feat(website): publish the podling site from website/

[Astro-Han]

Summary

maka.apache.org still returns 404, and #4307 settled what the site should say without giving it anywhere to live. This PR adds the site and the path that publishes it, following the OpenDAL layout described in #3404.

• website/ is an Astro workspace on the root lockfile. One English and one Chinese page share a single Copy type, so a section, claim or link added to one language fails to type-check until the other has it too; test/site.test.mjs checks the built HTML for the Incubator disclaimer, the ASF footer, the [DISCUSS] Rebuild the Maka website and project narrative #4307 positioning sentence, identical link sets across languages, and no third-party loads.
• The homepage is direction D from the vote in [DISCUSS] Rebuild the Maka website and project narrative #4307 (Astryx Centered Hero): one turn of RuntimeEvents in the hero (appended one by one on first view, gated on prefers-reduced-motion), a bento with the Terminal-Bench leaderboard, the paired run, the Runtime Host and the log, the three download paths kept separate, and cards for the two blogs and two reports. Numbers are drawn from docs/eval/ and link there. Tokens are the desktop app's defaults; fonts are Geist and Geist Mono self-hosted from the @fontsource-variable packages the app already depends on, with each package's OFL text published under /licenses/; the logo is the README's sky.png.
• /downloads/ is shaped like OpenDAL's and laid out like the Astryx technical-docs template: a status table up top, then Apache releases (none yet, and the page says so), verification steps with KEYS, .asc and SHA-512, Desktop Nightly and building from source, each labelled, with copyable code blocks and a sticky outline that tracks the section in view.
• The root / sends visitors to /en/ with an immediate meta refresh (Astro's generated redirect page waits two seconds). Under 900px the site links fold into a menu at the right of the top bar, built from the same list, so every page stays reachable on a phone. The top bar has a light/dark toggle; the site follows the OS scheme until a choice is made, and the choice is remembered in that browser.
• The ASF links the website policy requires (Foundation, License, Events, Privacy, Security, Sponsorship, Thanks) plus Incubator and Code of Conduct render as one list in the nav's ASF menu and in the footer; the site test asserts each URL on every page. The footer also carries the Apache Incubator logo (the ASF's published file, unedited, linking to incubator.apache.org), the Incubator disclaimer and the copyright and trademark line, the last two in English on both languages.
• .github/workflows/website.yml builds the site and force-pushes the output plus LICENSE, NOTICE and a site-only .asf.yaml (publish: whoami: asf-site, staging: autostage: site/*) as an orphan commit: asf-site on a push to main touching the site, site/<tag>-staging on a release-candidate tag, or site/<name>-staging from workflow_dispatch. A dispatch without a stage name publishes only from main and fails on any other ref. No third-party action is added; the push uses the job token through an extra header.
• The ASF header policy learns .astro files (frontmatter fence, then the block comment) and records why the footer copy may carry the ASF copyright line.
• Astro is pinned to 7.2.10: 7.3.0 imports astro/_internal/logger, which its own exports map does not expose, so every build that uses astro:assets fails.

Nothing is copied from the old maka-agent.github.io draft. Docs, Security, Community and Architecture stay where they live; the site links to them.

Refs #3404, #4307

Home, light and dark:

Chinese homepage and the downloads page:

Downloads in Chinese, dark, and at phone width:

Phone and tablet widths:

Verification

• npm --workspace @maka/website run test:dist: 5 pages built, 5/5 checks pass.
• npm run check:asf-headers: every source file carries the header or a reviewed exclusion.
• node --test scripts/ci-workflow-policy.test.mjs scripts/ci-test-plan.test.mjs scripts/asf-license-headers.test.mjs scripts/script-entrypoints.test.mjs: 119/119 pass. The planner selects website as a standard workspace for changes under website/, so pull requests build the site through ci.yml.
• npm run format and npm run lint: clean.
• Rendered at 1280, 820 and 390 px in both colour schemes with no horizontal overflow, no console errors, and both Geist faces loaded from the site itself.
• npm run build then npm run check:release: pass. The first CI run failed here because adding the workspace re-resolved zod from 4.4.3 to 4.5.4; the third-party notices are regenerated in the second commit.
• Not run: the publish step itself, which can only run from main. After merge I will dispatch the workflow with stage=preview and check maka-preview.staged.apache.org before relying on asf-site.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code drafted the site, the workflow, the tests and this description from the #4307 consensus and the D mock voted on there. I reviewed the copy, the numbers against docs/eval/, and the publication mechanics against the asfyaml reference.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[yihanzhu]

Took a pass at the homepage as a first-time visitor and it reads as a lot of text for what the data can already show. Screenshots below, PR head on the left, my branch on the right (yihanzhu/maka claude/maka-site-visualization-a5637f, one commit rebased on f252434, diff).

Three changes: the hero steps are named in plain words instead of RuntimeEvent types (Text / FunctionCall means nothing to someone landing here); the claims are drawn instead of described (pass@1 vs cost per pass as a scatter, head-to-head as two bars, plus Maka's pass rate by task difficulty, all computed from docs/eval at build time); and the explanatory paragraphs go where a figure carries them. The reading cards lead with a one-line takeaway instead of a formula or a bare number.

I dropped the Runtime Host and log tiles since the hero scene already shows one recorded turn; that's the part I'd most like your call on, since you just animated it. Happy to send this as a follow-up after merge or you can cherry-pick whatever you want.

Hero:

Bento:

Reports and writing:

Full page, light and dark:

[Astro-Han]

Thank you for taking the first-time visitor's pass, and for doing it as a working branch with side-by-sides rather than a list of asks. That made it easy to judge each piece on its own.

Taken now, in this PR (7aa7743): the hero events are named in plain words in both languages, and the high-water line reads as what the model still sees. You were right that type names have no business on the first screen; they stay in the log tile, where the term is explained.

Pushing back on the charts. The direction is right, and computing from docs/eval at build time beats hand-copied numbers. Two problems with this version, though. The pass-rate-by-difficulty panel is a result the site would be the only source for; the site can present what the reports established, but the analysis has to live in docs/eval first. And the two-column layout with the scatter and the difficulty bars loses the alignment the bento had: rows no longer line up and the page reads busier than before. Visual cleanliness is the bar we hold the homepage to, ahead of how much it shows. If you want to take another pass after merge, a single figure that keeps the grid would be where I'd start.

Pushing back on dropping the Runtime Host and log tiles. Those two are the architecture the project is built around, and the log is the piece we are investing in most over the coming months. Direction D in #4307 was voted with them below the fold, and the hero shows one turn only as an example of what the log records. They stay.

I'd like to merge this PR as the voted direction plus the fixes from review, and take anything further as the follow-up you offered.

[jackwener]

I reviewed exact head 3dceeba838f5659281952d5b411e2b13a9eb9162. One P2. Not approving — checks are still running on this head, and a site launch is a human's call.

The ASF-facing side of this is in good shape, and that is the part these launches usually get wrong. The Incubator disclaimer is quoted verbatim and both language builds use the English original, as the branding requirements ask. The site name carries (Incubating) and the brand block renders it beside the mark. The trademark line names Apache Maka, Apache Incubator, Apache and the feather logo. Downloads point at downloads.apache.org/incubator/maka/ with apache-maka-<version>-incubating-src.tar.gz, alongside the GPG and SHA-512 verification steps, and the page states plainly that no Apache release exists yet. The Desktop Nightly row links to GitHub Releases and is labelled NOT AN ASF RELEASE — that is the distinction this kind of page most often blurs.

License headers are covered too: asf-license-headers.mjs gains .astro with the header inside the frontmatter fence, every new website file carries one, and the two files that legitimately quote the ASF copyright line are recorded in reviewedProvenance with a written reason.

P2 — below 900px the site has no navigation at all

website/src/styles/site.css hides the whole primary nav in @media (max-width: 900px):

@media (max-width: 900px) {
  .nav .links {
    display: none;
  }

.nav .links is the entire nav — docs, downloads, benchmarks, community, security and the ASF menu. Nothing replaces it. There is no menu toggle in Site.astro (its only <button> is the theme switch), and the footer carries just the disclaimer, the trademark line and the Incubator link.

What survives on a narrow viewport is whatever the page body happens to link. The home page links downloads in three places and a few docs pages, so downloads stays reachable — but security and community become unreachable, on a project where the security page is the documented route for reporting a vulnerability.

It is also not only a visual matter: display: none removes those links from the accessibility tree, so a screen reader at that width does not encounter them either. They are absent, not merely hidden.

Whether this blocks the launch is a judgement about the audience, so it is a P2 rather than a request to hold. A menu toggle is the usual answer; the cheaper one, if this is meant to ship now, is to give the footer the same links it already has room for.

Confirmed on this head

The publish workflow now refuses to publish anything but main to asf-site: with no stage input and a ref that is not refs/heads/main, the target step fails with an explicit message instead of force-pushing the current branch to the live site. Earlier revisions of this PR did not have that guard.

Not covered

package.json and package-lock.json change here, and I have not established whether that can affect dependency resolution for existing workspaces. That matters because the test job has been failing on the Runtime Host case owned Host exits promptly after its first connection closes, and this PR touches no runtime-host file. A recent main run failed in the same step on a different case, which points at pre-existing instability in that suite rather than at this branch — but the lockfile is the one path by which this PR could genuinely reach it, and I am not claiming that path is clear. Checks were still running on this head when I posted.

简体中文

我审的是 3dceeba838f5659281952d5b411e2b13a9eb9162。一条 P2。 不批准——这个 head 上的检查还在跑,而且站点上线该由人来定。

ASF 这一面做得很到位,而这恰恰是这类上线最常出错的地方。Incubator disclaimer 逐字引用,中英两个构建都用英文原文(品牌要求如此)。站名带 (Incubating),品牌区把它显示在标识旁边。商标行点名了 Apache Maka、Apache Incubator、Apache 和羽毛标志。下载指向 downloads.apache.org/incubator/maka/,包名 apache-maka-<version>-incubating-src.tar.gz,并给出 GPG 与 SHA-512 验证步骤,页面也明说尚未发布任何 Apache release。Desktop Nightly 一行指向 GitHub Releases,并标注 NOT AN ASF RELEASE——这正是这类页面最常含糊的地方。

License header 也是齐的:asf-license-headers.mjs 增加了 .astro(header 放在 frontmatter 围栏内),新增的网站文件都带了,两个确实要引用 ASF 版权行的文件在 reviewedProvenance 里有书面理由。

P2:900px 以下,站点没有任何导航。

website/src/styles/site.css 在 @media (max-width: 900px) 里把整条主导航 display: none。.nav .links 就是导航全部——文档、下载、评测、社区、安全和 ASF 菜单。没有任何东西替代它:Site.astro 里没有菜单开关(唯一的 <button> 是主题切换),页脚只有 disclaimer、商标行和 Incubator 链接。

窄屏下还能到达的,只剩页面正文碰巧链到的地方。首页正文有三处链到下载、还有几个文档页,所以下载仍可达——但安全页和社区页变成不可达,而安全页正是这个项目文档规定的漏洞报告入口。

这也不只是视觉问题:display: none 会把这些链接从无障碍树中移除,所以该宽度下屏幕阅读器同样遇不到它们。它们是不存在,而不是仅仅看不见。

这条要不要拦下上线,是关于受众的判断,所以我给 P2 而不是要求暂停。常规解法是加一个菜单开关;如果打算现在就上线,更便宜的做法是让页脚也带上这几个链接——那里本来就有空间。

在这个 head 上确认过的:发布 workflow 现在拒绝把 main 以外的任何东西发到 asf-site——不带 stage 输入、且 ref 不是 refs/heads/main 时,目标步骤会带明确报错失败,而不是把当前分支强推到线上站点。这个 PR 更早的修订版本没有这道守卫。

没有覆盖到的:这次改了 package.json 和 package-lock.json,我没有确认这是否会影响既有 workspace 的依赖解析。这一点要紧,因为 test 一直挂在 Runtime Host 的 owned Host exits promptly after its first connection closes,而这个 PR 一个 runtime-host 文件都没碰;最近一次 main 的失败也在同一步骤,但挂的是另一条用例,这更像该套件本身既有的不稳定,而不是这个分支造成的——但 lockfile 是这个 PR 唯一可能真正触及它的路径,我并不声称这条路径已经排除。我发布时,这个 head 上的检查仍在运行。

---

Automated review notice: This comment was posted by an automated review agent operated by jackwener. It is not an independent human review and does not replace one.

[M4n5ter]

Reviewed current head faa1e060941efedfcb38ed4004c3a96b05fba7f1. The new responsive menu closes the earlier narrow-screen navigation gap: at 390 px I can reach the summary by keyboard, open it, and reach Docs, Downloads, Benchmarks, Community, Security, and Get Maka. The main-only production guard, branch-local ASF staging configuration, Incubator identity/disclaimer, release-vs-Nightly wording, bundled font licenses, and static build also check out.

P2 — the static-site toolchain is classified as a product production dependency

website/package.json puts Astro and both font packages in dependencies. Because website is a root workspace, npm now treats the entire site builder as part of the repository's production tree: comparing the lockfiles shows 281 packages newly classified as production, including Astro, Sharp, Esbuild/Rolldown bindings, and platform-specific native packages. A direct npm ls --omit=dev on this head includes @maka/website -> astro -> sharp.

That classification is observable outside the website workflow. The dependency and product-release workflows run root npm audit --omit=dev specifically as their production-dependency gate, so a vulnerability in a build-only website compiler can now block Desktop/CLI product releases even though none of that code ships in those products. The full dependency/signature audit already covers build-time tooling separately.

Please make the three website packages devDependencies, as they are only used to generate static files, or add an explicit tested boundary if the project intentionally wants the website compiler to govern the product production audit.

P3 — the five copy controls have the same accessible name

The Downloads page renders every command control as <button>Copy</button>. Its accessibility tree therefore contains five indistinguishable buttons named “Copy”; a screen-reader button list gives no way to tell whether a control copies keys, signature verification, checksum verification, clone, or build commands. Give each button a step-specific aria-label (and update it while the visible text says “Copied”).

Local evidence on this head: website build/tests 7/7, release-contract tests 192/192, workflow/header tests 119/119, lint and formatting green, clean merge tree against current main. Hosted checks were still running when this review was posted, so this is a comment rather than an approval.

---

Automated review notice: This comment was posted by an automated review agent operated by M4n5ter. It is not an independent human review and does not replace one.

[hqhq1025]

Reviewed exact head bac0d35b00077aa42ded8982cb1ff943d261b687. One new P2.

I independently reproduced the production-dependency P2 and duplicate accessible-name P3 already reported in review 5104740319; both remain on this head, so I am not duplicating those comments. The compact menu itself does restore Docs, Downloads, Benchmarks, Community, Security, and Get Maka at 360px and 390px.

The remaining responsive boundary is still incorrect: the new compact menu only activates through 900px, while the English desktop navigation needs about 1005px. The inline comment has the exact reproduction.

Verification on this revision and its clean synthetic merge with current main (ab7b739260375028ca220a1c00b062630a4ec1a1): website build/tests 7/7; repository build:test passed after applying the repository's dependency patches; focused Runtime Host capability tests 20/20; third-party notices and ASF header checks passed; Zod remains resolved to 4.4.3. Hosted test, Linux packaging, and Windows packaging were still running when this review was submitted.

Conclusion: the narrow-screen repair is correct at phone widths, but the responsive solution is not complete until the breakpoint follows the actual navigation width. No production-code deletion, low-value test deletion, or deeper refactor is required; add a boundary viewport regression. The revision is not ready to merge while the existing P2/P3 and the new overflow P2 remain. This PR changes public website publication and product dependency-audit behavior, so it still requires independent human review.

---

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

[Astro-Han]

Thanks, all three taken on a917af4f8d:

• Production dependency tree (M4n5ter, confirmed by hqhq1025): Astro and the two font packages are devDependencies now. npm ls --omit=dev no longer lists astro, sharp or @fontsource-variable/*, so the npm audit --omit=dev gates in the release and nightly workflows are back to the shipped closure. The lockfile diff is the dev flags plus the manifest key.
• Compact-menu breakpoint (hqhq1025): the English row needs about 1000px including page padding, so the menu now takes over at 1024px and below. Verified in a browser: no horizontal overflow at 901, 1000 and 1024; the full row from 1025 in both languages. I did not add a browser-level viewport assertion: the website workspace's tests run on the built HTML under node --test alone, and a browser in that job for one breakpoint seemed disproportionate. Happy to add one if the PMC would rather have it.
• Copy buttons (M4n5ter): each carries an aria-label naming its step, for example "Copy: Step 2: Check the signature", updated while the visible text reads "Copied". A site test asserts five distinct names per language.

[hqhq1025]

Reviewed exact head a917af4f8d1c0d963a96e06b9e3afc3c9e25490c. No remaining P0-P3 findings in the three follow-up fixes.

The full PR adds the bilingual Astro podling site, its static publication workflow, downloads and ASF-policy content, theme/navigation behavior, and the website workspace. This revision specifically addresses the three findings from the prior reviews:

• website/package.json:12 now classifies Astro and both font packages as development dependencies. The lockfile marks the site-only closure accordingly. On both the exact head and its clean synthetic merge with current main (7ab2a432328c040e5ab4e8aeec23fb51aeb1f3c5), npm ls --omit=dev no longer contains Astro, Sharp, or the font packages; npm audit --omit=dev reports zero vulnerabilities.
• website/src/styles/site.css:1089-1096 switches to the compact menu through 1024px. I exercised the built English site at 360, 390, 720, 901, 1000, 1024, 1025, and 1280px: every viewport had scrollWidth === clientWidth; the compact menu exposed Docs, Downloads, Benchmarks, Community, Security, and Get Maka through 1024px; the complete desktop row fit from 1025px.
• website/src/components/Downloads.astro:83,105,123-132 gives each copy control a step-specific accessible name and updates that name with its visible state. In Chromium, the five English names were distinct; a successful click changed the first control to Copied: Step 1: Import the release managers’ keys, then restored the original name after the timeout. website/test/site.test.mjs:63-72 also checks five distinct names in both languages.

Verification: exact-head website build and output tests 8/8; changed-file Biome check; third-party notice and ASF header checks; git diff --check; clean current-main merge tree c549ff800f6eaaec20c28bb4b57d116d9a612b98; and full repository build:test on that synthetic merge all passed. Zod remains resolved to 4.4.3. Hosted audit, packaging, platform-owner, recovery, and CLI validation checks are green; the hosted test check is still running.

I did not independently exercise native Windows or macOS browser rendering. This is a COMMENTED technical re-review, not an approval; the public-site launch still needs independent human review and the remaining hosted check to finish.

---

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.

[jackwener]

Approving at exact head a917af4f8d1c0d963a96e06b9e3afc3c9e25490c. No P0 or P1, and all three findings from my earlier comment are closed.

The narrow-viewport navigation is fixed. The breakpoint moved to 1024px and a menu now carries what the bar drops: measured computed styles show links visible at 1200px and 1025px, replaced by the menu at 1024px and 900px, with docs, downloads, benchmarks, community and security all inside it. Keyboard focus reaches them.

The production dependency boundary is fixed, and I can now close the question I left open. Astro and both font packages moved to devDependencies. Measured on the real lockfile: the root production-only tree drops from 983 edges to 568, with Astro, Sharp and the fonts gone; excluding the now-empty @maka/website leaf, that tree is identical to the merge base — 567 edges, zero package or version differences. npm audit --omit=dev reports no vulnerabilities, and the production classification falls from 534 packages to 362. The site compiler no longer sits inside the product's release gate.

My earlier comment said I had not established whether the lockfile could affect dependency resolution for existing workspaces, and named that as the one path by which this PR might reach the failing Runtime Host case. That is now settled: it cannot. Between the merge base and this head the lockfile adds 194 entries and removes none; among pre-existing entries only two things change — the root gains the website workspace, and @napi-rs/wasm-runtime moves 1.1.6 → 1.2.3. That package is a dev/optional WASM fallback consumed by Storybook, Knip and the new Astro compiler, and it is not on the Runtime Host path. Every other package's version, tarball, integrity and dependency map is untouched, and the Runtime Host suite is 1655 pass / 12 skip on this head.

The copy buttons are fixed, including the state I would have missed. Each of the five now carries an accessible name naming its step, and show() updates the visible text and the aria-label in the same tick, so the name follows the button into "Copied" and back rather than going stale. Observed in a real browser: Copy: <step> → Copied: <step> → Copy: <step>, with all five names distinct in both language builds.

The ASF-facing material is unchanged from my first pass and still correct: verbatim Incubator disclaimer in both builds, (Incubating) in the site name and brand block, the full trademark line, downloads pointed at downloads.apache.org/incubator/maka/ with GPG and SHA-512 steps, the Nightly row marked NOT AN ASF RELEASE, and license headers covering the new .astro files with the two ASF-copyright quotations recorded as reviewed provenance.

On checks: audit, package, package-linux and windows_recovery are green on this head; test was still running when I posted. This approval covers the review gate only — branch protection still requires that job to pass before anything can merge, so nothing here bypasses it. If test comes back red on this head, this approval should not be read as covering it.

Evidence boundary: the dependency-tree, lockfile and browser measurements above were run against this head; I did not personally execute them, and I have no Wayland or Windows machine to check the platform-specific claims elsewhere in this PR.

简体中文

在 a917af4f8d1c0d963a96e06b9e3afc3c9e25490c 上批准。没有 P0/P1,我先前评论里的三条也都已关闭。

窄屏导航修好了。 断点移到 1024px,并且有一个菜单承接了导航栏收起的内容:实测计算样式显示 1200px 与 1025px 下链接可见,1024px 与 900px 下改由菜单承载,文档、下载、评测、社区、安全都在其中,键盘焦点可以到达。

生产依赖边界修好了,而且我可以就此关闭先前留下的那个问题。 Astro 和两个字体包都移到了 devDependencies。在真实 lockfile 上实测:root 的 production-only 依赖树从 983 条边降到 568 条,Astro、Sharp 和字体都不在其中;排除现在为空的 @maka/website 叶子后,该树与 merge base 完全一致——567 条边,零 package/版本差异。npm audit --omit=dev 报告无漏洞,生产分类从 534 个包降到 362 个。网站编译器不再位于产品发布门禁之内。

我先前的评论写过:尚未确认 lockfile 是否会影响既有 workspace 的依赖解析,并指出那是本 PR 唯一可能触及那条失败的 Runtime Host 用例的路径。现在这一点确定了:不能。 从 merge base 到这个 head,lockfile 新增 194 条、删除 0 条;既有条目中只有两处变化——root 增加了 website workspace,以及 @napi-rs/wasm-runtime 从 1.1.6 升到 1.2.3。后者是 dev/optional 的 WASM 回退实现,消费者是 Storybook、Knip 和新的 Astro 编译器,不在 Runtime Host 路径上。其余每个 package 的版本、tarball、完整性校验和依赖映射均未改动,而 Runtime Host 套件在这个 head 上是 1655 通过 / 12 跳过。

复制按钮修好了,包括我原本会漏掉的那个状态。 五个按钮现在各自带有点名其步骤的可访问名称,并且 show() 在同一拍里同时更新可见文字与 aria-label,所以名称会跟着按钮进入「已复制」再回来,而不是停在旧值。真实浏览器观测:复制: <步骤> → 已复制: <步骤> → 复制: <步骤>,中英两个构建里五个名称都各不相同。

面向 ASF 的部分与我第一轮所见一致,仍然正确:两个构建都逐字引用 Incubator disclaimer,站名与品牌区都带 (Incubating),完整的商标行,下载指向 downloads.apache.org/incubator/maka/ 并附 GPG 与 SHA-512 步骤,Nightly 一行标注 NOT AN ASF RELEASE,license header 覆盖了新的 .astro 文件,两处引用 ASF 版权行的文件也已记录为经审查的来源。

关于检查:这个 head 上 audit、package、package-linux、windows_recovery 都是绿的;我发布时 test 仍在运行。本批准只覆盖审查门禁——分支保护仍然要求该任务通过才能合并,所以这里没有绕过任何东西。如果 test 在这个 head 上最终变红,不应把本批准理解为涵盖了它。

证据边界:上述依赖树、lockfile 与浏览器测量都是针对这个 head 跑的,但不是我本人执行;本 PR 中其它与平台相关的主张,我没有 Wayland 或 Windows 机器可以核。

---

Automated review notice: This comment was posted by an automated review agent operated by jackwener. It is not an independent human review and does not replace one.

[hqhq1025]

Reviewed exact head 1afee2369ac3c83cd06bf68f560f552ece08e923. No remaining P0-P3 findings.

This revision rewrites the previously reviewed website tree onto base 7ab2a432 and separates the three fixes into their own commits. Its tree is exactly c549ff800f6eaaec20c28bb4b57d116d9a612b98, byte-identical to the current-main synthetic tree validated in my preceding review, so the rewritten history does not introduce a content delta.

I independently rechecked the three fixes on that exact tree:

• website/package.json:12 keeps Astro and the two font packages in devDependencies. Both the exact tree and the latest-main synthetic merge exclude Astro, Sharp, and the fonts from npm ls --omit=dev; npm audit --omit=dev reports zero vulnerabilities.
• website/src/styles/site.css:1089-1096 uses the compact menu through 1024px. Chromium at 360, 390, 720, 901, 1000, 1024, 1025, and 1280px found no horizontal overflow; all six destinations are present in the compact menu, and the full row begins at 1025px.
• website/src/components/Downloads.astro:83,105,123-132 gives all five copy controls distinct step-specific accessible names and keeps each name synchronized through Copy → Copied → Copy. The built-output regression at website/test/site.test.mjs:63-72 passes for both languages.

Latest-main freshness was checked separately. The head merges cleanly with current main 69598adfb933851f205ea36bfa49622ba0bc96f1; the synthetic tree is 201f04bac4db4e2884ce8410837a608a4513d8d4. On it, clean install, full repository build:test, website build/output tests 8/8, dependency audit, third-party notices, ASF headers, changed-file Biome, and git diff --check pass. The intervening main commits touch Eval, Runtime, and Storybook paths, with no overlap in the PR-owned files.

The implementation is proportionate to the three defects. I found no production code or tests that should be deleted, and no deeper refactor is required. Hosted test and Windows package were still running at publication, so branch protection remains the final gate. I did not independently exercise native Windows or macOS browser rendering.

Automated review notice: This comment was posted by an automated review agent operated by hqhq1025. It is not an independent human review and does not replace one.