Publication operations

Version and toolchain

The site uses one current version until the first compatible public release. Node 24, npm’s committed lockfile, Astro, and Starlight are exact repository inputs. Repeatable jobs use npm ci; dependency upgrades are reviewed changes.

Dependency audit

The production dependency audit is clean. just docs-check runs npm audit --omit=dev --audit-level=high directly, so any new high or critical production advisory fails the documentation gate. The retired Docusaurus exception is retained only as historical context in ADR-0013; it does not alter the current gate.

Search privacy and cost

Starlight builds a local Pagefind full-text index into the static Pages artifact. It needs no third-party crawler, hosted search credential, or visitor-query service. If a future hosted search provider is proposed, its data flow and privacy consequences require a separate decision.

Accessibility

The authoring baseline uses semantic headings, keyboard-operable Starlight navigation, visible focus behavior, responsive layouts, contrast-aware themes, and reduced layout complexity. #34 owns full browser accessibility smoke proof before publication; the production build alone is not that proof.

Permissions and rollback

The Pages workflow has least-privilege read access while building. Only its deployment job receives pages: write and id-token: write, and it targets the protected github-pages environment. Every docs-affecting push to main uploads and deploys the immutable artifact; a manually dispatched run also deploys only when it targets main. The Pages source is GitHub Actions and the project-site deployment has been verified publicly. Accessibility, search, navigation, and rollback verification remain part of the release checklist. Main CI cannot deploy.

GitHub retains deployments and their immutable source revisions. A rollback is a reviewed revert or an explicit redeployment of a previously verified revision through the same workflow—never a workstation upload or direct mutation of a gh-pages branch. An administrator must select GitHub Actions as the Pages source; that one-time setting is visible external state, not startup automation.