feat(site): accessible searchable OVK resource explorer (static preview)

[fraware]

Objective

Build a serious, approachable, responsive public-facing interface for Open Verification Kernel focused on maximum discoverability, honest verification scope, and cross-repository reuse. The baseline repository has no existing frontend or GitHub Pages site, so this is a new, static website candidate, not a claim of modifying an already deployed service.

No verification-kernel or trust-chain source is changed. This independent draft is branched from main@79370539ca9b26a0a6b01f6ac6ab6923243f40f4, not stacked on unreleased drafts #225–#228. No automatic deployment or release permission is added.

Product experience

• Clean, restrained brand/UI with responsive layouts, consistent typography, accessible contrast/focus, semantic landmarks, reduced-motion support and mobile navigation.
• Instant searchable index of 51 real repository resources (guides, checkers, architectural specs, research, evidence, templates, examples, and release/trust documentation). Search across title/description/path/curated keywords, ranked with all-term matching, immediate top-four result suggestions, count, empty state, topic filters and pagination.
• Keyboard: Ctrl/⌘+K or / focus, ArrowDown moves to the first suggestion, Escape clears, Enter focuses the first result. Query and category preserved in the URL where the browser permits history updates.
• Real links to source files, explicit distinction between public main resources and two unpublished development documents linked by exact feat(product): package source-scoped advisory PR summary for reuse #228 candidate SHA 837c931d059f74dcda06432d83f5bde759f53d0a. No fake browser search index or constructed verifier output.
• Three-step verification mental model; copyable local advisory development workflow; prominent release-status guidance and human-review boundaries.
• No backend, CDN, external fonts, cookies, analytics, credentials, GitHub write token, or live source uploads. The site executes no verification.

Quality and reproducibility

• Local desktop (1440px) and mobile (390px) Chromium/Playwright smoke runs passed. These exercise search ranking/suggestions, no-results recovery, keyboard shortcuts, copy interaction, navigation, mobile layout (zero horizontal overflow), and absence of JS exceptions. Screenshot snapshots were visually inspected during development and corrected after a 752px mobile overflow was discovered.
• New read-only site-quality.yml runs on site changes and checks JavaScript syntax plus a dependency-free Node resource contract.
• site/tests/catalog_contract.mjs enforces indexed source-file existence, allowed categories, no duplicated paths, draft link identity, safe DOM text handling and accessibility landmarks.
• site/README.md describes local preview, testing, indexing scope and release/deployment restrictions.

Explicit boundaries / no-go

1. The site is not deployed. GitHub Pages is currently disabled. Deploying it, selecting a domain, providing security/privacy policy, and granting publication authority are separate maintainer-controlled decisions.
2. It is a curated source-navigation index, not search across all 1,600+ project files, not a real-time evidence search API, and not an interactive verification service.
3. A passing check is always scoped. This UI never converts an allow finding into permission to merge or a signed security certificate.
4. Draft verification documents are identified as drafts and source-pinned; refresh these references explicitly on merge/change, instead of silently redirecting to a mutable or nonexistent main path.
5. Repository governance issue Release blocker: protect main and v* release tags before v1.3.0-rc.1 #25, independent source-model security review, external calibration and a human pilot remain unchanged. Do not imply their closure because the website looks professional.

Review checklist

• Keyboard-only path from search to a real linked document; no inaccessible UI controls.
• Inspect desktop/mobile at 320/390/760/1024/1440px, and with 200% zoom/reduced-motion.
• Open each indexed path (or run node site/tests/catalog_contract.mjs) and verify editorial descriptions against source documents.
• Challenge all inferred marketing claims; current docs/CURRENT_RELEASE_STATUS.md is the controlling publication reference.
• Confirm no hidden diff/source transfer, analytics or cookies.
• Review hosting/deployment policy separately, after site UX and independent technical review.

Status: draft / not deployed / not a release.

[fraware]

Independent UX/accessibility review entry point — 17 Oct 2026

Exact website candidate: 59be60c89c1382a9bcc01b73994846d60cac9b23. Dedicated site-quality, CI and Repro jobs all passed; no submitted independent review. See launch review protocol #230, reviewer B (unfamiliar user and accessibility) and reviewer C (public statements/hosting provenance).

Audit the actual user journey at 320px mobile and desktop: an unfamiliar developer opens the site, searches authorization, secrets, or evidence reuse, distinguishes a released capability from an unmerged development draft, follows a valid result, understands its limits, and finds a safe local onboarding path. Verify keyboard-only and screen-reader navigation, no-results and stale-link handling, responsive overflow, contrast/focus, data-collection statements, trust warnings, and all 51 curated resource refs.

The site is a static resource explorer, not a live verification/evidence search service, and it does not issue certificates. GitHub Pages is disabled. Approving UI for integration is not an authorization to host publicly. Provide exact SHA, real test observations, issues, and a submitted GitHub review; keep PR draft/unmerged until protected release governance is active.