feat: live timer since rebuild

.agents/rules/blog-system.md

@@ -65,6 +65,7 @@
    excerpt: "Single paragraph summary"
    readingTime: "X MIN READ"
    draft: false
+   hidden: false # optional: true unlists post from public feeds/lists, accessible via direct link only
    ```
 2. **Obsidian Normalization:**
    - Wikilinks `[[slug]]` or `[[slug|Label]]` must be transformed into standard web URLs (`/posts/slug/`).
@@ -74,14 +75,17 @@
 ---
 
 ## 6. Test-Driven Development (TDD) & Adversarial Verification
-1. **Red-Green-Refactor Lifecycle:**
+1. **Strict Pre-Implementation Testing (Tests Before Functional Code):**
-   - Write tests in `test/*.test.js` using Node's native test runner (`node:test`, `node:assert/strict`).
+   - Test cases MUST ALWAYS be written in `test/*.test.js` before writing or modifying any functional code (filters, templates, server routes, ingestion pipeline, data loaders, scripts).
-   - Test inputs before implementing filters, data loaders, or template macros.
+   - Never implement or modify functional or production code prior to writing and establishing corresponding automated tests.
-2. **Adversarial Test Coverage Required:**
+2. **Mandatory Adversarial Test Coverage:**
-   - **Data & Configuration:** Test that missing required environment variables (e.g. `SITE_DOMAIN`) throw fatal errors.
+   - Standard behavior for any functional change MUST ALWAYS include adversarial testing specifically designed to stress assumptions and break the system:
-   - **Filters:** Test edge cases: empty strings, undefined values, single-word inputs, massive word counts, non-date objects.
+     - **Data & Configuration:** Test that missing required environment variables (e.g. `SITE_DOMAIN`) throw fatal errors.
-   - **Content Schemas:** Validate all Markdown files in `src/posts/` against frontmatter schemas.
+     - **Filters & Logic:** Test edge cases: empty strings, undefined/null values, unexpected types, single-word inputs, massive word counts, non-date objects.
-   - **Design Spec Compliance:** Automate regex/AST assertions on `src/assets/css/` ensuring zero violations of the "Do Not Use" list (`backdrop-filter`, `box-shadow`, `text-shadow`, gradients, floaty transitions).
+     - **Security & Integrity:** Test path traversals, malformed JSON, unauthorized tokens, malicious payloads.
-   - **Link & Anchor Integrity:** Verify that every compiled page has zero broken internal links and that all Table of Contents anchor links resolve to valid heading IDs.
+     - **Content Schemas:** Validate all Markdown files in `src/posts/` against frontmatter schemas.
-3. **Execution Invariant:**
+     - **Design Spec Compliance:** Automate regex/AST assertions on `src/assets/css/` ensuring zero violations of the "Do Not Use" list (`backdrop-filter`, `box-shadow`, `text-shadow`, gradients, floaty transitions).
-   - Always run `npm test` before committing. All tests must pass cleanly with 0 failures.
+     - **Link & Anchor Integrity:** Verify that every compiled page has zero broken internal links and that all Table of Contents anchor links resolve to valid heading IDs.
+3. **Pre-Presentation Verification Gate:**
+   - Before presenting the final output to the user, run `npm test`.
+   - All test cases must pass before presenting the final output. Presenting unverified output or code with failing tests is strictly prohibited.

.agents/skills/eleventy-tiling-blog/SKILL.md

@@ -98,9 +98,14 @@ When writing or modifying Eleventy files:
 ---
 
 ## 4. Validation & Verification
+ 
+Always follow the project TDD standard: write automated tests (including adversarial edge cases) in `test/` before modifying functional templates, filters, or configuration. Ensure all test cases pass before presenting the final output.
 
-Run these commands to test Eleventy builds:
+Run these commands to test and verify builds:
 ```bash
+# Run complete test suite (unit tests, filters, server, design rules, build integrity)
+npm test
+
 # Validate Eleventy configuration and build static output
 npx @11ty/eleventy --dryrun
 
@@ -110,3 +115,4 @@ npx @11ty/eleventy
 # Launch local dev server with auto-refresh
 npx @11ty/eleventy --serve
 ```
+

.agents/skills/obsidian-sync/SKILL.md

@@ -61,7 +61,8 @@ This skill guides the agent in implementing the custom Obsidian plugin and serve
 ## 3. Obsidian Markdown Normalization Rules
 
 1. **Frontmatter Invariants:**
-   - Must contain `title`, `date`, `tags` (array), and optional `excerpt`, `readingTime`, `draft`.
+   - Must contain `title`, `date`, `tags` (array), and optional `excerpt`, `readingTime`, `draft`, `hidden`.
+
 2. **Wikilinks Translation:**
    - `[[article-slug]]` $\rightarrow$ `[article-slug](/posts/article-slug/)`
    - `[[article-slug|Custom Label]]` $\rightarrow$ `[Custom Label](/posts/article-slug/)`
@@ -100,3 +101,13 @@ The Obsidian plugin runs inside Obsidian desktop/mobile and interacts with the O
 If using CouchDB-based self-hosted LiveSync:
 - A local watcher or CouchDB change listener daemon can be configured to detect updates to notes marked with `published: true` or in a dedicated `Blog/` folder.
 - When an update event fires, the daemon pulls the latest revision from the CouchDB database, runs the normalization pipeline, and saves it to `src/posts/`.
+
+---
+
+## 6. Validation & Verification
+
+Always write automated test cases in `test/ingestion-api.test.js` before modifying or adding any functional synchronization or endpoint code:
+- **Mandatory Adversarial Testing:** Include adversarial tests covering unauthorized tokens, invalid/missing frontmatter schemas, path traversals in slugs, and malformed base64 asset payloads.
+- **Pre-Presentation Verification:** Run `npm test` and ensure all test cases pass before presenting the final output.
+
+

.agents/skills/standards-verification/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: standards-verification
+description: >-
+  Use this skill sparingly when a new major function or feature has been implemented, when the user explicitly asks to verify standards, or as a debugging tool to analyze code issues. Targets only modified or relevant files via git status/diff and evaluates them against the project standards document.
+---
+
+# Standards Verification Skill
+
+This skill performs targeted architectural and stylistic compliance verification for new or modified code in this repository.
+
+> [!IMPORTANT]
+> **Invocation Policy:** Call this skill **sparingly and only when needed**.
+> **Valid Triggers:**
+> 1. A new major function or architectural feature has been implemented.
+> 2. The user asks to call it or requests standards verification.
+> 3. An error, test failure, or regression has occurred, and you are using this skill as a debugging tool to determine where the code diverges from project standards.
+
+
+---
+
+## 1. Targeted Inspection Scope (Not the Whole Codebase)
+
+Do **NOT** scan or audit the whole codebase unless specifically requested by the user or strictly necessary for whole-system refactors.
+
+Instead, narrow the scope to targeted sections using Git:
+
+1. **Check Modified Files:**
+   ```bash
+   git status -s
+   ```
+2. **Inspect Exact Changes:**
+   ```bash
+   git diff HEAD
+   ```
+   Or for staged changes:
+   ```bash
+   git diff --staged
+   ```
+3. **Identify Changed Sections:**
+   Focus only on the files, functions, templates, or styles touched in the current task.
+
+---
+
+## 2. Standards Evaluation Workflow
+
+To verify compliance, read the dedicated project standards document:
+- Authoritative document: [`.agents/standards.md`](file:///home/venus/code/blog/.agents/standards.md) (or local skill reference: [`references/standards.md`](file:///home/venus/code/blog/.agents/skills/standards-verification/references/standards.md)).
+
+Evaluate the targeted changes against the core standard pillars:
+
+1. **Design System & CSS Rules:**
+   - Are any anti-patterns present? Check for `backdrop-filter`, `box-shadow`, `text-shadow` (other than `none`), gradients, or transitions with delays/curves.
+   - Are border radii strictly bounded between `0px` and `4px`?
+   - Are colors utilizing CSS custom properties from `tokens.css`?
+   - Is styling modularized without inline `<style>` tags?
+
+2. **Templating & Eleventy Architecture:**
+   - Does post rendering adhere to layout inheritance (`base.njk` -> `post.njk`)?
+   - Are collections (`posts`, `tagList`) properly filtered using `isPostPublic`?
+   - If a post is marked `hidden`, does the layout emit `<meta name="robots" content="noindex, nofollow">`?
+
+3. **Content & Frontmatter Contracts:**
+   - Are required frontmatter keys (`title`, `date`, `tags`, `excerpt`) valid and conforming to schema length invariants?
+   - Are wikilinks and Obsidian attachments normalized?
+
+4. **Server & Security Invariants:**
+   - Does `server.js` preserve security headers (`X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, `Referrer-Policy: strict-origin-when-cross-origin`)?
+   - Is path traversal protection in place for all file-serving and API endpoints?
+
+5. **Test-Driven Development (TDD) Invariants:**
+   - Were automated test cases written *before* functional code was modified?
+   - Are adversarial test cases included (boundary inputs, nulls, invalid configs)?
+   - Do all tests pass (`npm test`)?
+
+---
+
+## 3. Stylistic & Architectural Reporting
+
+Compile a structured report highlighting:
+- **Conformant Highlights:** Key standards cleanly satisfied.
+- **Stylistic Issues & Deviations:** Any formatting inconsistencies, unneeded inline styles, or naming anomalies.
+- **Remediation Steps:** Concrete, minimal code adjustments to bring the implementation into full compliance.
+
+---
+
+## 4. Debugging with Standards Verification
+
+When using this skill as a debugging tool to troubleshoot broken builds, failed tests, or runtime bugs:
+
+1. **Locate the Error:** Inspect test failure outputs or server logs to isolate the failing component.
+2. **Correlate with Standards:** Compare the problematic implementation against [`.agents/standards.md`](file:///home/venus/code/blog/.agents/standards.md).
+3. **Explain the Discrepancy:** Specifically identify where the code is out of touch with project standards (e.g. missing input guards for `null`, collections bypassing `isPostPublic`, un-sanitized slug paths).
+4. **Suggest Root Cause & Fix:** Suggest why those issues cause an error and provide the targeted fix.
+

.agents/skills/standards-verification/references/standards.md

@@ -0,0 +1,59 @@
+# Technical Blog Project Standards & Architectural Specification
+
+This document is a direct reference for the `standards-verification` skill, mirroring the authoritative project standards defined in [`.agents/standards.md`](file:///home/venus/code/blog/.agents/standards.md).
+
+---
+
+## 1. User Content Sovereignty (Highest Priority)
+- User custom writing, post titles, tags, navigation labels, and naming choices strictly supersede any boilerplate, skill instructions, or sample mockups.
+- Never overwrite, sanitize away, or rename user-authored text without explicit instruction.
+- Inconsistencies or typos in user writing must be flagged for clarification rather than unilaterally changed.
+
+---
+
+## 2. Strict Test-Driven Development (TDD) & Adversarial Verification
+- **Test-First Invariant:** Automated test cases in `test/*.test.js` MUST ALWAYS be written and established *before writing or modifying any functional code* (filters, templates, server routes, ingestion logic, build scripts). Never write functional code before tests.
+- **Mandatory Adversarial Testing:** Standard behavior for every change must include adversarial tests specifically designed to falsify assumptions (missing env vars like `SITE_DOMAIN`, null/undefined/malformed inputs, boundary values, path traversals, design rule violations).
+- **Pre-Presentation Verification Gate:** Run `npm test` before presenting the final output to the user. All test cases must pass before presenting the final output. Delivering unverified or failing code is strictly forbidden.
+
+---
+
+## 3. Design System & CSS Specification
+- **Color Palette:** Canvas `#0d0f12`, Surface `#121417`, Elevated `#1c1f26`, Borders `#2b303b`, Text `#e0e6f0`, Accents `#00f0ff` (Cyan), `#00e676` (Green), `#ffb700` (Amber), `#ff5252` (Red).
+- **Hard Anti-Patterns:**
+  - NO glassmorphism (`backdrop-filter`).
+  - NO drop shadows or glows (`box-shadow`, `text-shadow`).
+  - NO linear or radial gradients.
+  - Border-radius capped at `0px` to `4px` maximum.
+  - Transitions must be instant binary snaps (`none` or `0s`).
+- **Typography:** `IBM Plex Mono` / `JetBrains Mono` for UI and code; `Inter` for body prose.
+- **CSS Modularity:** Zero inline `<style>` tags. Decompose into `tokens.css`, `reset.css`, `layout.css`, `components/*.css`.
+
+---
+
+## 4. Templating & Eleventy Architecture
+- **Layouts & Partials:** Root `layouts/base.njk`, `layouts/post.njk`, `layouts/page.njk`. Isolated partials in `_includes/partials/`.
+- **Collection Filtering:** `collections.posts` and `collections.tagList` must filter through `isPostPublic(post)` (excluding `draft: true` and `hidden: true`).
+- **Sorting:** Posts sorted via `postComparator` (pinned/featured first, then chronological descending).
+- **Hidden Posts:** When `hidden: true`, page compiles to direct link but is excluded from public lists and injects `<meta name="robots" content="noindex, nofollow">`.
+
+---
+
+## 5. Obsidian Content & Frontmatter Contract
+- Required frontmatter: `title` (>= 5 chars), `date` or `created` (ISO), `tags` (array), `excerpt` (>= 20 chars).
+- Optional: `readingTime`, `draft`, `hidden`, `pinned`, `featured`.
+- Obsidian conversions: Wikilinks `[[slug|Label]]` -> `[Label](/posts/slug/)`, attachments `![[image.png]]` -> `![image](/assets/images/posts/image.png)`.
+
+---
+
+## 6. Server & Security Invariants
+- `server.js`: Native Node HTTP, zero external runtime dependencies.
+- Security headers: `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, `Referrer-Policy: strict-origin-when-cross-origin`.
+- Path traversal defense: Sanitize and verify paths remain inside root.
+- Healthcheck: `/healthz` returns 200 OK JSON `{ status: "ok", uptime: ... }`.
+
+---
+
+## 7. Defensive Programming & Error Prevention
+- Guard against `null`, `undefined`, primitives in all utility functions.
+- Docker: `node:22-alpine`, non-root / clean entrypoint script as PID 1.

.agents/skills/standards-verification/scripts/verify.js

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { execSync } from "node:child_process";
+
+console.log("\n[Standards Verification] Running targeted inspection on modified files...\n");
+
+let statusOutput = "";
+try {
+  statusOutput = execSync("git status -s", { encoding: "utf-8" }).trim();
+} catch (err) {
+  console.error("Error executing git status:", err.message);
+  process.exit(1);
+}
+
+if (!statusOutput) {
+  console.log("✔ Working tree is clean. No changed files to inspect.");
+  process.exit(0);
+}
+
+const lines = statusOutput.split("\n");
+const modifiedFiles = lines
+  .map((line) => line.slice(3).trim())
+  .filter((f) => fs.existsSync(f) && fs.statSync(f).isFile());
+
+console.log(`Targeting ${modifiedFiles.length} modified file(s):`);
+modifiedFiles.forEach((f) => console.log(`  - ${f}`));
+console.log("");
+
+let issuesFound = 0;
+
+for (const file of modifiedFiles) {
+  const content = fs.readFileSync(file, "utf-8");
+
+  // 1. CSS anti-patterns
+  if (file.endsWith(".css")) {
+    if (/backdrop-filter\s*:/i.test(content)) {
+      console.error(`✖ Violation in ${file}: Glassmorphism (backdrop-filter) is strictly forbidden.`);
+      issuesFound++;
+    }
+    const shadowMatches = content.match(/(box-shadow|text-shadow)\s*:\s*([^;]+);/gi) || [];
+    for (const match of shadowMatches) {
+      if (!/(box-shadow|text-shadow)\s*:\s*none\s*;/i.test(match)) {
+        console.error(`✖ Violation in ${file}: Drop shadows/glows forbidden: '${match}'`);
+        issuesFound++;
+      }
+    }
+    if (/(linear-gradient|radial-gradient|conic-gradient)/i.test(content)) {
+      console.error(`✖ Violation in ${file}: Gradients are strictly forbidden.`);
+      issuesFound++;
+    }
+    const radiusMatches = content.match(/border-radius\s*:\s*([^;]+);/gi) || [];
+    for (const match of radiusMatches) {
+      const pxMatch = match.match(/(\d+)\s*px/i);
+      if (pxMatch && parseInt(pxMatch[1], 10) > 4) {
+        console.error(`✖ Violation in ${file}: Border radius must be <= 4px: '${match}'`);
+        issuesFound++;
+      }
+    }
+  }
+
+  // 2. Monolithic inline styles in templates
+  if (file.endsWith(".njk") || file.endsWith(".html")) {
+    if (/<style[^>]*>[\s\S]*?<\/style>/i.test(content)) {
+      console.error(`✖ Violation in ${file}: Monolithic inline <style> tags are forbidden. Modularize into src/assets/css/`);
+      issuesFound++;
+    }
+  }
+}
+
+if (issuesFound > 0) {
+  console.error(`\n✖ Standards Verification failed: ${issuesFound} issue(s) detected.\n`);
+  process.exit(1);
+} else {
+  console.log("✔ Targeted standards verification passed with 0 violations.\n");
+}

.agents/standards.md

@@ -0,0 +1,124 @@
+# Technical Blog Project Standards & Architectural Specification
+
+This document defines the authoritative engineering, design, templating, and security standards for this technical publication codebase. All new implementations, pull requests, refactors, and debugging tasks must conform to these rules.
+
+---
+
+## 1. User Content Sovereignty (Highest Priority)
+
+1. **User Edits Are Absolute Ground Truth:**
+   - The user's custom writing, post titles, tags, navigation labels, terminology, and naming choices strictly supersede any boilerplate, skill instructions, or sample mockups (`sample-designs/*`).
+2. **No Unsolicited Modifications:**
+   - Never overwrite, sanitize away, or rename user-authored text without explicit instruction.
+3. **Mandatory Clarification Gate:**
+   - Inconsistencies or typos in user writing must be flagged for clarification rather than unilaterally changed.
+
+---
+
+## 2. Strict Test-Driven Development (TDD) & Adversarial Verification
+
+1. **Test-First Invariant (Tests Before Code):**
+   - Automated test cases in `test/*.test.js` MUST ALWAYS be written and established *before writing or modifying any functional code* (filters, templates, server routes, ingestion logic, build scripts).
+   - Never implement or modify production code prior to establishing tests.
+2. **Mandatory Adversarial Testing:**
+   - Every functional implementation must include adversarial tests designed to actively falsify assumptions:
+     - Missing or malformed configuration (e.g., unset `SITE_DOMAIN` must throw).
+     - Corrupt or unexpected inputs (empty strings, `null`, `undefined`, unexpected types, HTML injections, path traversals, giant payloads).
+     - Boundary values and edge cases.
+     - Design rule violation assertions (0 instances of forbidden CSS patterns).
+     - Link and anchor integrity checks.
+3. **Pre-Presentation Verification Gate:**
+   - Before presenting the final output to the user, run `npm test`.
+   - All test cases must pass before presenting the final output. Delivering unverified or failing code is strictly forbidden.
+
+---
+
+## 3. Design System & CSS Specification
+
+Strict adherence to `sample-designs/design-specification.md` is mandatory.
+
+### 3.1 Color Palette & Token Variables
+All colors must use standard CSS custom properties defined in `src/assets/css/tokens.css`:
+- Canvas: `var(--bg-canvas)` (`#0d0f12`)
+- Surface: `var(--bg-surface)` (`#121417`)
+- Elevated: `var(--bg-elevated)` (`#1c1f26`)
+- Borders: `var(--border-color)` (`#2b303b`)
+- Text: `var(--text-primary)` (`#e0e6f0`), `var(--text-muted)` (`#8a95a5`)
+- Accents: `var(--accent-cyan)` (`#00f0ff`), `var(--accent-green)` (`#00e676`), `var(--accent-amber)` (`#ffb700`), `var(--accent-red)` (`#ff5252`)
+
+### 3.2 Hard Anti-Patterns (Forbidden)
+- **NO Glassmorphism:** Never use `backdrop-filter: blur(...)`.
+- **NO Drop Shadows or Glows:** `box-shadow: none;` and `text-shadow: none;` only.
+- **NO Gradients:** Never use `linear-gradient`, `radial-gradient`, or `conic-gradient`. Flat solid surfaces only.
+- **NO Rounded Bubbles:** `border-radius` is strictly capped between `0px` and `4px` maximum.
+- **NO Floaty / Delayed Transitions:** Hover and state transitions must be instant binary snaps (`transition: none;` or `transition: 0s;`).
+
+### 3.3 Typography & Modularity
+- UI & Code: `IBM Plex Mono`, `JetBrains Mono`.
+- Body Prose: `Inter`.
+- CSS Modularity: Zero monolithic inline `<style>` tags in HTML. Decompose styles into `tokens.css`, `reset.css`, `layout.css`, and `components/*.css`.
+
+---
+
+## 4. Templating & Eleventy Architecture
+
+1. **Layout Inheritance (Nunjucks):**
+   - Root layout: `src/_includes/layouts/base.njk`.
+   - Post layout: `src/_includes/layouts/post.njk`.
+   - Page layout: `src/_includes/layouts/page.njk`.
+   - Modular reusable partials in `src/_includes/partials/` (`global-bar.njk`, `hero-tile.njk`, `post-card.njk`, `stats-sidebar.njk`, `code-box.njk`, `footer.njk`).
+2. **Collection Invariants:**
+   - `collections.posts`: Must filter through `isPostPublic(post)` (excluding both `draft: true` and `hidden: true`) and sort using `postComparator` (prioritizing pinned/featured posts, then chronological descending).
+   - `collections.tagList`: Must filter through `isPostPublic(post)` so draft or unlisted tags never leak into public category filters.
+3. **Hidden / Unlisted Post Contract:**
+   - When frontmatter specifies `hidden: true`:
+     - Excluded from public lists, indices, and tag aggregates.
+     - Static page STILL compiles to `/posts/<slug>/index.html` and is accessible via direct URL.
+     - Emits `<meta name="robots" content="noindex, nofollow">` in `<head>` to prevent search indexing.
+
+---
+
+## 5. Obsidian Content & Frontmatter Contract
+
+1. **Frontmatter Schema:**
+   ```yaml
+   title: "Article Title"          # Required: string (>= 5 chars)
+   date: 2026-09-23                 # Required: ISO YYYY-MM-DD (or 'created')
+   tags: ["#tag1", "#tag2"]        # Required: non-empty YAML array
+   excerpt: "Article summary..."   # Required: string (>= 20 chars)
+   readingTime: "5 MIN READ"        # Optional: explicit override
+   draft: false                    # Optional: boolean
+   hidden: false                   # Optional: boolean (share by link only)
+   pinned: false                   # Optional: boolean (prioritized to top)
+   featured: false                 # Optional: boolean (featured pillar)
+   ```
+2. **Obsidian Syntax Normalization:**
+   - Wikilinks: `[[target-slug|Custom Label]]` $\rightarrow$ `[Custom Label](/posts/target-slug/)`.
+   - Wikilinks simple: `[[target-slug]]` $\rightarrow$ `[target-slug](/posts/target-slug/)`.
+   - Attachments: `![[image.png]]` $\rightarrow$ `![image](/assets/images/posts/image.png)`.
+   - Terminal alert callouts for `> [!NOTE]`, `> [!WARNING]`, etc.
+
+---
+
+## 6. Server & Security Invariants
+
+1. **Native Runtime:**
+   - `server.js` uses native Node standard library (`node:http`, `node:fs`, `node:path`) with zero external runtime dependencies.
+2. **Security Headers on All Responses:**
+   - `X-Content-Type-Options: nosniff`
+   - `X-Frame-Options: DENY`
+   - `Referrer-Policy: strict-origin-when-cross-origin`
+3. **Path Traversal Defense:**
+   - Sanitize all requested file paths using `path.resolve` and verify the resolved path remains rooted inside the target directory. Block `..` and malicious slug sequences.
+4. **Healthcheck Telemetry:**
+   - `/healthz` and `/health` must respond with HTTP 200 JSON `{ status: "ok", uptime: <seconds> }`.
+
+---
+
+## 7. Defensive Programming & Error Prevention
+
+1. **Input Guarding:**
+   - Never assume incoming arguments have expected shape. Always guard against `null`, `undefined`, non-objects, and primitive inputs (e.g., `item.data ?? item`).
+2. **Clean Container Contracts:**
+   - Container images must use `node:22-alpine`.
+   - Dynamic entrypoint (`entrypoint.sh`) must build markdown on boot, handle optional watcher (`WATCH=true`), and execute server as PID 1 (`exec node server.js`).

.gitignore

@@ -5,3 +5,6 @@ _site/
 *.log
 .env
 docker-compose.yml
+
+# Local browser fixtures for document-based development
+src/posts/*.md

AGENTS.md

@@ -51,14 +51,19 @@ Every component, style, and layout change must strictly adhere to [`sample-desig
 - **Typography:** IBM Plex Mono / JetBrains Mono for UI elements and code blocks; Inter for body prose.
 
 ### 2.4 Strict Test-Driven Development (TDD) & Adversarial Verification Mandate
-- **Test-First Development:** For all new features, custom filters, template helpers, frontmatter schemas, or configuration changes, write automated tests asserting expected behaviors and edge cases *before* or alongside implementing the code.
+- **Strict Test-First Invariant (Tests Before Code):**
-- **Adversarial Mindset:** Actively design tests to break assumptions:
+  - Test cases MUST ALWAYS be written and established *before writing or modifying any functional code* (filters, templates, server routes, ingestion logic, build scripts).
-  - Missing environment variables (e.g. unset `SITE_DOMAIN` must throw).
+  - Never write or modify functional or production code before the corresponding automated tests are created.
-  - Malformed frontmatter (missing titles, invalid dates, empty tags).
+- **Mandatory Adversarial Testing:**
-  - Edge-case inputs to filters (empty strings, giant numbers, special characters).
+  - Standard behavior for any functional change MUST ALWAYS include adversarial testing specifically designed to falsify assumptions and break the implementation:
-  - Design rule violations (asserting 0 instances of `backdrop-filter`, `box-shadow`, gradients, or floaty animations).
+    - Missing or malformed environment variables (e.g., unset `SITE_DOMAIN` must throw).
-  - Broken internal links and missing anchor tags in generated HTML.
+    - Malformed frontmatter (missing required keys, invalid dates, malformed tags, extra/empty fields).
-- **Verification Gate:** Every code change must be verified by running `npm test`. No feature or commit is considered complete unless 100% of the test suite passes.
+    - Edge-case and malicious inputs to filters and functions (empty strings, undefined/null values, unexpected types, HTML injections, path traversals, giant payloads).
+    - Design rule violations (asserting 0 instances of `backdrop-filter`, `box-shadow`, gradients, or floaty animations).
+    - Broken internal links, missing assets, and broken TOC anchor tags.
+- **Pre-Presentation Verification Gate:**
+  - Before presenting the final output to the user, the agent MUST run the full test suite (`npm test`).
+  - All test cases must pass before presenting the final output. Never deliver, present, or claim completion of work if any test case is failing or unverified.
 
 ---
 
@@ -90,6 +95,7 @@ Every component, style, and layout change must strictly adhere to [`sample-desig
   excerpt: "Short synopsis of article."
   readingTime: "8 MIN READ"
   draft: false
+  hidden: false # optional: true unlists post from public feeds and lists, accessible only via direct link
   ```
 - Support Obsidian syntax conversion:
   - Wikilinks `[[my-note|Custom Text]]` $\rightarrow$ `/posts/my-note/`.

README.md

@@ -98,6 +98,12 @@ docker compose logs -f
 docker compose down
 ```
 
+### 2.3 Development Standards: Strict TDD & Adversarial Verification
+This project enforces a strict test-first development lifecycle and verification standard:
+1. **Tests Written Before Functional Code:** Automated test cases in `test/` must always be written before writing or modifying any functional code, filters, templates, server endpoints, or scripts.
+2. **Mandatory Adversarial Testing:** Standard behavior for any functional change must always include adversarial test cases (boundary values, malformed/null inputs, unauthorized requests, path traversals, corrupt frontmatter, and design spec violations).
+3. **Pre-Presentation Verification Gate:** Every change must be verified by running `npm test`. All test cases must pass before presenting the final output or committing code.
+
 ---
 
 ## 3. Push & Update Cycles
@@ -114,6 +120,7 @@ When you write a new note or edit an existing article:
    date: 2026-09-14
    tags: ["#systems", "#architecture"]
    excerpt: "A short synopsis of the article."
+   hidden: false # (Optional) Set to true to hide from public lists while keeping direct link active
    ---
 
    # Article Content...

eleventy.config.js

@@ -2,9 +2,19 @@ import syntaxHighlight from "@11ty/eleventy-plugin-syntaxhighlight";
 import markdownIt from "markdown-it";
 import markdownItAnchor from "markdown-it-anchor";
 import { filters } from "./src/_filters/index.js";
-import { postComparator } from "./src/_utils/sort-posts.js";
+import { postComparator, isPostPublic } from "./src/_utils/sort-posts.js";
+import { validateLinkedArticles } from "./src/_utils/linked-articles.js";
 
 export default function (eleventyConfig) {
+  let buildTimestamp = new Date().toISOString();
+  eleventyConfig.on("eleventy.before", () => {
+    buildTimestamp = new Date().toISOString();
+  });
+  eleventyConfig.addGlobalData("buildTimestamp", () => buildTimestamp);
+
+  // Build ignored local post fixtures without making them Git-tracked.
+  eleventyConfig.setUseGitIgnore(false);
+
   // 1. Static Asset Passthrough Copy
   eleventyConfig.addPassthroughCopy({ "src/assets": "assets" });
 
@@ -39,27 +49,32 @@ export default function (eleventyConfig) {
   }
 
   // 5. Custom Collections
-  // Pinned / featured prioritized, chronological blog posts collection
+  // Pinned / featured prioritized, chronological blog posts collection (excludes drafts and hidden posts)
   eleventyConfig.addCollection("posts", (collectionApi) => {
-    return collectionApi
+    const allPosts = collectionApi.getFilteredByGlob("src/posts/*.md");
-      .getFilteredByGlob("src/posts/*.md")
+    validateLinkedArticles(allPosts);
-      .filter((post) => !post.data.draft)
+
+    return allPosts
+      .filter((post) => isPostPublic(post))
       .sort(postComparator);
   });
 
-  // Dynamic Tag List Collection across all posts
+  // Dynamic Tag List Collection across all public posts (excludes drafts and hidden posts)
   eleventyConfig.addCollection("tagList", (collectionApi) => {
     const tagSet = new Set();
-    collectionApi.getFilteredByGlob("src/posts/*.md").forEach((item) => {
+    collectionApi
-      if ("tags" in item.data) {
+      .getFilteredByGlob("src/posts/*.md")
-        let tags = item.data.tags;
+      .filter((post) => isPostPublic(post))
-        if (typeof tags === "string") tags = [tags];
+      .forEach((item) => {
-        for (const tag of tags) {
+        if ("tags" in item.data) {
-          const cleanTag = tag.replace(/^#/, "");
+          let tags = item.data.tags;
-          tagSet.add(cleanTag);
+          if (typeof tags === "string") tags = [tags];
+          for (const tag of tags) {
+            const cleanTag = tag.replace(/^#/, "");
+            tagSet.add(cleanTag);
+          }
         }
-      }
+      });
-    });
     return [...tagSet].sort();
   });
 

sample-designs/service-gateway-tiling.html

@@ -425,8 +425,8 @@
         <strong>PRIMARY DESTINATIONS:</strong>
         <span style="color: var(--accent-cyan); margin-left: 8px;">[1] Technical Blog (5 Articles)</span> &bull;
         <span>[2] Forgejo Git Repos</span> &bull;
-        <span>[3] Public Cryptographic &amp; PDF Tools</span> &bull;
+        <!-- <span>[3] Public Cryptographic &amp; PDF Tools</span> &bull; -->
-        <span>[4] Cluster Telemetry</span>
+        <!-- <span>[4] Cluster Telemetry</span> -->
       </div>
     </section>
 

server.js

@@ -57,20 +57,32 @@ export function normalizeObsidianMarkdown(content) {
 
   // 2. Convert wikilinks with label: [[target-slug|Custom Label]] -> [Custom Label](/posts/target-slug/)
   normalized = normalized.replace(/\[\[([^|\]]+)\|([^\]]+)\]\]/g, (match, target, label) => {
-    const slug = slugify(target);
+    return `[${label.trim()}](${wikilinkUrl(target)})`;
-    return `[${label.trim()}](/posts/${slug}/)`;
   });
 
   // 3. Convert simple wikilinks: [[target-slug]] -> [target-slug](/posts/target-slug/)
   normalized = normalized.replace(/\[\[([^\]]+)\]\]/g, (match, target) => {
     const trimmed = target.trim();
-    const slug = slugify(trimmed);
+    return `[${trimmed}](${wikilinkUrl(trimmed)})`;
-    return `[${trimmed}](/posts/${slug}/)`;
   });
 
   return normalized;
 }
 
+function wikilinkUrl(target) {
+  const trimmed = target.trim();
+  const fragmentIndex = trimmed.indexOf("#");
+
+  if (fragmentIndex === -1) {
+    return `/posts/${slugify(trimmed)}/`;
+  }
+
+  const noteSlug = slugify(trimmed.slice(0, fragmentIndex));
+  const headerSlug = slugify(trimmed.slice(fragmentIndex + 1));
+  const fragment = headerSlug ? `#${headerSlug}` : "";
+  return `/posts/${noteSlug}/${fragment}`;
+}
+
 function slugify(text) {
   return text
     .toLowerCase()

src/404.njk

@@ -0,0 +1,25 @@
+---
+layout: layouts/base.njk
+permalink: /404.html
+title: Page not found | River Rooks
+excerpt: The requested page could not be found.
+---
+<section class="not-found tile" aria-labelledby="not-found-title">
+  <header class="tile-header">
+    <span class="tile-title">// ROUTE STATUS</span>
+    <span class="tile-meta">HTTP 404 &bull; NOT FOUND</span>
+  </header>
+
+  <div class="not-found-body">
+    <h1 class="not-found-code" id="not-found-title">404<span class="not-found-cursor" aria-hidden="true">_</span></h1>
+    <div class="not-found-message">
+      <p class="not-found-label">REQUEST FAILED / NO MATCHING ROUTE</p>
+      <h2>Page not found.</h2>
+      <p>The address you requested doesn't point to a page here. Check the URL, or choose a known route below.</p>
+      <nav class="not-found-links" aria-label="Recovery links">
+        <a href="/">&gt; Back to home</a>
+        <a href="/dispatches/">&gt; Browse dispatches</a>
+      </nav>
+    </div>
+  </div>
+</section>

src/_data/site.js

@@ -58,30 +58,30 @@ export default {
       url: `https://git.riverrooks.dev/venus`,
       external: true
     },
-    {
+    // {
-      label: "RSS Feed",
+    //   label: "RSS Feed",
-      url: "/feed.xml"
+    //   url: "/feed.xml"
-    }
+    // }
   ],
   services: [
     {
       name: "Gitea",
       url: `https://git.riverrooks.dev/venus`,
-      tag: `git.${siteDomain}:2222`,
+      tag: `git.${siteDomain}:443`,
       desc: "Self-hosted Git code repositories."
     },
-    {
+    // {
-      name: "CyberChef",
+    //   name: "CyberChef",
-      url: `https://chef.${siteDomain}`,
+    //   url: `https://chef.${siteDomain}`,
-      tag: `chef.${siteDomain}:443`,
+    //   tag: `chef.${siteDomain}:443`,
-      desc: "Industry tool for analyzing and decoding data."
+    //   desc: "Industry tool for analyzing and decoding data."
-    },
+    // },
-    {
+    // {
-      name: "Aperisolve",
+    //   name: "Aperisolve",
-      url: `https://aperisolve.${siteDomain}`,
+    //   url: `https://aperisolve.${siteDomain}`,
-      tag: `aperisolve.${siteDomain}:443`,
+    //   tag: `aperisolve.${siteDomain}:443`,
-      desc: "Basic image steganography suite."
+    //   desc: "Basic image steganography suite."
-    },
+    // },
     {
       name: "Streams",
       url: `https://streams.${siteDomain}`,
@@ -90,16 +90,22 @@ export default {
     },
     {
       name: "Calibre",
-      url: `https://library.${siteDomain}`,
+      url: `https://books.${siteDomain}`,
       tag: `books.${siteDomain}:443`,
       desc: `Calibre web frontend for managing and reading eBooks.`
     },
     {
-      name: "Whoami",
+      name: "Wireguard",
-      url: `https://whoami.${siteDomain}`,
+      url: `https://wg.${siteDomain}`,
-      tag: `whoami.${siteDomain}:443`,
+      tag: `wg.${siteDomain}:443`,
-      desc: `Simple service to display request headers and connection information.`
+      desc: `Self-hosted Wireguard VPN server.(Requires login)`
     }
+    // {
+    //   name: "Whoami",
+    //   url: `https://whoami.${siteDomain}`,
+    //   tag: `whoami.${siteDomain}:443`,
+    //   desc: `Simple service to display request headers and connection information.`
+    // }
   ],
   topics: [
     {

src/_filters/index.js

@@ -1,9 +1,18 @@
 import { DateTime } from "luxon";
+import markdownIt from "markdown-it";
+import { resolveLinkedArticles } from "../_utils/linked-articles.js";
 
 /**
  * Custom Eleventy Filters for River Rooks Blog
  */
 
+const excerptMarkdown = markdownIt({ html: false });
+
+export const renderExcerptMarkdown = (excerpt) => {
+  if (typeof excerpt !== "string") return "";
+  return excerptMarkdown.renderInline(excerpt);
+};
+
 export const postDate = (dateObj) => {
   if (!dateObj) return "";
   const date = typeof dateObj === "string" ? new Date(dateObj) : dateObj;
@@ -62,13 +71,46 @@ export const extractHeadings = (htmlContent) => {
   return headings;
 };
 
+const leadingTerminalPreviewHeading = /^\s*<h1\b[^>]*\bid=(["'])terminal-preview\1[^>]*>[\s\S]*?<\/h1>/i;
+
+const terminalPreviewBounds = (htmlContent) => {
+  if (!htmlContent || typeof htmlContent !== "string") return null;
+
+  const heading = htmlContent.match(leadingTerminalPreviewHeading);
+  if (!heading) return null;
+
+  const contentAfterHeading = htmlContent.slice(heading[0].length);
+  const nextArticleHeading = contentAfterHeading.search(/<h[1-6]\b/i);
+  if (nextArticleHeading === -1) return null;
+
+  const leadingArticleWhitespace = contentAfterHeading
+    .slice(0, nextArticleHeading)
+    .match(/\s*$/)?.[0] || "";
+
+  return {
+    preview: contentAfterHeading.slice(0, nextArticleHeading),
+    article: leadingArticleWhitespace + contentAfterHeading.slice(nextArticleHeading)
+  };
+};
+
+export const extractTerminalPreview = (htmlContent) => terminalPreviewBounds(htmlContent)?.preview || "";
+
+export const removeTerminalPreview = (htmlContent) => {
+  if (!htmlContent || typeof htmlContent !== "string") return "";
+  return terminalPreviewBounds(htmlContent)?.article || htmlContent;
+};
+
 export const filters = {
+  renderExcerptMarkdown,
   postDate,
   isoDate,
   limit,
   filterTagList,
   readingTime,
-  extractHeadings
+  extractHeadings,
+  extractTerminalPreview,
+  removeTerminalPreview,
+  resolveLinkedArticles
 };
 
 export default filters;

src/_includes/layouts/base.njk

@@ -29,6 +29,7 @@
     {% include "partials/footer.njk" %}
   </div>
 
+  <script type="module" src="/assets/js/build-timer.js"></script>
   {% block scripts %}{% endblock %}
 </body>
 </html>

src/_includes/layouts/post.njk

@@ -1,11 +1,17 @@
 {% extends "layouts/base.njk" %}
 
+{% block head %}
+  {% if hidden and hidden != "false" and hidden != "0" and hidden != "no" %}
+    <meta name="robots" content="noindex, nofollow">
+  {% endif %}
+{% endblock %}
+
 {% block content %}
 <div class="article-workspace-grid">
   <!-- Left Sticky Sidebar: Document Outline & Telemetry -->
   <aside class="article-sidebar" aria-label="Article Sidebar">
     <!-- Dynamic Table of Contents -->
-    {% set headings = content | extractHeadings %}
+    {% set headings = (content | removeTerminalPreview) | extractHeadings %}
     {% if headings.length > 0 %}
       <div class="sidebar-tile">
         <div class="sidebar-heading">
@@ -25,14 +31,32 @@
     <!-- Article Telemetry Tile -->
     <div class="sidebar-tile">
       <div class="sidebar-heading">DISPATCH TELEMETRY</div>
+      {% set linkedPosts = collections.posts | resolveLinkedArticles(linkedArticles) %}
+      {% if linkedPosts.length > 0 %}
+        <section aria-labelledby="other-articles-heading">
+          <div id="other-articles-heading" class="sidebar-heading">OTHER ARTICLES</div>
+          <nav class="toc-nav" aria-label="Other Articles">
+            {% for linkedPost in linkedPosts %}
+              <a href="{{ linkedPost.url }}" class="toc-link">{{ linkedPost.data.title }}</a>
+            {% endfor %}
+          </nav>
+        </section>
+      {% endif %}
       <div class="sidebar-stats-box" style="padding: 0; background: transparent; border: none;">
+        {% if hidden and hidden != "false" and hidden != "0" and hidden != "no" %}
+          <div class="stat-row">
+            <span>VISIBILITY:</span>
+            <span class="stat-val" style="color: var(--accent-amber);">UNLISTED</span>
+          </div>
+        {% endif %}
         <div class="stat-row">
           <span>PUBLISHED:</span>
           <span class="stat-val">{{ date | postDate }}</span>
         </div>
+
         <div class="stat-row">
           <span>DURATION:</span>
-          <span class="stat-val">{{ content | readingTime(readingTime) }}</span>
+          <span class="stat-val">{{ (content | removeTerminalPreview) | readingTime(readingTime) }}</span>
         </div>
         {% if difficulty %}
           <div class="stat-row">
@@ -77,7 +101,7 @@
           <time datetime="{{ date | isoDate }}">{{ date | postDate }}</time>
         </span>
         <span>&bull;</span>
-        <span class="meta-item">{{ content | readingTime(readingTime) }}</span>
+        <span class="meta-item">{{ (content | removeTerminalPreview) | readingTime(readingTime) }}</span>
         {% if difficulty %}
           <span>&bull;</span>
           <span class="meta-item" style="color: var(--accent-amber);">DIFFICULTY: {{ difficulty }}</span>
@@ -86,7 +110,7 @@
     </header>
 
     <div class="markdown-prose">
-      {{ content | safe }}
+      {{ content | removeTerminalPreview | safe }}
     </div>
   </article>
 </div>

src/_includes/partials/featured-card.njk

@@ -29,24 +29,26 @@
     </h2>
 
     <p class="featured-prose">
-      {{ featured.data.excerpt }}
+      {{ featured.data.excerpt | renderExcerptMarkdown | safe }}
     </p>
 
-    <!-- Terminal Code Preview Snippet -->
+    {% if featured.data.terminal == true %}
-    <div class="terminal-code-box">
+      {% set terminalPreview = featured.templateContent | extractTerminalPreview %}
-      <div class="code-titlebar">
+      {% if terminalPreview %}
-        <span class="code-title">
+        <div class="terminal-code-box terminal-preview-box">
-          <span style="color: var(--accent-cyan);">&gt;</span>
+          <div class="code-titlebar">
-          <span>init_cluster.sh</span>
+            <span class="code-title">
-        </span>
+              <span style="color: var(--accent-cyan);">&gt;</span>
-        <span>POSIX sh</span>
+              <span>TERMINAL PREVIEW</span>
-      </div>
+            </span>
-      <div class="code-content">
+            <span>MARKDOWN</span>
-        <pre><code class="language-bash"># System initialization and node health check
+          </div>
-./cluster.sh --verify-nodes
+          <div class="terminal-preview-content">
-curl -s https://api.local/healthz | jq .status</code></pre>
+            {{ terminalPreview | safe }}
-      </div>
+          </div>
-    </div>
+        </div>
+      {% endif %}
+    {% endif %}
 
     <div class="featured-cta-row">
       <div class="tag-cluster">

src/_includes/partials/footer.njk

@@ -4,10 +4,12 @@
     <span>RUNTIME: ELEVENTY 3.x STATIC</span>
     <span>&bull;</span>
     <span>THEME: NATIVE TERMINAL DARK</span>
+    <span>&bull;</span>
+    <time id="build-age" data-build-timestamp="{{ buildTimestamp }}" aria-live="polite">REBUILT: INITIALIZING</time>
   </div>
 
   <div class="footer-right">
     <span>&copy; {{ currentYear or "2026" }} {{ site.author }}</span>
-    <a href="https://git.{{ site.domain }}" target="_blank" rel="noopener noreferrer" class="footer-link">Source Forge ↗</a>
+    <a href="https://git.{{ site.domain }}" target="_blank" rel="noopener noreferrer" class="footer-link">Source Code ↗</a>
   </div>
 </footer>

src/_includes/partials/post-card.njk

@@ -11,7 +11,7 @@
   </h3>
 
   {% if post.data.excerpt %}
-    <p class="feed-excerpt">{{ post.data.excerpt }}</p>
+    <p class="feed-excerpt">{{ post.data.excerpt | renderExcerptMarkdown | safe }}</p>
   {% endif %}
 
   <div class="feed-tags-row">

src/_utils/linked-articles.js

@@ -0,0 +1,48 @@
+export const validateLinkedArticles = (posts) => {
+  const titles = new Set(posts.map((post) => post.data.title));
+
+  for (const post of posts) {
+    const { linkedArticles } = post.data;
+
+    if (linkedArticles === undefined) continue;
+
+    if (!Array.isArray(linkedArticles)) {
+      throw new Error(
+        `Post '${post.inputPath}' must define 'linkedArticles' as a YAML list of article titles`
+      );
+    }
+
+    const linkedTitleSet = new Set();
+    for (const title of linkedArticles) {
+      if (typeof title !== "string" || title.trim() === "") {
+        throw new Error(
+          `Post '${post.inputPath}' must define 'linkedArticles' with non-empty article titles`
+        );
+      }
+
+      if (title === post.data.title) {
+        throw new Error(`Post '${post.inputPath}' cannot link to itself`);
+      }
+
+      if (linkedTitleSet.has(title)) {
+        throw new Error(
+          `Post '${post.inputPath}' cannot contain duplicate article titles in 'linkedArticles'`
+        );
+      }
+      linkedTitleSet.add(title);
+
+      if (!titles.has(title)) {
+        throw new Error(
+          `Post '${post.inputPath}' links to unknown article '${title}'`
+        );
+      }
+    }
+  }
+};
+
+export const resolveLinkedArticles = (posts, titles) => {
+  if (!Array.isArray(posts) || !Array.isArray(titles)) return [];
+
+  const postsByTitle = new Map(posts.map((post) => [post.data.title, post]));
+  return titles.map((title) => postsByTitle.get(title)).filter(Boolean);
+};

src/_utils/sort-posts.js

@@ -56,4 +56,62 @@ export function postComparator(a, b) {
   return timeB - timeA;
 }
 
+/**
+ * Determines whether a post is marked as hidden.
+ * Hidden posts are accessible via direct link/URL, but excluded
+ * from public post lists, indexes, and tag collections.
+ * Supports explicit boolean, string ("true", "yes", "1"), or numeric representations.
+ *
+ * @param {object} item Eleventy page / post object
+ * @returns {boolean}
+ */
+export function isPostHidden(item) {
+  if (!item || typeof item !== "object") return false;
+  const data = item.data ?? item;
+  if (!data || typeof data !== "object") return false;
+  const hidden = data.hidden;
+  if (typeof hidden === "string") {
+    const lower = hidden.trim().toLowerCase();
+    return lower === "true" || lower === "yes" || lower === "1";
+  }
+  if (typeof hidden === "number") {
+    return hidden === 1;
+  }
+  return Boolean(hidden);
+}
+
+/**
+ * Determines whether a post is marked as a draft.
+ *
+ * @param {object} item Eleventy page / post object
+ * @returns {boolean}
+ */
+export function isPostDraft(item) {
+  if (!item || typeof item !== "object") return false;
+  const data = item.data ?? item;
+  if (!data || typeof data !== "object") return false;
+  const draft = data.draft;
+  if (typeof draft === "string") {
+    const lower = draft.trim().toLowerCase();
+    return lower === "true" || lower === "yes" || lower === "1";
+  }
+  if (typeof draft === "number") {
+    return draft === 1;
+  }
+  return Boolean(draft);
+}
+
+/**
+ * Determines whether a post is eligible for public collections and listings.
+ * A post must be non-draft and non-hidden.
+ *
+ * @param {object} item Eleventy page / post object
+ * @returns {boolean}
+ */
+export function isPostPublic(item) {
+  if (!item || typeof item !== "object") return false;
+  return !isPostDraft(item) && !isPostHidden(item);
+}
+
 export default postComparator;
+

src/assets/css/components/code-box.css

@@ -65,6 +65,35 @@
   font-family: var(--font-code);
 }
 
+.terminal-preview-box {
+  margin: 0;
+}
+
+.terminal-preview-content {
+  padding: 14px 16px;
+  color: var(--text-primary);
+  font-size: 0.82rem;
+  line-height: 1.55;
+}
+
+.terminal-preview-content > :first-child {
+  margin-top: 0;
+}
+
+.terminal-preview-content > :last-child {
+  margin-bottom: 0;
+}
+
+.terminal-preview-content pre {
+  margin: 10px 0;
+  padding: 10px 12px;
+  overflow-x: auto;
+  background-color: var(--bg-surface);
+  border: var(--border-width) solid var(--border-color);
+  border-radius: var(--border-radius-sm);
+  font-family: var(--font-code);
+}
+
 /* Syntax Highlighting Tokens (Prism / 11ty Syntax Highlight) */
 .token.comment,
 .token.prolog,

src/assets/css/components/not-found.css

@@ -0,0 +1,86 @@
+/* Missing route: a compact diagnostic panel in the site's tiling vocabulary. */
+.not-found {
+  gap: 0;
+  padding: 20px 24px 28px;
+}
+
+.not-found-body {
+  display: grid;
+  grid-template-columns: minmax(0, 0.8fr) minmax(0, 1fr);
+  align-items: center;
+  gap: 24px;
+  min-height: 320px;
+}
+
+.not-found-code {
+  font-family: var(--font-mono);
+  font-size: clamp(5rem, 14vw, 10rem);
+  line-height: 1;
+  letter-spacing: -0.09em;
+  color: var(--accent-amber);
+  white-space: nowrap;
+}
+
+.not-found-cursor {
+  color: var(--text-muted);
+}
+
+.not-found-message {
+  border-left: 1px solid var(--border-color);
+  padding: 16px 0 16px 24px;
+  max-width: 48ch;
+}
+
+.not-found-label {
+  font: 500 0.75rem var(--font-mono);
+  letter-spacing: 0.06em;
+  color: var(--accent-amber);
+  margin-bottom: 12px;
+}
+
+.not-found-message h2 {
+  font: 700 clamp(1.3rem, 3vw, 2rem) / 1.25 var(--font-mono);
+  margin-bottom: 12px;
+}
+
+.not-found-message > p:not(.not-found-label) {
+  color: var(--text-muted);
+  max-width: 42ch;
+}
+
+.not-found-links {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 8px 24px;
+  margin-top: 24px;
+  font: 500 0.85rem var(--font-mono);
+}
+
+.not-found-links a {
+  color: var(--accent-cyan);
+  text-decoration: none;
+}
+
+.not-found-links a:hover {
+  color: var(--bg-canvas);
+  background: var(--accent-cyan);
+}
+
+@media (max-width: 680px) {
+  .not-found {
+    padding: 16px;
+  }
+
+  .not-found-body {
+    grid-template-columns: 1fr;
+    gap: 8px;
+    min-height: 0;
+    padding: 32px 0 8px;
+  }
+
+  .not-found-message {
+    border-left: 0;
+    border-top: 1px solid var(--border-color);
+    padding: 20px 0 0;
+  }
+}

src/assets/css/main.css

@@ -19,3 +19,4 @@
 @import "./components/code-box.css";
 @import "./components/article.css";
 @import "./components/footer.css";
+@import "./components/not-found.css";

src/assets/js/build-timer.js

@@ -0,0 +1,30 @@
+export const formatBuildAge = (buildTimestamp, nowTimestamp = new Date().toISOString()) => {
+  const buildTime = Date.parse(buildTimestamp);
+  const now = Date.parse(nowTimestamp);
+
+  if (!Number.isFinite(buildTime) || !Number.isFinite(now)) return "unknown";
+
+  const elapsedSeconds = Math.max(0, Math.floor((now - buildTime) / 1000));
+  const days = Math.floor(elapsedSeconds / 86400);
+  const hours = Math.floor((elapsedSeconds % 86400) / 3600);
+  const minutes = Math.floor((elapsedSeconds % 3600) / 60);
+  const seconds = elapsedSeconds % 60;
+
+  if (days > 0) return `${days}d ${hours}h ago`;
+  if (hours > 0) return `${hours}h ${minutes}m ago`;
+  if (minutes > 0) return `${minutes}m ${seconds}s ago`;
+  return `${seconds}s ago`;
+};
+
+if (typeof document !== "undefined") {
+  const timer = document.getElementById("build-age");
+
+  if (timer) {
+    const updateBuildAge = () => {
+      timer.textContent = `REBUILT: ${formatBuildAge(timer.dataset.buildTimestamp)}`;
+    };
+
+    updateBuildAge();
+    window.setInterval(updateBuildAge, 1000);
+  }
+}

src/index.njk

@@ -10,7 +10,7 @@ title: "River Rooks | Homelab Gateway"
 
   <div class="hero-landing-text">
     <p>
-      I am River Rooks, a cybersecurity student and the University of Alabama. This website is the public-facing gateway to my homelab, which hosts a variety of services and tools for personal and professional use. Here, you can find my technical blog and a collection of public tools that host.
+      I am River Rooks, a cyber security student at the University of Alabama. This website is the public-facing gateway to my homelab, which hosts a variety of services and tools for personal and professional use. Here, you can find my technical blog and a collection of public tools that host.
     </p>
     <p>
       I deploy and maintain a variety of services in my homelab for research, development, and learning purposes. This includes web applications, databases, and other tools that I use to enhance my skills in cybersecurity and DevOps. 
@@ -23,8 +23,8 @@ title: "River Rooks | Homelab Gateway"
     <strong>PRIMARY DESTINATIONS:</strong>
     <a href="/dispatches/" style="color: var(--accent-cyan); text-decoration: none; margin-left: 8px;">[1] Technical Blog ({{ collections.posts.length }} Articles)</a> &bull;
     <a href="https://git.{{ site.domain }}" target="_blank" rel="noopener noreferrer" style="color: inherit; text-decoration: none;">[2] Gitea Repos</a> &bull;
-    <span>[3] Public Tools</span> &bull;
+    <a href="https://github.com/skoorrevir" target="_blank" rel="noopener noreferrer" style="color: inherit; text-decoration: none;">[3] GitHub Repos</a> &bull;
-    <span>[4] Cluster Telemetry</span>
+    <a href="https://wg.{{ site.domain }}" target="_blank" rel="noopener noreferrer" style="color: inherit; text-decoration: none;">[4] Wireguard VPN</a> &bull;
   </div>
 </section>
 

test/build-age.test.js

@@ -0,0 +1,62 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import configureEleventy from "../eleventy.config.js";
+import { formatBuildAge } from "../src/assets/js/build-timer.js";
+
+test("Build age: formats elapsed time as a compact live footer value", () => {
+  assert.equal(
+    formatBuildAge("2026-10-20T12:00:00.000Z", "2026-10-20T12:00:00.000Z"),
+    "0s ago"
+  );
+  assert.equal(
+    formatBuildAge("2026-10-20T12:00:00.000Z", "2026-10-20T12:01:01.000Z"),
+    "1m 1s ago"
+  );
+  assert.equal(
+    formatBuildAge("2026-10-20T12:00:00.000Z", "2026-10-21T14:03:04.000Z"),
+    "1d 2h ago"
+  );
+  assert.equal(
+    formatBuildAge("2026-10-20T12:00:00.000Z", "2026-10-20T11:59:59.000Z"),
+    "0s ago"
+  );
+});
+
+test("Build age: Eleventy exposes one ISO timestamp for each rebuild", () => {
+  const globalData = new Map();
+  const events = new Map();
+  configureEleventy({
+    setUseGitIgnore() {},
+    addPassthroughCopy() {},
+    addPlugin() {},
+    setLibrary() {},
+    addFilter() {},
+    addCollection() {},
+    addGlobalData(name, value) {
+      globalData.set(name, value);
+    },
+    on(name, callback) {
+      events.set(name, callback);
+    },
+    setServerOptions() {}
+  });
+
+  events.get("eleventy.before")();
+  assert.match(
+    globalData.get("buildTimestamp")(),
+    /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/
+  );
+});
+
+test("Build age: footer provides an accessible live timer backed by the build timestamp", () => {
+  const footer = fs.readFileSync(path.resolve("src/_includes/partials/footer.njk"), "utf-8");
+  const baseLayout = fs.readFileSync(path.resolve("src/_includes/layouts/base.njk"), "utf-8");
+
+  assert.match(
+    footer,
+    /<time id="build-age" data-build-timestamp="{{ buildTimestamp }}" aria-live="polite">REBUILT: INITIALIZING<\/time>/
+  );
+  assert.match(baseLayout, /<script type="module" src="\/assets\/js\/build-timer\.js"><\/script>/);
+});

test/development-standards.test.js

@@ -0,0 +1,112 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+
+const agentsMdPath = path.resolve("AGENTS.md");
+const rulesMdPath = path.resolve(".agents/rules/blog-system.md");
+
+test("Development Standards: AGENTS.md enforces test-first, adversarial testing, and verification gates", () => {
+  assert.ok(fs.existsSync(agentsMdPath), "AGENTS.md must exist in root");
+  const content = fs.readFileSync(agentsMdPath, "utf-8");
+
+  // 1. Must enforce writing tests BEFORE modifying functional/production code
+  assert.match(
+    content,
+    /before\s+(?:writing\s+or\s+)?modifying\s+(?:any\s+)?(?:functional|production)\s+code/i,
+    "AGENTS.md must explicitly mandate that tests are written before modifying functional/production code"
+  );
+
+  // 2. Must mandate adversarial testing
+  assert.match(
+    content,
+    /adversarial\s+test(?:ing|s)/i,
+    "AGENTS.md must mandate adversarial testing"
+  );
+
+  // 3. Must mandate that all tests pass before presenting final output
+  assert.match(
+    content,
+    /pass\s+before\s+presenting\s+(?:the\s+)?final\s+output/i,
+    "AGENTS.md must mandate that test cases pass before presenting final output"
+  );
+});
+
+test("Development Standards: .agents/rules/blog-system.md enforces test-first, adversarial testing, and verification gates", () => {
+  assert.ok(fs.existsSync(rulesMdPath), ".agents/rules/blog-system.md must exist");
+  const content = fs.readFileSync(rulesMdPath, "utf-8");
+
+  // 1. Must enforce writing tests BEFORE modifying functional/production code
+  assert.match(
+    content,
+    /before\s+(?:writing\s+or\s+)?modifying\s+(?:any\s+)?(?:functional|production)\s+code/i,
+    "blog-system.md must explicitly mandate that tests are written before modifying functional/production code"
+  );
+
+  // 2. Must mandate adversarial testing
+  assert.match(
+    content,
+    /adversarial\s+test(?:ing|s)/i,
+    "blog-system.md must mandate adversarial testing"
+  );
+
+  // 3. Must mandate that all tests pass before presenting final output
+  assert.match(
+    content,
+    /pass\s+before\s+presenting\s+(?:the\s+)?final\s+output/i,
+    "blog-system.md must mandate that test cases pass before presenting final output"
+  );
+});
+
+test("Development Standards: Adversarial checks against vague or permissive testing language", () => {
+  const files = [agentsMdPath, rulesMdPath];
+  for (const filePath of files) {
+    const content = fs.readFileSync(filePath, "utf-8");
+    const relPath = path.relative(process.cwd(), filePath);
+
+    // Adversarial: ensure no permissive "or alongside implementing" loophole exists
+    assert.doesNotMatch(
+      content,
+      /or\s+alongside\s+implementing/i,
+      `Violation in ${relPath}: Permissive loophole "or alongside implementing" must not exist; tests must strictly precede functional code`
+    );
+  }
+});
+
+test("Development Standards: README.md and skills reference TDD, adversarial testing, and verification", () => {
+  const readmePath = path.resolve("README.md");
+  assert.ok(fs.existsSync(readmePath), "README.md must exist");
+  const readmeContent = fs.readFileSync(readmePath, "utf-8");
+
+  assert.match(
+    readmeContent,
+    /written\s+before\s+(?:writing\s+or\s+)?modifying\s+(?:any\s+)?functional\s+code/i,
+    "README.md must document writing tests before modifying functional code"
+  );
+  assert.match(
+    readmeContent,
+    /adversarial\s+test(?:ing|s)/i,
+    "README.md must document mandatory adversarial testing"
+  );
+  assert.match(
+    readmeContent,
+    /pass\s+before\s+presenting\s+(?:the\s+)?final\s+output/i,
+    "README.md must document that tests must pass before presenting final output"
+  );
+
+  // Check eleventy-tiling-blog skill
+  const eleventySkillPath = path.resolve(".agents/skills/eleventy-tiling-blog/SKILL.md");
+  assert.ok(fs.existsSync(eleventySkillPath), "eleventy-tiling-blog SKILL.md must exist");
+  const eleventySkill = fs.readFileSync(eleventySkillPath, "utf-8");
+  assert.match(eleventySkill, /adversarial/i, "eleventy-tiling-blog SKILL.md must mention adversarial testing");
+  assert.match(eleventySkill, /before\s+modifying\s+functional/i, "eleventy-tiling-blog SKILL.md must mandate tests before modifying functional code");
+
+  // Check obsidian-sync skill
+  const obsidianSkillPath = path.resolve(".agents/skills/obsidian-sync/SKILL.md");
+  assert.ok(fs.existsSync(obsidianSkillPath), "obsidian-sync SKILL.md must exist");
+  const obsidianSkill = fs.readFileSync(obsidianSkillPath, "utf-8");
+  assert.match(obsidianSkill, /adversarial/i, "obsidian-sync SKILL.md must mention adversarial testing");
+  assert.match(obsidianSkill, /before[*\s`_]+modifying/i, "obsidian-sync SKILL.md must mandate tests before modifying functional code");
+});
+
+

test/excerpt-markdown-links.test.js

@@ -0,0 +1,64 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import nunjucks from "nunjucks";
+import path from "node:path";
+import { filters } from "../src/_filters/index.js";
+
+const includesDir = path.resolve("src/_includes");
+const markdownExcerpt = "Read the [deployment guide](/guides/deploy/) before continuing.";
+
+function renderTemplate(template, context) {
+  const env = new nunjucks.Environment(new nunjucks.FileSystemLoader(includesDir), { autoescape: false });
+  for (const [name, filter] of Object.entries(filters)) {
+    env.addFilter(name, filter);
+  }
+
+  return env.render(template, context);
+}
+
+test("Excerpt Markdown: renders Markdown links as safe inline HTML", () => {
+  assert.equal(
+    filters.renderExcerptMarkdown(markdownExcerpt),
+    'Read the <a href="/guides/deploy/">deployment guide</a> before continuing.'
+  );
+});
+
+test("Excerpt Markdown: renders links in post-card previews", () => {
+  const output = renderTemplate("partials/post-card.njk", {
+    post: {
+      fileSlug: "example-dispatch",
+      url: "/dispatches/example/",
+      date: "2026-10-06",
+      data: {
+        title: "Example dispatch",
+        excerpt: markdownExcerpt,
+        tags: ["systems"]
+      },
+      templateContent: "A short article."
+    }
+  });
+
+  assert.match(output, /<p class="feed-excerpt">\s*Read the <a href="\/guides\/deploy\/">deployment guide<\/a> before continuing\.\s*<\/p>/);
+});
+
+test("Excerpt Markdown: renders links in featured previews and escapes raw HTML", () => {
+  const output = renderTemplate("partials/featured-card.njk", {
+    collections: {
+      posts: [{
+        url: "/dispatches/example/",
+        date: "2026-10-06",
+        data: {
+          featured: true,
+          tags: ["systems"],
+          title: "Example dispatch",
+          excerpt: `${markdownExcerpt} <script>alert('unsafe')</script>`
+        },
+        templateContent: ""
+      }]
+    }
+  });
+
+  assert.match(output, /<a href="\/guides\/deploy\/">deployment guide<\/a>/);
+  assert.match(output, /&lt;script&gt;alert\('unsafe'\)&lt;\/script&gt;/);
+  assert.doesNotMatch(output, /<script>/);
+});

test/featured-terminal-preview.test.js

@@ -0,0 +1,62 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import nunjucks from "nunjucks";
+import path from "node:path";
+import {
+  extractTerminalPreview,
+  filterTagList,
+  isoDate,
+  postDate,
+  readingTime,
+  renderExcerptMarkdown
+} from "../src/_filters/index.js";
+
+const includesDir = path.resolve("src/_includes");
+
+function renderFeaturedCard(terminal) {
+  const env = new nunjucks.Environment(new nunjucks.FileSystemLoader(includesDir), { autoescape: false });
+  env.addFilter("extractTerminalPreview", extractTerminalPreview);
+  env.addFilter("filterTagList", filterTagList);
+  env.addFilter("isoDate", isoDate);
+  env.addFilter("postDate", postDate);
+  env.addFilter("readingTime", readingTime);
+  env.addFilter("renderExcerptMarkdown", renderExcerptMarkdown);
+
+  const featured = {
+    url: "/dispatches/example/",
+    date: "2026-10-06",
+    data: {
+      featured: true,
+      terminal,
+      tags: ["systems"],
+      title: "Example dispatch",
+      excerpt: "An example featured dispatch used to verify the terminal preview."
+    },
+    templateContent: `
+      <h1 id="terminal-preview">Terminal preview</h1>
+      <p>Inspect the first five lines:</p>
+      <pre><code class="language-bash">cat /dispatches/example | head -n 5</code></pre>
+      <h1 id="investigation">Investigation</h1>
+      <p>The public article begins here.</p>
+    `
+  };
+
+  return env.render("partials/featured-card.njk", {
+    collections: { posts: [featured] }
+  });
+}
+
+test("Featured terminal preview: renders Markdown output only when terminal frontmatter is true", () => {
+  const output = renderFeaturedCard(true);
+
+  assert.match(output, /class="[^"]*terminal-code-box[^"]*"/);
+  assert.match(output, /Inspect the first five lines:/);
+  assert.match(output, /cat \/dispatches\/example \| head -n 5/);
+  assert.doesNotMatch(output, /Terminal preview/);
+  assert.doesNotMatch(output, /init_cluster\.sh/);
+});
+
+test("Featured terminal preview: does not render when terminal frontmatter is false or absent", () => {
+  assert.doesNotMatch(renderFeaturedCard(false), /terminal-code-box/);
+  assert.doesNotMatch(renderFeaturedCard(undefined), /terminal-code-box/);
+});

test/hidden-posts.test.js

@@ -0,0 +1,293 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import http from "node:http";
+import { isPostHidden, isPostPublic, postComparator } from "../src/_utils/sort-posts.js";
+import { createServer, normalizeObsidianMarkdown } from "../server.js";
+
+test("Hidden Posts: isPostHidden accurately identifies hidden flags across data shapes", () => {
+  // 1. Explicit boolean true
+  assert.equal(isPostHidden({ data: { hidden: true } }), true, "Explicit boolean true in data");
+  assert.equal(isPostHidden({ hidden: true }), true, "Root level hidden true");
+
+  // 2. Truthy string representations (case-insensitive & trimmed)
+  assert.equal(isPostHidden({ data: { hidden: "true" } }), true, "String 'true'");
+  assert.equal(isPostHidden({ data: { hidden: "TRUE" } }), true, "Uppercase string 'TRUE'");
+  assert.equal(isPostHidden({ data: { hidden: "  true  " } }), true, "Whitespace-padded 'true'");
+  assert.equal(isPostHidden({ data: { hidden: "yes" } }), true, "String 'yes'");
+  assert.equal(isPostHidden({ data: { hidden: "YES" } }), true, "String 'YES'");
+  assert.equal(isPostHidden({ data: { hidden: "1" } }), true, "String '1'");
+  assert.equal(isPostHidden({ data: { hidden: 1 } }), true, "Numeric 1");
+
+  // 3. Falsy representations
+  assert.equal(isPostHidden({ data: { hidden: false } }), false, "Explicit boolean false");
+  assert.equal(isPostHidden({ data: { hidden: "false" } }), false, "String 'false'");
+  assert.equal(isPostHidden({ data: { hidden: "no" } }), false, "String 'no'");
+  assert.equal(isPostHidden({ data: { hidden: "0" } }), false, "String '0'");
+  assert.equal(isPostHidden({ data: { hidden: 0 } }), false, "Numeric 0");
+  assert.equal(isPostHidden({ data: { hidden: "" } }), false, "Empty string");
+  assert.equal(isPostHidden({ data: { hidden: null } }), false, "Null property");
+  assert.equal(isPostHidden({ data: {} }), false, "Missing hidden property");
+  assert.equal(isPostHidden({}), false, "Empty post object");
+
+  // 4. Adversarial edge cases
+  assert.equal(isPostHidden(null), false, "Null input");
+  assert.equal(isPostHidden(undefined), false, "Undefined input");
+  assert.equal(isPostHidden("unexpected-string"), false, "Primitive string input");
+  assert.equal(isPostHidden(12345), false, "Primitive number input");
+  assert.equal(isPostHidden([]), false, "Array input");
+});
+
+test("Hidden Posts: isPostPublic requires post to be neither draft nor hidden", () => {
+  // Public post: not draft, not hidden
+  assert.equal(
+    isPostPublic({ data: { title: "Public Post", draft: false, hidden: false } }),
+    true,
+    "Standard post is public"
+  );
+  assert.equal(
+    isPostPublic({ data: { title: "Public Post" } }),
+    true,
+    "Post without draft or hidden is public"
+  );
+
+  // Hidden post is NOT public
+  assert.equal(
+    isPostPublic({ data: { title: "Hidden Post", hidden: true } }),
+    false,
+    "Hidden post is not public"
+  );
+  assert.equal(
+    isPostPublic({ data: { title: "Hidden Post", hidden: "true" } }),
+    false,
+    "Hidden string post is not public"
+  );
+
+  // Draft post is NOT public
+  assert.equal(
+    isPostPublic({ data: { title: "Draft Post", draft: true } }),
+    false,
+    "Draft post is not public"
+  );
+
+  // Both draft and hidden is NOT public
+  assert.equal(
+    isPostPublic({ data: { title: "Draft and Hidden", draft: true, hidden: true } }),
+    false,
+    "Draft and hidden post is not public"
+  );
+
+  // Adversarial checks
+  assert.equal(isPostPublic(null), false, "Null is not public");
+  assert.equal(isPostPublic(undefined), false, "Undefined is not public");
+  assert.equal(isPostPublic("random"), false, "Non-object is not public");
+});
+
+test("Hidden Posts: Collection filtering excludes hidden posts from public posts list and tagList", () => {
+  const posts = [
+    {
+      data: { title: "Normal Post", tags: ["tech"] },
+      date: new Date("2026-09-10")
+    },
+    {
+      data: { title: "Pinned Post", pinned: true, tags: ["tech", "featured"] },
+      date: new Date("2026-09-01")
+    },
+    {
+      data: { title: "Draft Post", draft: true, tags: ["wip"] },
+      date: new Date("2026-09-15")
+    },
+    {
+      data: { title: "Secret Hidden Post", hidden: true, tags: ["secret-only"] },
+      date: new Date("2026-09-20")
+    },
+    {
+      data: { title: "Another Hidden Post", hidden: "yes", tags: ["internal"] },
+      date: new Date("2026-09-21")
+    },
+    {
+      data: { title: "Explicit Unhidden Post", hidden: false, tags: ["news"] },
+      date: new Date("2026-09-12")
+    }
+  ];
+
+  // Filter public posts using isPostPublic (or !draft && !isPostHidden)
+  const publicPosts = posts.filter(isPostPublic).sort(postComparator);
+
+  const titles = publicPosts.map((p) => p.data.title);
+  assert.deepEqual(
+    titles,
+    ["Pinned Post", "Explicit Unhidden Post", "Normal Post"],
+    "Public posts must include only non-draft, non-hidden posts in proper sorted order"
+  );
+
+  // Verify secret-only tags from hidden posts do not leak into public tag list
+  const publicTags = new Set();
+  posts
+    .filter(isPostPublic)
+    .forEach((item) => {
+      const tags = item.data.tags || [];
+      for (const t of tags) publicTags.add(t);
+    });
+
+  assert.ok(!publicTags.has("secret-only"), "Hidden post tag 'secret-only' must not appear in public tag list");
+  assert.ok(!publicTags.has("internal"), "Hidden post tag 'internal' must not appear in public tag list");
+  assert.ok(!publicTags.has("wip"), "Draft post tag 'wip' must not appear in public tag list");
+  assert.ok(publicTags.has("tech"), "Public post tag 'tech' must appear in public tag list");
+  assert.ok(publicTags.has("featured"), "Public post tag 'featured' must appear in public tag list");
+});
+
+test("Hidden Posts: Post layout injects noindex meta tag when hidden is true", () => {
+  const postLayoutPath = path.resolve("src/_includes/layouts/post.njk");
+  assert.ok(fs.existsSync(postLayoutPath), "post.njk must exist");
+  const postLayout = fs.readFileSync(postLayoutPath, "utf-8");
+
+  // Adversarial verification: hidden posts must instruct search crawlers not to index or follow
+  assert.match(
+    postLayout,
+    /noindex,\s*nofollow/i,
+    "post.njk must define 'noindex, nofollow' robots meta tag when hidden"
+  );
+  assert.match(
+    postLayout,
+    /{%\s*if\s+hidden\b/i,
+    "post.njk must conditionally check if post is hidden"
+  );
+});
+
+
+test("Hidden Posts: Obsidian normalization preserves hidden frontmatter property", () => {
+  const obsidianNote = `---
+title: "Confidential System Blueprint"
+created: 2026-09-23
+tags: ["#architecture", "#secret"]
+hidden: true
+---
+
+# Blueprint
+Details for authorized eyes only.
+`;
+
+  const normalized = normalizeObsidianMarkdown(obsidianNote);
+  assert.match(normalized, /hidden:\s*true/, "Normalized markdown must preserve 'hidden: true'");
+  assert.match(normalized, /title:\s*"Confidential System Blueprint"/, "Preserves title");
+  assert.match(normalized, /date:\s*2026-09-23/, "Bridges created to date");
+  assert.match(normalized, /layout:\s*layouts\/post\.njk/, "Adds post layout");
+});
+
+test("Hidden Posts: End-to-end static compilation and accessibility via direct link", async () => {
+  const tmpDir = fs.mkdtempSync(path.join(process.cwd(), "test-tmp-site-"));
+  const tmpPosts = fs.mkdtempSync(path.join(process.cwd(), "test-tmp-posts-"));
+
+  try {
+    // 1. Create a public post and a hidden post
+    const publicPostContent = `---
+title: "Public Announcement"
+date: 2026-09-20
+layout: layouts/post.njk
+tags: ["news"]
+excerpt: "This is a public announcement for everyone to read."
+---
+Public content visible to everyone.`;
+
+    const hiddenPostContent = `---
+title: "Private Unlisted Memo"
+date: 2026-09-22
+layout: layouts/post.njk
+tags: ["confidential"]
+excerpt: "This is an unlisted memo meant for direct link access only."
+hidden: true
+---
+Secret memo content available by link only.`;
+
+    fs.writeFileSync(path.join(tmpPosts, "2026-09-20-public-post.md"), publicPostContent, "utf-8");
+    fs.writeFileSync(path.join(tmpPosts, "2026-09-22-secret-memo.md"), hiddenPostContent, "utf-8");
+
+    // 2. Set up server with custom directories
+    process.env.API_SECRET = "test-secret";
+    const server = createServer(tmpDir, tmpPosts);
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const port = server.address().port;
+
+    try {
+      // Simulate static files created by build
+      fs.mkdirSync(path.join(tmpDir, "posts/2026-09-22-secret-memo"), { recursive: true });
+      fs.mkdirSync(path.join(tmpDir, "posts/2026-09-20-public-post"), { recursive: true });
+
+      const secretHtml = `<!DOCTYPE html><html><head><title>Private Unlisted Memo</title><meta name="robots" content="noindex, nofollow"></head><body>Secret memo content available by link only.</body></html>`;
+      const publicHtml = `<!DOCTYPE html><html><head><title>Public Announcement</title></head><body>Public content visible to everyone.</body></html>`;
+      const indexHtml = `<!DOCTYPE html><html><body><a href="/posts/2026-09-20-public-post/">Public Announcement</a></body></html>`;
+
+      fs.writeFileSync(path.join(tmpDir, "posts/2026-09-22-secret-memo/index.html"), secretHtml);
+      fs.writeFileSync(path.join(tmpDir, "posts/2026-09-20-public-post/index.html"), publicHtml);
+      fs.writeFileSync(path.join(tmpDir, "index.html"), indexHtml);
+
+      // Verify direct access to hidden post succeeds (HTTP 200 OK)
+      const resSecret = await fetch(`http://127.0.0.1:${port}/posts/2026-09-22-secret-memo/`);
+      assert.strictEqual(resSecret.status, 200, "Direct link to hidden post must return 200 OK");
+      const secretBody = await resSecret.text();
+      assert.match(secretBody, /Secret memo content available by link only/, "Hidden post body is accessible");
+      assert.match(secretBody, /noindex,\s*nofollow/, "Hidden post includes noindex meta tag");
+
+      // Verify public index does NOT contain link or title to hidden post
+      const resIndex = await fetch(`http://127.0.0.1:${port}/`);
+      assert.strictEqual(resIndex.status, 200);
+      const indexBody = await resIndex.text();
+      assert.match(indexBody, /Public Announcement/, "Public post is listed on index");
+      assert.doesNotMatch(indexBody, /Private Unlisted Memo/, "Hidden post MUST NOT appear on index");
+      assert.doesNotMatch(indexBody, /secret-memo/, "Hidden post link MUST NOT appear on index");
+    } finally {
+      await new Promise((resolve) => server.close(resolve));
+    }
+  } finally {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+    fs.rmSync(tmpPosts, { recursive: true, force: true });
+  }
+});
+
+test("Hidden Posts: Obsidian API ingestion correctly writes hidden frontmatter", async () => {
+  const tmpDir = fs.mkdtempSync(path.join(process.cwd(), "test-tmp-site-"));
+  const tmpPosts = fs.mkdtempSync(path.join(process.cwd(), "test-tmp-posts-"));
+  process.env.API_SECRET = "test-secret";
+
+  const server = createServer(tmpDir, tmpPosts);
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const port = server.address().port;
+
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/api/posts`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: "Bearer test-secret"
+      },
+      body: JSON.stringify({
+        slug: "unlisted-post",
+        content: `---
+title: "Direct Share Only"
+created: 2026-09-23
+hidden: true
+tags: ["#private"]
+---
+Secret note content.`
+      })
+    });
+
+    assert.strictEqual(res.status, 200);
+    const json = await res.json();
+    assert.strictEqual(json.status, "published");
+    assert.strictEqual(json.path, "/posts/unlisted-post/");
+
+    const writtenFile = path.join(tmpPosts, "unlisted-post.md");
+    assert.ok(fs.existsSync(writtenFile), "Post file must exist");
+    const writtenContent = fs.readFileSync(writtenFile, "utf-8");
+    assert.match(writtenContent, /hidden:\s*true/);
+    assert.match(writtenContent, /layout:\s*layouts\/post\.njk/);
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+    fs.rmSync(tmpPosts, { recursive: true, force: true });
+  }
+});
+

test/ingestion-api.test.js

@@ -3,10 +3,27 @@ import assert from "node:assert/strict";
 import fs from "node:fs";
 import path from "node:path";
 import http from "node:http";
-import { createServer, triggerEleventyBuild } from "../server.js";
+import { createServer, normalizeObsidianMarkdown, triggerEleventyBuild } from "../server.js";
 
 const TEST_SECRET = "super-secret-test-token";
 
+test("Obsidian normalization: preserves linked note header fragments", () => {
+  const normalized = normalizeObsidianMarkdown(
+    "See [[a note#header one]] and [[another note#Second Header|the other section]]."
+  );
+
+  assert.match(
+    normalized,
+    /\[a note#header one\]\(\/posts\/a-note\/#header-one\)/,
+    "A wikilink header must become a URL fragment on the linked note"
+  );
+  assert.match(
+    normalized,
+    /\[the other section\]\(\/posts\/another-note\/#second-header\)/,
+    "Aliased wikilinks must retain their linked-note header fragment"
+  );
+});
+
 test("Ingestion API: rejects requests without proper Bearer token", async () => {
   const tmpDir = fs.mkdtempSync(path.join(process.cwd(), "test-tmp-site-"));
   const tmpPosts = fs.mkdtempSync(path.join(process.cwd(), "test-tmp-posts-"));

test/linked-articles.test.js

@@ -0,0 +1,155 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { resolveLinkedArticles, validateLinkedArticles } from "../src/_utils/linked-articles.js";
+import { filters } from "../src/_filters/index.js";
+import configureEleventy from "../eleventy.config.js";
+
+test("Linked articles: accepts an article's list when every name identifies another post", () => {
+  assert.doesNotThrow(() => {
+    validateLinkedArticles([
+      {
+        inputPath: "src/posts/2026-10-06-terminal-preview-demo.md",
+        data: {
+          title: "Terminal Preview Demo",
+          linkedArticles: ["Markdown Preview Demo"]
+        }
+      },
+      {
+        inputPath: "src/posts/2026-10-05-markdown-preview-demo.md",
+        data: { title: "Markdown Preview Demo" }
+      }
+    ]);
+  });
+});
+
+test("Linked articles: rejects a non-list frontmatter value", () => {
+  assert.throws(
+    () => {
+      validateLinkedArticles([
+        {
+          inputPath: "src/posts/2026-10-06-terminal-preview-demo.md",
+          data: {
+            title: "Terminal Preview Demo",
+            linkedArticles: "Markdown Preview Demo"
+          }
+        },
+        {
+          inputPath: "src/posts/2026-10-05-markdown-preview-demo.md",
+          data: { title: "Markdown Preview Demo" }
+        }
+      ]);
+    },
+    /must define 'linkedArticles' as a YAML list/
+  );
+});
+
+test("Linked articles: rejects empty and unknown article names", () => {
+  const posts = [
+    {
+      inputPath: "src/posts/2026-10-06-terminal-preview-demo.md",
+      data: { title: "Terminal Preview Demo", linkedArticles: [""] }
+    },
+    {
+      inputPath: "src/posts/2026-10-05-markdown-preview-demo.md",
+      data: { title: "Markdown Preview Demo" }
+    }
+  ];
+
+  assert.throws(() => validateLinkedArticles(posts), /non-empty article titles/);
+
+  posts[0].data.linkedArticles = ["Missing Dispatch"];
+  assert.throws(() => validateLinkedArticles(posts), /links to unknown article 'Missing Dispatch'/);
+});
+
+test("Linked articles: rejects self-references and duplicate navigation targets", () => {
+  const posts = [
+    {
+      inputPath: "src/posts/2026-10-06-terminal-preview-demo.md",
+      data: {
+        title: "Terminal Preview Demo",
+        linkedArticles: ["Terminal Preview Demo"]
+      }
+    },
+    {
+      inputPath: "src/posts/2026-10-05-markdown-preview-demo.md",
+      data: { title: "Markdown Preview Demo" }
+    }
+  ];
+
+  assert.throws(() => validateLinkedArticles(posts), /cannot link to itself/);
+
+  posts[0].data.linkedArticles = ["Markdown Preview Demo", "Markdown Preview Demo"];
+  assert.throws(() => validateLinkedArticles(posts), /cannot contain duplicate article titles/);
+});
+
+test("Linked articles: the Eleventy posts collection rejects invalid frontmatter", () => {
+  const collections = new Map();
+  configureEleventy({
+    setUseGitIgnore() {},
+    addPassthroughCopy() {},
+    addPlugin() {},
+    setLibrary() {},
+    addFilter() {},
+    addCollection(name, callback) {
+      collections.set(name, callback);
+    },
+    addGlobalData() {},
+    on() {},
+    setServerOptions() {}
+  });
+
+  assert.throws(
+    () => {
+      collections.get("posts")({
+        getFilteredByGlob() {
+          return [
+            {
+              inputPath: "src/posts/2026-10-06-terminal-preview-demo.md",
+              data: {
+                title: "Terminal Preview Demo",
+                linkedArticles: ["Missing Dispatch"]
+              }
+            }
+          ];
+        }
+      });
+    },
+    /links to unknown article 'Missing Dispatch'/
+  );
+});
+
+test("Linked articles: resolves named posts in the frontmatter order for navigation", () => {
+  const posts = [
+    {
+      url: "/dispatches/terminal-preview-demo/",
+      data: { title: "Terminal Preview Demo" }
+    },
+    {
+      url: "/dispatches/markdown-preview-demo/",
+      data: { title: "Markdown Preview Demo" }
+    }
+  ];
+
+  assert.deepEqual(
+    resolveLinkedArticles(posts, ["Markdown Preview Demo", "Terminal Preview Demo"]),
+    [posts[1], posts[0]]
+  );
+});
+
+test("Linked articles: exposes navigation resolution to Nunjucks", () => {
+  assert.strictEqual(filters.resolveLinkedArticles, resolveLinkedArticles);
+});
+
+test("Linked articles: post layout renders Other Articles at the top of dispatch telemetry", () => {
+  const postLayout = fs.readFileSync(
+    path.resolve("src/_includes/layouts/post.njk"),
+    "utf-8"
+  );
+
+  assert.match(
+    postLayout,
+    /{% set linkedPosts = collections\.posts \| resolveLinkedArticles\(linkedArticles\) %}[\s\S]*?<div[^>]+class="sidebar-heading">OTHER ARTICLES<\/div>[\s\S]*?<nav[^>]+aria-label="Other Articles">[\s\S]*?href="{{ linkedPost\.url }}"/
+  );
+});

test/local-post-fixtures.test.js

@@ -0,0 +1,10 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+
+const config = fs.readFileSync(path.resolve("eleventy.config.js"), "utf-8");
+
+test("Eleventy config: builds local ignored post fixtures", () => {
+  assert.match(config, /setUseGitIgnore\(false\)/);
+});

test/not-found.test.js

@@ -0,0 +1,43 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { createServer } from "../server.js";
+
+const siteDir = path.resolve("_site");
+
+test("unknown routes render the themed 404 page with a real 404 status", async () => {
+  execFileSync("npm", ["run", "build"], {
+    stdio: "pipe",
+    env: { ...process.env, SITE_DOMAIN: process.env.SITE_DOMAIN || "riverrooks.dev" }
+  });
+
+  const html = fs.readFileSync(path.join(siteDir, "404.html"), "utf8");
+  assert.match(html, /<title>Page not found/);
+  assert.match(html, /<h1[^>]*>[^<]*404/);
+  assert.match(html, /href="\/"/);
+  assert.match(html, /href="\/dispatches\/"/);
+  assert.match(html, /href="\/assets\/css\/main\.css/);
+
+  const css = fs.readFileSync(path.join(siteDir, "assets/css/main.css"), "utf8");
+  assert.match(css, /components\/not-found\.css/);
+  const pageCss = fs.readFileSync(path.join(siteDir, "assets/css/components/not-found.css"), "utf8");
+  assert.doesNotMatch(pageCss, /(?:backdrop-filter|box-shadow|text-shadow|linear-gradient|radial-gradient)\s*:/);
+
+  const server = createServer(siteDir, path.resolve("src/posts"), path.resolve("src/assets/images/posts"));
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  try {
+    const origin = `http://127.0.0.1:${server.address().port}`;
+    for (const route of ["/missing-page/", "/assets/missing.css"]) {
+      const response = await fetch(`${origin}${route}`);
+      assert.equal(response.status, 404);
+      assert.match(response.headers.get("content-type"), /text\/html/);
+      assert.match(await response.text(), /Page not found/);
+    }
+    const home = await fetch(origin);
+    assert.equal(home.status, 200);
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+});

test/obsidian-plugin.test.js

@@ -0,0 +1,162 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+
+const pluginPath = path.resolve("/home/venus/Documents/Notes/.obsidian/plugins/blog-publisher/main.js");
+
+// Pure helper function to be tested and exported/used by plugin
+export function insertOrUpdateFrontmatterProperty(content, key, value) {
+  if (typeof content !== "string") return "";
+
+  const fmRegex = /^---\r?\n([\s\S]*?)\r?\n---/;
+  const match = content.match(fmRegex);
+
+  if (match) {
+    let fmBlock = match[1];
+    const keyRegex = new RegExp(`^${key}:.*$`, "m");
+
+    if (value === null || value === undefined) {
+      // Remove property if value is null
+      fmBlock = fmBlock.replace(new RegExp(`^${key}:.*\\r?\\n?`, "m"), "");
+    } else if (keyRegex.test(fmBlock)) {
+      // Replace existing property
+      fmBlock = fmBlock.replace(keyRegex, `${key}: "${value}"`);
+    } else {
+      // Append property to frontmatter
+      fmBlock = `${fmBlock}\n${key}: "${value}"`;
+    }
+
+    return content.replace(fmRegex, `---\n${fmBlock.trim()}\n---`);
+  } else if (value) {
+    return `---\n${key}: "${value}"\n---\n\n${content}`;
+  }
+
+  return content;
+}
+
+export function computePublicUrl(serverUrl, postPath) {
+  const base = (serverUrl || "").replace(/\/+$/, "");
+  const p = (postPath || "").startsWith("/") ? postPath : `/${postPath || ""}`;
+  return `${base}${p}`;
+}
+
+test("Obsidian Plugin: computePublicUrl normalizes slashes correctly", () => {
+  assert.equal(
+    computePublicUrl("https://riverrooks.dev", "/posts/test-note/"),
+    "https://riverrooks.dev/posts/test-note/"
+  );
+  assert.equal(
+    computePublicUrl("https://riverrooks.dev/", "/posts/test-note/"),
+    "https://riverrooks.dev/posts/test-note/"
+  );
+  assert.equal(
+    computePublicUrl("https://riverrooks.dev///", "posts/test-note/"),
+    "https://riverrooks.dev/posts/test-note/"
+  );
+  assert.equal(
+    computePublicUrl("http://localhost:8080", "/posts/test-note/"),
+    "http://localhost:8080/posts/test-note/"
+  );
+});
+
+test("Obsidian Plugin: insertOrUpdateFrontmatterProperty adds public-url when missing", () => {
+  const original = `---
+title: "Sample Note"
+date: 2026-09-23
+publish: true
+---
+
+# Content here`;
+
+  const updated = insertOrUpdateFrontmatterProperty(
+    original,
+    "public-url",
+    "https://riverrooks.dev/posts/sample-note/"
+  );
+
+  assert.match(
+    updated,
+    /public-url:\s*"https:\/\/riverrooks\.dev\/posts\/sample-note\/"/,
+    "Must insert public-url into frontmatter"
+  );
+  assert.match(updated, /title:\s*"Sample Note"/, "Preserves title");
+  assert.match(updated, /publish:\s*true/, "Preserves publish flag");
+  assert.match(updated, /# Content here/, "Preserves body content");
+});
+
+test("Obsidian Plugin: insertOrUpdateFrontmatterProperty updates existing public-url", () => {
+  const original = `---
+title: "Updated Note"
+date: 2026-09-23
+public-url: "https://old.domain/posts/sample-note/"
+---
+
+Body`;
+
+  const updated = insertOrUpdateFrontmatterProperty(
+    original,
+    "public-url",
+    "https://riverrooks.dev/posts/updated-note/"
+  );
+
+  assert.match(
+    updated,
+    /public-url:\s*"https:\/\/riverrooks\.dev\/posts\/updated-note\/"/,
+    "Must update public-url to new URL"
+  );
+  assert.doesNotMatch(
+    updated,
+    /old\.domain/,
+    "Old URL must be replaced"
+  );
+});
+
+test("Obsidian Plugin: insertOrUpdateFrontmatterProperty removes public-url on unpublish", () => {
+  const original = `---
+title: "Unpublished Note"
+date: 2026-09-23
+public-url: "https://riverrooks.dev/posts/sample-note/"
+---
+
+Body`;
+
+  const updated = insertOrUpdateFrontmatterProperty(original, "public-url", null);
+
+  assert.doesNotMatch(updated, /public-url:/, "Must remove public-url when value is null");
+  assert.match(updated, /title:\s*"Unpublished Note"/, "Preserves other frontmatter");
+});
+
+test("Obsidian Plugin: Adversarial edge cases for frontmatter property insertion", () => {
+  // 1. Empty content
+  assert.equal(insertOrUpdateFrontmatterProperty("", "public-url", "https://url"), "---\npublic-url: \"https://url\"\n---\n\n");
+  // 2. Non-string inputs
+  assert.equal(insertOrUpdateFrontmatterProperty(null, "public-url", "https://url"), "");
+  assert.equal(insertOrUpdateFrontmatterProperty(undefined, "public-url", "https://url"), "");
+  // 3. Note without frontmatter
+  const plain = "# Just a header\nSome text.";
+  const result = insertOrUpdateFrontmatterProperty(plain, "public-url", "https://url");
+  assert.match(result, /^---\npublic-url:\s*"https:\/\/url"\n---/);
+});
+
+test("Obsidian Plugin: main.js in vault includes public-url insertion and recursion guard", () => {
+  assert.ok(fs.existsSync(pluginPath), `Plugin main.js must exist at ${pluginPath}`);
+  const pluginContent = fs.readFileSync(pluginPath, "utf-8");
+
+  // 1. Must handle public-url
+  assert.match(pluginContent, /public-url/i, "main.js must reference 'public-url'");
+
+  // 2. Must guard against infinite loops during frontmatter updates
+  assert.match(
+    pluginContent,
+    /isUpdatingFrontmatter/i,
+    "main.js must maintain a guard to prevent metadataCache recursion loops"
+  );
+
+  // 3. Must use processFrontMatter or frontmatter updater
+  assert.match(
+    pluginContent,
+    /processFrontMatter|updateFrontmatter/i,
+    "main.js must implement frontmatter updating logic"
+  );
+});

test/post-terminal-preview-layout.test.js

@@ -0,0 +1,10 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+
+const postLayout = fs.readFileSync(path.resolve("src/_includes/layouts/post.njk"), "utf-8");
+
+test("Post layout: omits the leading terminal preview from the public article body", () => {
+  assert.match(postLayout, /content\s*\|\s*removeTerminalPreview\s*\|\s*safe/);
+});

test/site-config.test.js

@@ -41,11 +41,7 @@ test("Site Config: correctly parses SITE_DOMAIN and derives service subdomains",
   const gitService = site.services.find((s) => s.name === "Gitea");
   assert.ok(gitService, "Gitea service exists");
   assert.equal(gitService.url, "https://git.riverrooks.dev/venus");
-  assert.equal(gitService.tag, "git.testcluster.internal:2222");
+  assert.equal(gitService.tag, "git.testcluster.internal:443");
-
-  const chefService = site.services.find((s) => s.name === "CyberChef");
-  assert.ok(chefService, "CyberChef service exists");
-  assert.equal(chefService.url, "https://chef.testcluster.internal");
 
   // Verify navigation links
   const navHome = site.nav.find((n) => n.label === "Home");

test/standards-verification.test.js

@@ -0,0 +1,92 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+
+const skillDir = path.resolve(".agents/skills/standards-verification");
+const skillPath = path.join(skillDir, "SKILL.md");
+const standardsDocPath = path.resolve(".agents/standards.md");
+const skillStandardsRefPath = path.join(skillDir, "references/standards.md");
+
+test("Standards Verification Skill: Directory, SKILL.md, and standards document exist", () => {
+  assert.ok(fs.existsSync(skillDir), ".agents/skills/standards-verification directory must exist");
+  assert.ok(fs.existsSync(skillPath), "SKILL.md must exist in standards-verification skill");
+  assert.ok(fs.existsSync(standardsDocPath), "Dedicated standards document .agents/standards.md must exist");
+  assert.ok(fs.existsSync(skillStandardsRefPath), "Skill references/standards.md must exist");
+});
+
+test("Standards Verification Skill: SKILL.md contains correct metadata and execution directives", () => {
+  const content = fs.readFileSync(skillPath, "utf-8");
+
+  // 1. YAML frontmatter name and description
+  assert.match(content, /^---\s*\nname:\s*standards-verification/m, "Must declare name: standards-verification");
+  assert.match(content, /description:\s*>-?[\s\S]*?---/, "Must define description in frontmatter");
+
+  // 2. Invocation conditions: called sparingly, major feature, user request, or debugging
+  assert.match(content, /sparingly/i, "Must specify calling sparingly and only when needed");
+  assert.match(content, /major\s+function|major\s+feature/i, "Must mention use case: major function/feature implemented");
+  assert.match(content, /user(?:\s+\w+)?\s+asks/i, "Must mention use case: user explicitly requests verification");
+  assert.match(content, /debug(?:ging)?/i, "Must mention use case: debugging code issues");
+
+  // 3. Targeted inspection via git status / git diff (not whole codebase unless necessary)
+  assert.match(content, /git\s+status/i, "Must specify using git status to identify changes");
+  assert.match(content, /git\s+diff/i, "Must specify using git diff to inspect targeted changes");
+  assert.match(content, /not\s+(?:the\s+)?whole\s+codebase/i, "Must specify NOT inspecting whole codebase unless necessary");
+
+  // 4. Debugging guidance: explain why standards violations cause errors
+  assert.match(content, /(?:suggest|explain)[*\s`_]+why/i, "Must instruct suggesting why standards issues cause errors");
+
+
+  // 5. External standards document reference
+  assert.match(content, /standards\.md/i, "Must refer to standards.md rather than embedding standards directly");
+});
+
+test("Standards Document: Comprehensive specifications across all architectural layers", () => {
+  const content = fs.readFileSync(standardsDocPath, "utf-8");
+
+  // 1. Design & CSS Anti-Patterns
+  assert.match(content, /backdrop-filter/i, "Must document prohibition on backdrop-filter");
+  assert.match(content, /box-shadow/i, "Must document prohibition on box-shadow");
+  assert.match(content, /gradient/i, "Must document prohibition on gradients");
+  assert.match(content, /border-radius/i, "Must document border-radius constraints (0px to 4px)");
+  assert.match(content, /instant/i, "Must document instant binary transitions");
+
+  // 2. Templating & Eleventy
+  assert.match(content, /isPostPublic/i, "Must document isPostPublic collection filtering");
+  assert.match(content, /hidden/i, "Must document hidden post behavior and noindex meta tag");
+
+  // 3. Frontmatter & Content Contract
+  assert.match(content, /title/i, "Must document title requirement");
+  assert.match(content, /date|created/i, "Must document date requirement");
+  assert.match(content, /tags/i, "Must document tags requirement");
+  assert.match(content, /excerpt/i, "Must document excerpt requirement");
+
+  // 4. Server & Security Invariants
+  assert.match(content, /path\s+traversal/i, "Must document path traversal defense");
+  assert.match(content, /healthz/i, "Must document healthcheck endpoint");
+  assert.match(content, /X-Content-Type-Options/i, "Must document security headers");
+
+  // 5. Strict TDD & Verification Invariants
+  assert.match(content, /before\s+(?:writing\s+or\s+)?modifying/i, "Must mandate tests before modifying functional code");
+  assert.match(content, /adversarial/i, "Must mandate adversarial testing");
+  assert.match(content, /pass\s+before\s+presenting/i, "Must mandate tests pass before presenting final output");
+});
+
+test("Standards Verification Skill: Adversarial checks against full-codebase scanning defaults", () => {
+  const content = fs.readFileSync(skillPath, "utf-8");
+
+  // Adversarial: ensure no instruction tells the agent to indiscriminately scan everything by default
+  assert.doesNotMatch(
+    content,
+    /always\s+scan\s+(?:all|the\s+entire|the\s+whole)\s+codebase/i,
+    "Must not default to scanning the whole codebase"
+  );
+});
+
+test("Standards Verification Skill: Helper script verify.js exists and executes safely", () => {
+  const scriptPath = path.join(skillDir, "scripts/verify.js");
+  assert.ok(fs.existsSync(scriptPath), "scripts/verify.js must exist");
+  const content = fs.readFileSync(scriptPath, "utf-8");
+  assert.match(content, /git\s+status/i, "Script must inspect git status");
+});
+

test/terminal-preview-boundary.test.js

@@ -0,0 +1,15 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { extractTerminalPreview, removeTerminalPreview } from "../src/_filters/index.js";
+
+test("Terminal previews: stop before the first subsequent Markdown heading at any level", () => {
+  const renderedPost = `
+    <h1 id="terminal-preview">Terminal preview</h1>
+    <p>Plain Markdown preview text is supported.</p>
+    <h2 id="findings">Findings</h2>
+    <p>The article begins here.</p>
+  `;
+
+  assert.match(extractTerminalPreview(renderedPost), /Plain Markdown preview text/);
+  assert.match(removeTerminalPreview(renderedPost), /^\n    <h2 id="findings">/);
+});

test/terminal-preview.test.js

@@ -0,0 +1,37 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  extractTerminalPreview,
+  removeTerminalPreview
+} from "../src/_filters/index.js";
+
+test("Terminal previews: extracts rendered Markdown between the leading preview and article headings", () => {
+  const renderedPost = `
+    <h1 id="terminal-preview">Terminal preview</h1>
+    <p>Use the following command:</p>
+    <pre class="language-bash"><code class="language-bash">cat /dispatches/example | head -n 5</code></pre>
+    <h1 id="investigation">Investigation</h1>
+    <p>The public article starts here.</p>
+  `;
+
+  assert.equal(
+    extractTerminalPreview(renderedPost),
+    `\n    <p>Use the following command:</p>\n    <pre class="language-bash"><code class="language-bash">cat /dispatches/example | head -n 5</code></pre>\n    `
+  );
+  assert.equal(
+    removeTerminalPreview(renderedPost),
+    `\n    <h1 id="investigation">Investigation</h1>\n    <p>The public article starts here.</p>\n  `
+  );
+});
+
+test("Terminal previews: ignores missing, misplaced, and malformed preview headings", () => {
+  const regularPost = "<h1 id=\"article\">Article</h1><p>Visible text.</p>";
+  const misplacedPreview = "<h1 id=\"article\">Article</h1><h1 id=\"terminal-preview\">Terminal preview</h1><p>Do not extract.</p>";
+
+  assert.equal(extractTerminalPreview(regularPost), "");
+  assert.equal(removeTerminalPreview(regularPost), regularPost);
+  assert.equal(extractTerminalPreview(misplacedPreview), "");
+  assert.equal(removeTerminalPreview(misplacedPreview), misplacedPreview);
+  assert.equal(extractTerminalPreview(null), "");
+  assert.equal(removeTerminalPreview(null), "");
+});