Review or merge
                                                       ↑ Repair loop
Then: Ticket Runs → Spec branch → Spec review → Spec PR
      Pickup / Architect / Security → Run or Spec run

Closes #88

Evidence

• Before: cd site && node --test --test-name-pattern='the homepage leads' tests/pages.test.cjs failed waiting for the missing homepage guide link.
  After: the same test passes and follows the homepage link through the seven ordered explanations.

• The diagram layout checks exposed header overflow at 320px, 390px and 768px; removing the guide header's inherited rotation fixed it. All seven guide checks now pass, including section navigation, Repair return links, prompt deep links and layouts at 320/390/768/1280px with JavaScript disabled.

• cd site && npm test: all 11 browser tests pass, including the existing Prompts and skills tests. Inspected desktop and mobile screenshots.

• cargo check, cargo fmt --check, and cargo clippy --all-targets -- -D warnings: pass.

• cargo test: the full Rust unit and integration suite passes (two ignored unit tests).

• Independent verification of published 22aa70b: all 11 browser tests passed, as did cargo check and cargo fmt --check. All 900 Rust integration tests passed across 48 suites on byte-identical Rust source and fixtures. The independent unit run had 1042 passes, 2 ignored and one failure in session::execution_tests::partial_stdout_is_reported_after_log_failure_with_a_blocked_prompt (prompt-write BrokenPipe instead of the expected log-write BrokenPipe); its exact rerun passed: cargo test --bin thirdshift session::execution_tests::partial_stdout_is_reported_after_log_failure_with_a_blocked_prompt -- --exact --nocapture.

Test seams

• The served site in Chromium: navigation from the homepage, the guide's ordered explanations and diagrams, section links, and readable layouts with JavaScript disabled on desktop and mobile.

Review coverage

Independent Standards and Spec reviews use git diff main...HEAD with main at d5694638afb600360ddde6091d2089d2edbb655c. Each reviewed all four changed files, including the renamed browser test file. No generated-output exclusions. Unread changed files: none on either axis.

Unaddressed findings

Standards

None.

Spec

None.

Security

None. Guidance-mode security review of HEAD 22aa70b against pinned merge base d5694638afb600360ddde6091d2089d2edbb655c covered all four changed files, shared styles and JavaScript, browser-test server and runner, CI, and static deployment configuration. Applied the relevant injection, client-side rendering/navigation, resource/file handling, secrets, and supply-chain guidance alongside the unattended-session trust model in README and ADR-0013. The guide contains fixed HTML/CSS and fixed links, with no scripts, forms, or user-controlled rendering; the homepage additions are fixed links. The test routing change retains the existing loopback listener, and deployment serves static files. No introduced security finding or candidate required a proof-of-concept test. No target code or tests were executed, and no source changes were made during this review.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

Static documentation and browser tests; revert to remove the guide. No runtime or data changes.

Blast Radius: site

Adds a page and two homepage links. Diagram styles load only on the guide; the shared browser test runner continues to exercise the Prompts and skills page.

Built with codex · gpt-6.1-sol · high