Simplify WizardLoop into an illustrated static portfolio

.env.example

@@ -1,8 +1,3 @@
-# Public configuration only. Never prefix secrets with PUBLIC_.
-# Leave blank until the separate feedback Worker is configured and approved.
-PUBLIC_FEEDBACK_API_URL=
-PUBLIC_TURNSTILE_SITE_KEY=
-# Local development automatically uses a clearly labeled loopback mock.
-# Set true only for a non-indexable build used for review.
+# Optional local preview setting. The static site needs no credentials.
+# Set true only for a review build that must not be indexed.
 PUBLIC_PREVIEW=false
-# Telegram/Cloudflare credentials belong to their separate services, never here.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,11 +1,13 @@
 ## What changes for visitors
 
-Describe the visible behavior and the reason for it. Link representative desktop/mobile screenshots when the interface changes.
+Describe the concrete behavior and reason for it. Include desktop/mobile screenshots for visual changes.
 
 ## Validation
 
-List commands actually run, measured results, and remaining limitations. Distinguish fixtures from authenticated service tests.
+List checks actually run, measured results and remaining limitations. Do not present older QA results as verification of this revision.
 
-## Deployment and privacy
+## Publication
 
-State whether credentials, content synchronization, third-party requests, public URLs or hosting settings are affected. Keep secrets and personal feedback out of this description. Merging or deploying requires the owner's explicit approval.
+Merging into `main` triggers the GitHub Pages workflow. Confirm that the change is ready for the owner to publish, preserves `wizardloop.com` and existing URLs, and includes any relevant rollback notes. A pull request does not itself merge or deploy the change.
+
+State any changes to external links, visitor data handling or hosting settings. Keep credentials and personal messages out of this description.

.github/workflows/ci.yml

@@ -8,10 +8,11 @@ on:
 permissions:
   contents: read
 env:
-  ASTRO_TELEMETRY_DISABLED: 1
+  ASTRO_TELEMETRY_DISABLED: '1'
 jobs:
   check:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -28,13 +29,3 @@ jobs:
           name: browser-quality-results
           path: artifacts/final/
           retention-days: 7
-  profile-sync-tests:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.13'
-      - run: python -m pip install -r services/profile-sync/requirements.txt
-      - run: python -m unittest discover -s services/profile-sync -p "test_*.py" -v
-      - run: python -m unittest discover -s services/posts-sync -p "test_*.py" -v

.github/workflows/deploy.yml

@@ -1,22 +1,22 @@
-name: Approved Pages deployment
+name: Deploy to GitHub Pages
 on:
+  push:
+    branches:
+      - main
   workflow_dispatch:
-    inputs:
-      approval:
-        description: 'Type DEPLOY_WIZARDLOOP only after explicit owner approval'
-        required: true
-        type: string
 permissions:
   contents: read
 concurrency:
   group: pages-production
   cancel-in-progress: false
 env:
-  ASTRO_TELEMETRY_DISABLED: 1
+  ASTRO_TELEMETRY_DISABLED: '1'
+  PUBLIC_PREVIEW: 'false'
 jobs:
   build:
-    if: github.ref == 'refs/heads/main' && inputs.approval == 'DEPLOY_WIZARDLOOP'
+    if: github.repository == 'WizardLoop/wizardloop.github.io' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
@@ -25,22 +25,28 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run check
-        env:
-          PUBLIC_FEEDBACK_API_URL: ${{ vars.PUBLIC_FEEDBACK_API_URL }}
-          PUBLIC_TURNSTILE_SITE_KEY: ${{ vars.PUBLIC_TURNSTILE_SITE_KEY }}
+      - run: npx playwright install --with-deps chromium firefox webkit
+      - run: npm run test:browsers
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: production-quality-results
+          path: artifacts/final/
+          retention-days: 7
       - uses: actions/upload-pages-artifact@v3
         with:
           path: dist
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       pages: write
       id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - name: Deploy approved static artifact
+      - name: Deploy validated static artifact
         id: deployment
         uses: actions/deploy-pages@v4

CHANGELOG.md

@@ -1,32 +1,32 @@
 # Changelog
 
-This file records repository changes. A heading does not mean a Git tag, GitHub Release or production deployment exists.
+These headings record source changes. They do not establish that a Git tag, GitHub Release or production deployment exists.
 
-## 1.0.0-rc.1 - Unreleased
+## 1.0.0-rc.2 - Unreleased
 
-### Website
+- Simplify the site to static GitHub Pages with manually maintained profile content and local media.
+- Replace the feedback form with verified direct contact links while preserving `/feedback/`.
+- Add an accessible email-copy action, persistent mobile-menu close control and visible current-page navigation.
+- Refine the illustrated destination pages around original ink, paper, star and infinity artwork; keep the creator's existing wizard identity and motion.
+- Preload the local body font to reduce initial text-layout work; record fresh Lighthouse measurements and broader three-engine responsive coverage.
+- Direct Work and Posts visitors to the original Telegram channel and Projects visitors to all GitHub repositories; retain the existing page URLs.
+- Remove automatic profile/post services, the feedback backend, CAPTCHA setup, related fixtures and obsolete operational instructions.
+- Remove embedded-feed loading and explain the current external-link behavior in privacy, security and accessibility information.
+- Publish validated `dist/` output on pushes to `main`, with a manual retry option. Require lint, typecheck, build and browser checks before deployment; keep deployment permissions in the deploy job.
+- Document the one-time GitHub Actions publishing-source setting, direct content editing, verification and rollback. No DNS change or additional service credentials are required.
 
-- Rebuild the personal portfolio with Astro static output and the selected Spectrum Circuit direction, developed with comic framing and the owner's wizard illustrations.
-- Add Home, About, Selected Work, Projects, Posts, Community, Feedback, Privacy, Cookies, Security, Accessibility and a custom 404 page.
-- Add responsive navigation, light and dark themes, persistent preferences, keyboard controls, motion pause and reduced-motion behavior.
-- Return the hero to a still preview when a native decoder stops unexpectedly, while preserving intentional user and visibility pauses.
-- Detect a frozen native-video clock even when the decoder still reports playback, and avoid false failures after delayed timer callbacks.
-- Include 30 original wizard animations and six flag samples, unchanged source TGS files, transparent posters and provenance manifests.
-- Add page-specific metadata, structured data, static social artwork, favicons, sitemap output and domain-preserving builds.
+Current validation and known limits are recorded in [QA.md](docs/QA.md). This candidate does not claim completed legal conformance, human screen-reader review or a verified production release.
 
-### Services and tooling
+## 1.0.0-rc.1 - Earlier review candidate
 
-- Add an isolated profile synchronization service with active-photo identity matching, video/still selection, cache, fallback and offline fixtures.
-- Add consent-gated Telegram posts and a separately configured supported-update ingestion path. Original Telegram links remain available when embedded media is incomplete.
-- Add a feedback Worker and local mock, server validation, Turnstile verification, private-chat setup and provider-mocked tests.
-- Add source/build checks, browser coverage, accessibility checks, quality CI and an approval-gated manual Pages workflow.
-- Correct the canvas media fixture, measure native loop capability independently from application code, and record actual encoded AVC metadata.
-- Document setup, content editing, service limitations, asset rights, contribution, security reporting and release/rollback procedures.
+- Rebuilt the personal site with Astro and the selected Spectrum Circuit direction, comic framing and the owner's wizard illustrations.
+- Added responsive pages, themes, navigation, motion preferences, semantic metadata, static social artwork and domain-preserving builds.
+- Included 30 original wizard animations, six flag samples, retained TGS sources, transparent posters and provenance manifests.
+- Added native hero video and static fallbacks for decoders that stop or freeze, plus browser, accessibility and performance checks.
+- Prototyped private profile/post synchronization and a feedback backend. Those components were removed in `1.0.0-rc.2` after the owner chose a simpler static scope. Their earlier code and review evidence remain in Git history.
 
-### Review status
-
-This is an unreleased review candidate. Measured browser, accessibility, performance and offline-service results are documented in [the quality review](docs/QA.md). Authenticated Telegram/profile media tests, live feedback delivery, native Safari and human screen-reader review, production validation, merge approval and release approval remain separate steps. Complete legal/accessibility conformance is not asserted.
+The earlier service tests are historical evidence, not verification of a current live service. No release is implied by this entry.
 
 ## Earlier baseline
 
-The original four-file website remains in Git history at `658ed667c173f861cd16e6048126de12ec3648b9` from 2025-07-20. The initial audit found no Git tags or GitHub Releases. Do not assign a historical semantic version retrospectively. Phase 1 tooling used `0.1.0-preview.1` while three local concepts were evaluated; it was not a production release.
+The original four-file website remains in Git history at `658ed667c173f861cd16e6048126de12ec3648b9`, dated 2025-07-20. The initial audit found no tags or GitHub Releases; recheck before creating any release. Do not assign a historical semantic version retrospectively. Phase 1 tooling used `0.1.0-preview.1` for the three local concepts, not a production release.

CONTRIBUTING.md

@@ -1,36 +1,33 @@
 # Contributing to WizardLoop
 
-This repository is the source of one creator's personal website. Contributions should improve that website while preserving the owner's identity, verified content and control over publication.
+This repository is one creator's personal website. Contributions should preserve the owner's identity, verified content and control over publication. Open focused pull requests for corrections, and discuss major visual changes or dependencies first. Report vulnerabilities privately through [SECURITY.md](SECURITY.md).
 
-For a small correction, open a focused pull request. Discuss substantial visual changes, new services or dependencies in an issue first. Never disclose credentials, personal submissions or a vulnerability in a public issue or pull request; use [SECURITY.md](SECURITY.md).
+## Local work
 
-## Working locally
+1. Read [README.md](README.md) and [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+2. Use a dedicated branch or fork. Do not work directly on `main` or modify another repository as part of this project.
+3. Install Node 22.23.4 or newer, run `npm ci`, then `npm run dev`.
+4. Edit content, styles and browser interactions in their documented locations. No service credentials or mock server are needed.
 
-1. Read the [README](README.md), relevant service guide and [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
-2. Use a dedicated branch or fork. Do not work directly on `main` or alter another repository as part of this project.
-3. Install locked dependencies with `npm ci` using Node 22.23.4 or newer.
-4. Run `npm run dev`. The frontend and optional `npm run dev:feedback` mock require no live credentials.
-5. Make the smallest coherent change. Keep content, styles, browser interactions and private integrations in their existing locations.
+Preserve `wizardloop.com`, both source CNAME files and existing public routes. Hosting or domain changes require a specific owner-reviewed proposal. Keep the site static unless the owner explicitly requests a different architecture.
 
-Do not change `wizardloop.com`, either CNAME file, production settings or deployment behavior as incidental cleanup. Such changes need a specific proposal and owner approval.
+## Content and interface
 
-## Content, design and accessibility
+- Use English by default and correct direction handling for Hebrew.
+- Verify claims and links. Do not invent clients, achievements or profiles.
+- Use a regular hyphen instead of U+2014 in controlled content and metadata.
+- Preserve keyboard access, visible focus, semantic headings, contrast and narrow-screen layouts. Honor reduced motion and the global motion control.
+- Keep useful content when JavaScript fails. Do not load external scripts or media merely to display a link to another service.
+- Record asset provenance and licensing. MIT code contributions do not relicense the owner's branding or artwork.
 
-- Use English by default and preserve correct direction handling for Hebrew content.
-- Verify project links and factual claims. Do not invent clients, achievements, personal details or social profiles.
-- Use a regular hyphen instead of the em dash character U+2014 in controlled content, metadata and documentation.
-- Keep keyboard access, visible focus, semantic headings, readable contrast and small-screen layouts. Honor reduced motion and the global motion control.
-- Keep useful static content when JavaScript or a third party fails. Avoid heavy dependencies for effects that local CSS or existing components can provide.
-- Preserve media attribution. MIT code contributions do not relicense the owner's artwork or third-party assets. Record the source and license of any new font, icon, media or dependency.
+## Validation and review
 
-## Validation and pull requests
+Run `npm run check`. For layout or interaction changes, run relevant browser tests against the built site; use `npm run test:browsers` for browser behavior changes. Do not add redundant tests for a simple text correction; existing content/build checks still apply.
 
-Run `npm run check`. For layout or interaction changes, build the site and run relevant Playwright checks, including `npm run test:browsers` when browser behavior changes. Follow service-specific tests for profile, posts or feedback changes. Do not write redundant tests for a simple text correction; existing content/build checks still apply.
+Describe the concrete change, validation actually performed and remaining limits. Include desktop/mobile screenshots and both themes for visual changes. Do not treat older QA reports as verification of the new revision.
 
-A useful pull request describes the concrete problem, resulting behavior, validation and remaining limits. Include desktop/mobile screenshots for visual changes and both themes where relevant. Identify mocks and fixtures explicitly. Do not report an external integration as verified unless it was exercised with authorized credentials.
+Keep lockfile updates with dependency changes. Exclude installed packages, build output, test artifacts, `.env` files, credentials and personal messages. Review the diff before submitting.
 
-Keep lockfile changes with dependency changes. Do not commit `node_modules`, build output, test artifacts, `.env`, `.dev.vars`, sessions, private chat IDs, submitted messages or tokens. Check the diff for accidentally included local files before submitting.
+**An owner-approved merge into `main` triggers publication after checks pass.** Creating a pull request does not authorize someone else to merge it. Confirm publication readiness before merging and follow [DEPLOYMENT.md](docs/DEPLOYMENT.md). Tags, releases and DNS changes remain separate owner decisions.
 
-Owner review governs design and content acceptance. A pull request does not authorize merging, deploying, enabling services, creating releases or changing DNS. Follow [DEPLOYMENT.md](docs/DEPLOYMENT.md) for those separate operations.
-
-By submitting new source code, you offer it under the repository's MIT license. Only submit material you have the right to contribute, and identify any different asset license. Participation is subject to the [Code of Conduct](CODE_OF_CONDUCT.md).
+New source contributions are offered under the repository's MIT license. Submit only material you may contribute and identify any different asset license. Participation follows [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md).