feat(portfolio): reconcile source evidence and refresh 2026 projects and UX

[writingdeveloper]

Summary

This draft integrates existing 4080 MAIN local portfolio work with GitHub main rather than rewriting the site from scratch. It is stacked on security draft #33 (fix/next-security-lockfile-20261011), so the Next.js/lockfile fix must pass its separate audit gate first.

• Preserved the original 36 dirty/untracked portfolio paths; snapshot into isolated worktree portfolio-reconcile-20261011. Reconciled five content/test merge conflicts against current GitHub main 689354e.
• Combined accurate AI/agent-systems positioning with later revenue-facing Hire and Creator OS case studies, avoiding a "fully remote only" claim.
• Preserved previously QA'd, dated versioned résumé PDF snapshots and evidence manifest, plus bilingual engineering article; no unsourced test, customer, revenue, or shipped-product claims.
• Added RailForge, Project STRATA and Music / MV Studio as private/building research entries, each with bilingual problem/decision/evidence/result sections. Never represent them as publicly launched.
• Updated home first viewport with readable résumé, AI pipeline and selected-work CTAs, added above-fold email and résumé shortcuts on Hire, larger mobile nav targets, concise cards and tech chips, shortened project-list JSON-LD while full case-study descriptions remain available.

Verified locally on 4080 MAIN, October 11 PT

• Clean npm ci after integrating Next.js 16.4.0.
• TypeScript, ESLint, Prettier: PASS.
• Vitest 228/228 PASS (23 files).
• Evidence/resumé byte/hash checks PASS; translation parity 11/11; Next.js 16.4.0 optimized production build PASS.
• Chromium EN/KO × 1440/390px × dark/light matrix 8/8 PASS, including above-fold contact links and all three résumé PDF SHA-256 checks. Both EN and KO navigation suites PASS.
• Preview /en/projects/railforge, /project-strata, /music-mv-studio, home, Hire and machine-readable routes returned 200. No unexpected browser/network assertion failures.
• Read-only performance lab captured in ignored .qa/portfolio/performance-20261011.json; public /en/projects uncompressed HTML 509,187 bytes and candidate 484,503 bytes. Different hosts/builds/compression and inventories; no field performance or deployment gain claimed.
• Screenshots and persisted machine QA report: local ignored .qa/portfolio/. Review notes: docs/reviews/2026-10-11-live-site-refresh-audit.md.

HARD RELEASE BLOCKER — do not auto-merge or deploy

GitHub draft #33 inherits the unpatched braces High vulnerability (GHSA-vfj7-8cjw-p6xm); npm audit still returns nonzero. No compatible upstream patched version verified, and npm audit fix --force is unsafe for Keystatic. See docs/reviews/2026-10-11-next-braces-dependency-gate.md. Neither audit nor production rollout is complete.

Additionally, résumé content and updated project evidence require editorial/security review before public release, particularly because the public production PDF URL currently returns HTTP 404. Deployment and post-deploy MIME/hash/link verification remain FOLIO-36, not part of opening a draft PR.

Plane: FOLIO-34, FOLIO-36, FOLIO-45 security gate, FOLIO-46 curation, FOLIO-47 UX, FOLIO-48 performance.

No force-push, GitHub main merge, or Vercel production deployment was performed here.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
portfolio	Ready	Preview	Oct 14, 2026 2:29am UTC

[writingdeveloper]

Linux GitHub CI read-back (2026-10-11 PT): Run 38205649337 has completed. PASS: checkout, clean npm ci, TypeScript, ESLint, Prettier, unit tests, evidence and résumé integrity, EN/KO translation parity, hero media verification, optimized production build, browser installation, production-preview Chromium QA, and QA evidence preservation. FAIL (sole remaining gate): strict dependency security audit for the pre-existing unpatched braces advisory GHSA-vfj7-8cjw-p6xm inherited from draft PR #33. Keep this PR draft and unmerged; do not bypass the audit or claim that Vercel production was updated. Local candidate QA report and performance lab are on MAIN PC, and Plane FOLIO-45/46/47/48 and FOLIO-36 track release work.

[writingdeveloper]

Follow-up on 2026-10-12 PT — AI usage itself is now table stakes. Pushed commit 29b8919 to this draft PR.

Source-backed positioning, not an AI-tool slogan

• The 2026 Stack Overflow survey reports widespread coding-assistant use and conditional trust in verifiable outputs (see https://survey.stackoverflow.co/2026/ai/data/ai-trust; survey respondents, not the whole job market). Editorial rationale: docs/research/2026-10-12-ai-commoditization-positioning.md.
• Home now places two pinned, dated, explicitly scoped evidence snapshots (DevDeck candidate validation and citefirst's 46-question retrieval benchmark) ahead of selected work, with links to the case study and immutable source. No new performance or business metrics were invented.
• Hire now shows scope/decision → measurable verification → ship or deliberately block, linked to actual DevDeck, citefirst and Creator OS cases. EN/KO + SEO copy distinguishes public links, prototypes and actual releases; ledger no longer calls every listed destination a "LIVE" commercial product.
• Added five regression tests and browser checks requiring the two pinned records, source/limitation links, and three method case-study links.

Final local QA on MAIN 4080 / Next.js 16.4.0: clean source state, TypeScript/ESLint/Prettier PASS, 233 unit tests / 24 files PASS, evidence and 3 résumé hashes PASS, EN/KO 11/11 post parity, production build PASS, Chromium EN/KO × desktop/mobile × dark/light 8/8 PASS, both navigation suites PASS. Screenshots reviewed under ignored .qa/portfolio/ai-evidence-20261012. See docs/reviews/2026-10-12-ai-era-portfolio-qa.md.

Still blocked: npm audit --audit-level=high nonzero, 7 High findings from upstream unpatched braces; latest registry version observed 3.0.3. The security issue is tracked by FOLIO-45 and draft #33. No audit bypass, risk acceptance, GitHub main merge, or Vercel production deployment is claimed. Keep this PR draft until those gates and résumé/privacy review are resolved.

[writingdeveloper]

GitHub Linux CI read-back for the AI-era positioning commit 29b8919 (2026-10-12 PT): run 38226265444 is finished. Passed: clean npm ci, TypeScript, ESLint, Prettier, 233 unit tests, evidence and three résumé PDFs, EN/KO translation parity, media verification, Next.js production build, Playwright browser installation, EN/KO desktop/mobile/light/dark preview QA, and QA artifact preservation. Vercel also reports a successful PR preview deployment, which is not the production site. Only failing CI step: dependency audit, still reporting the unpatched braces High advisory (registry version 3.0.3). Draft #33/#34 remain unmerged; no audit suppression or security risk exception. Public https://writingdeveloper.blog/resume/Sihyeong-Lee-Resume.pdf still returns 404 as of this read-back, so do not claim the portfolio or PDF fix has been released. Planes FOLIO-49 (AI differentiation QA), FOLIO-45 (security), FOLIO-36 (production release) have separate status gates.

[writingdeveloper]

New source-backed engineering incident case study shipped to draft PR #34 at commit a99a68f05105da2245d534681080b082aa23dce6 (2026-10-12 PT).

Why this case matters when AI coding is common: It demonstrates user-visible failure reproduction, state authority design, persistence-before-acknowledgement, stale-writer conflict behavior, and measurable QA, not model/tool-name proficiency.

• Chosen incident: DevDeck viewer rename reached host runtime but did not update the host's visible title/sidebar on historical baseline b781754. Historical three-app test timed out at the first UI convergence assertion. Root cause: renderer ignored LOCAL_MACHINE_ID label announcements; prior tests only inspected runtime.
• Fix is source-pinned at DevDeck fa88648, with review, host transaction and three-Electron-app harness.
• Independently reran on Windows MAIN (2026-10-12): 20/20 focused unit tests, 8/8 actual Electron host + two-viewer loopback TLS journeys, 0 recorded QA errors. Real fixture-only host before/after screenshots are published as small, labeled crops excluding local machine paths. The historical baseline test was not rerun today.
• Added fully bilingual in-page #failure-investigation with before/after, repro steps, root cause, three design changes, exact test commands, eight checks, limits and six pinned source/CI links. Home evidence and Hire link straight to it.
• Added 6 source/evidence regression tests. Current portfolio: 239/239 Vitest tests, TypeScript, ESLint, Prettier, evidence/resumé hashes, translation parity, Next.js production build all pass. Local Chromium EN/KO desktop/mobile/dark/light 8/8 PASS, added EN/KO DevDeck incident checks verify screenshots and links, and EN/KO navigation PASS.
• Evidence ledger and limitations: docs/reviews/2026-10-12-devdeck-incident-case-study.md.

Release gates remain: This DevDeck 1.37.8 is a validated unreleased candidate, not two physical PCs or multi-day field tests. PR #33's upstream braces audit is still unpatched; portfolio PR #34 remains draft. No security-audit bypass, approved exception, GitHub main merge or production Vercel release in this change.

[writingdeveloper]

Final CI read-back for commit 5fe338e1e156ec53cf8eb024376124e10dc05be2 (2026-10-12 PT): GitHub Actions run 38324959256 completed. PASS: clean npm ci, TypeScript, lint, formatting, 239 unit tests, evidence/résumé hashes, translation parity, hero images, production build, Playwright browser install, production-preview browser QA (including both EN/KO DevDeck #failure-investigation images and six pinned links), and QA evidence upload. The only failing step remains Audit dependencies because of the previously documented unresolved upstream braces High advisory. Vercel reports successful PR preview deployment, not public production. Local DevDeck source at fa88648 separately passed 20 focused tests and eight real Windows 3-Electron-app journeys; it is an unreleased candidate and historical baseline failure was recorded 2026-09-08. FOLIO-50 remains QA, FOLIO-45 security and FOLIO-36 publication remain open; keep PRs #33/#34 draft. No audit suppression, security risk acceptance, merge or production release.

[writingdeveloper]

2026-10-13 PT production audit + verified content-refresh readback for commit dc7cf1b.

Source findings and precise edits

• Reviewed Vercel public origin, MAIN/Notebook/GitHub source, 50 existing Plane FOLIO work items and dated production release QA. Public main still has all three résumé PDFs at HTTP 404; their MIME and SHA-256 pass only in the candidate. No public deployment was performed.
• BRAIN//VAT now has an October 13 verified /npc live link, a small actual production-Chromium screenshot and an explicit deterministic single-NPC/no-LLM/no-training boundary. Evidence from BVAT-37 shows 200/200 tests and desktop/mobile production browser QA; original implementation commit is pinned in content/verified-demos.json.
• Creator OS entries now explicitly identify one product: restricted Google Testing-only external pilot + anonymous public demo (real YouTube read-only consent separately authorized) versus the Release Engineering case. Do not confuse with unrestricted paid signup or LLM-powered reporting. Personal Soursea desktop is separated from the LLC's customer product catalogue.
• Other projects: 48 ledger entries, 36 lacking independently verified updatedAt (left unknown instead of inventing dates). MingleStage early-access inclusion and Studio current canonical multi-modal case remain deferred until their own runtime and privacy gates (new Plane work items).
• Added a repeatable read-only public link scanner: npm run audit:public-links and optional --all-projects. Production-facing targets 56 checked, 52 reachable, 3 actual internal 404 PDFs, Kindling intermittently timed out. After retries Kindling returned HTTP 200 once; do not call it permanently down. Candidate localhost preview: 56/56 responded; full project-catalogue sweep: 146 tested, 145 reachable, one external Kindling timeout. Beware dynamic Next.js non-existing project routes can return HTTP 200 with robots noindex (soft404); functional browser assertions remain necessary.

Validation and release gate

• Local final branch: TypeScript/ESLint/Prettier, 244/244 Vitest tests (26 files), evidence/résumé checks, 11/11 bilingual posts, optimized Next 16.4 build (148 static-generation tasks), 8 EN/KO × desktop/mobile × light/dark browser journeys, DevDeck incident EN/KO, real NPC and Creator pilot links/limits, and 3 local résumé SHA checks PASS. Original MAIN 36 dirty paths preserved; candidate worktree clean.
• Linux GitHub CI run 38484585719 completed: all functional/build/browser QA and QA artifact steps PASS; the ONLY failing step is dependency audit of unpatched braces via Keystatic/Chokidar. No audit bypass, forced incompatible downgrade or risk acceptance.
• Vercel reports successful draft PR preview deployment for dc7cf1b; this is not writingdeveloper.blog production. Remain Draft fix(deps): Next.js security refresh with repaired npm lockfile #33 (security) → Draft feat(portfolio): reconcile source evidence and refresh 2026 projects and UX #34 (content) → FOLIO-36 human/editorial/résumé review + controlled release/live PDF hash/CTA/rollback.

Detailed evidence: docs/reviews/2026-10-13-portfolio-refresh-audit.md. Plane issue work: FOLIO-51 link health/In Progress, FOLIO-52 canonical Studio review/Todo, FOLIO-53 MingleStage early-access evidence gate/Todo; FOLIO-45/36 unchanged release blockers.

[writingdeveloper]

Integrated security base and current release-candidate read-back (2026-10-13 PT), head 22169588190d12b37ced3e6d76025ca803b4ae1b: Merged security PR #33 Chokidar4-scoped override (from 2a4973e) and resolved the CI workflow conflict preserving BOTH original bilingual Playwright preview QA and new production + full audit gates. Fresh isolated npm ci on Windows, TS/lint/format, 248/248 tests / 27 files, 11/11 EN/KO posts, résumé PDF evidence SHA checks, Next.js 16.4.0 production build, npm audit --omit=dev --audit-level=high 0 reported vulnerabilities. Browser preview on localhost: eight EN/KO×desktop/mobile×dark/light checks, DevDeck incident, BRAIN//VAT NPC, Creator pilot and all 3 PDFs PASS; both locale navigation suites PASS. GitHub Linux CI 38501237311 likewise passed all functional/browser and production security audit steps; the sole failing step is the strict full dependency audit (5 High dev-only braces through ESLint). Vercel PR preview deployment SUCCESS but actual writingdeveloper.blog production remains unchanged, basic résumé remains HTTP 404. Separate draft #37 contains isolated 3-PDF/Hire-button hotfix based on old main and needs exact PDF editorial approval; do not merge blindly or ship old main with Next Critical advisory. Remain DRAFT; full-audit and human content approval gates FOLIO-45/36/51.