Add the Loom of Ideas product page for VOLPAROSSA Code

.github/workflows/code-website.yml

@@ -0,0 +1,89 @@
+name: Code website
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'website/**'
+      - '.github/workflows/code-website.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'website/**'
+      - '.github/workflows/code-website.yml'
+  workflow_dispatch:
+
+# Publication is manual, on main only, after a separate reviewed release decision.
+# Preview code never receives deployment credentials or an OIDC token.
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    name: Validate static Code website
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Check out the event's exact source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Build a noindex preview without Code runtime execution
+        run: python3 website/scripts/build_site.py --output website/preview/volparossa-code
+      - name: Check semantics, project paths, assets and content boundaries
+        run: python3 website/scripts/check_site.py --output website/preview/volparossa-code
+      - name: Preserve reviewable preview
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: code-website-preview
+          path: website/preview/
+          include-hidden-files: true
+          if-no-files-found: error
+          retention-days: 7
+
+  build:
+    name: Prepare production Pages artifact
+    needs: validate
+    if: github.repository == 'VOLPAROSSA/volparossa-code' && github.ref == 'refs/heads/main' && github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Check out the validated source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Build only the project website
+        run: python3 website/scripts/build_site.py --production --output website/dist/volparossa-code
+      - name: Check production artifact
+        run: python3 website/scripts/check_site.py --production --output website/dist/volparossa-code
+      - name: Upload only the generated site's root
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: website/dist/volparossa-code
+          include-hidden-files: true
+
+  deploy:
+    name: Publish Code project site
+    needs: [validate, build]
+    if: github.repository == 'VOLPAROSSA/volparossa-code' && github.ref == 'refs/heads/main' && github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      pages: write
+      id-token: write
+    concurrency:
+      group: code-github-pages
+      cancel-in-progress: false
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      # Pages must already be configured for GitHub Actions by a repository admin.
+      # No automatic enablement, domain change or source-tree checkout here.
+      - name: Verify the existing Pages configuration
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+        with:
+          enablement: false
+      - name: Deploy the checked static artifact
+        id: deployment
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

website/.gitattributes

@@ -0,0 +1,3 @@
+# Preserve exact upstream source bytes and their original notices.
+vendor/** -text whitespace=-blank-at-eol,-blank-at-eof,-cr-at-eol
+assets/icons/lucide/** -text whitespace=-blank-at-eol,-blank-at-eof,-cr-at-eol

website/.gitignore

@@ -0,0 +1,6 @@
+preview/
+dist/
+qa/
+node_modules/
+__pycache__/
+scripts/__pycache__/

website/README.md

@@ -0,0 +1,88 @@
+# VOLPAROSSA Code — The Loom of Ideas
+
+Static English product page for `/volparossa-code/`. The selected walnut/brass
+loom, golden threads and burgundy fox tapestry are implemented as separate
+responsive scenes around semantic HTML. No Code runtime, model, account or
+network participation is started by this website.
+
+## Build and preview
+
+Python 3 is the only build dependency. All theme files and visitor assets are
+local and pinned; the build works offline.
+
+```sh
+python3 website/scripts/build_site.py
+python3 website/scripts/check_site.py
+python3 -m http.server 8775 --bind 127.0.0.1 --directory website/preview
+```
+
+Open **http://127.0.0.1:8775/volparossa-code/**. The preview uses `noindex,nofollow`.
+The workflow's `code-website-preview` artifact contains the same project route;
+unzip it and serve its parent directory using the command above.
+
+The explicit production build is separate from publication:
+
+```sh
+python3 website/scripts/build_site.py --production --output website/dist/volparossa-code
+python3 website/scripts/check_site.py --production --output website/dist/volparossa-code
+```
+
+Use matching `--origin` and `--base-path` arguments on both commands to check an
+alternative host, such as `--origin https://volparossa.github.io`. Local resources
+remain relative to the repository project route. No CNAME or root robots policy
+is copied. The production sitemap contains only the real product route.
+
+## Maintenance
+
+- `src/index.html`, `src/content.json`: page structure, copy, metadata and links.
+- `assets/code.css`: Code-only composition, beside the unmodified shared styles.
+- `vendor/volparossa-theme/`: exact source-only theme export, its renderer,
+  original marks, fonts, notices and hash manifest. Do not edit it locally.
+- `masters/`: clean generated scene masters and exact prompts, excluded from output.
+- `scripts/export_images.py`: maintainer-only crops and AVIF/WebP/JPEG exports;
+  requires Pillow 12.3.0. `--inventory-only` refreshes hashes after an asset change.
+- `asset-manifest.json`: dimensions, crop boxes, file sizes and SHA-256 inventory.
+- `docs/`: [content sources](docs/CONTENT-SOURCES.md), [assets](docs/ASSETS.md)
+  and [verification](docs/VERIFICATION.md). `review/` contains review evidence,
+  never visitor assets.
+
+The existing `/docs/#applications` portal is the verified Code entrance. No
+second documentation portal or central publication flag is added.
+
+## Optional browser QA
+
+The website's separate package and lockfile pin Playwright, axe and Lighthouse.
+They do not change the application's package or ship to visitors.
+
+```sh
+cd website
+npm ci
+# With locally available browsers; otherwise provision Playwright browsers.
+CHROME_PATH=/usr/bin/chromium npm run qa
+```
+
+`SITE_QA_URL` overrides the preview URL. The script checks Chromium and Firefox,
+responsive layout, local assets, initial/full-page transfer, keyboard navigation,
+native details, no JS, reduced motion, text enlargement and narrow reflow.
+
+## Publication after review
+
+This implementation prepares a preview and PR; it does not merge or deploy.
+On 31 October 2026 the read-only Pages API reported `build_type=workflow`,
+`cname=null` and `html_url=https://volparossa.org/volparossa-code/`.
+This is configuration evidence, not a successful site deployment.
+
+After the owner approves publication:
+
+1. Merge the reviewed PR after required checks pass.
+2. Run **Code website** manually on `main`. The workflow validates the preview,
+   builds and checks production, uploads only `website/dist/volparossa-code/`,
+   then publishes with the existing GitHub Pages configuration.
+3. Verify the live HTML, asset bytes, canonical, links and actual mobile/desktop
+   rendering at the intended URL.
+4. Only after that live verification, make a separate homepage PR to set Code's
+   `published` flag to true. The product stays **In development**.
+
+PR and ordinary push jobs only build/check. Deployment is restricted to a manual
+event on `main`, with Pages/OIDC rights scoped to the deployment job. No settings,
+DNS, CNAME or root-site changes are part of this PR.