feat(portfolio): showcase live MingleStage Early Access

content/projects.json

@@ -1,5 +1,39 @@
 {
   "projects": [
+    {
+      "name": "MingleStage",
+      "slug": "minglestage",
+      "descriptionKo": "친구들이 같은 3D 공간에 모여 영상을 함께 보고 리액션을 나누는 브라우저 기반 워치파티 서비스. 캐릭터·좌석·공개/비공개 방·DJ 재생 제어·다국어 UI를 갖춘 무료 얼리 액세스를 운영 중입니다.",
+      "descriptionEn": "A browser-based 3D watch-party space where friends sit together, watch permitted video and react in real time. Free early access includes avatars, venues, public/private rooms, DJ playback controls and EN/KO/JA UI.",
+      "techStack": [
+        "TypeScript",
+        "React",
+        "Three.js",
+        "Colyseus",
+        "WebSockets",
+        "Docker",
+        "Playwright",
+        "Vite"
+      ],
+      "status": "launched",
+      "website": "https://minglestage.app",
+      "private": true,
+      "featured": true,
+      "updatedAt": "2026-10-17",
+      "screenshot": "/images/projects/minglestage.webp",
+      "screenshotAltKo": "MingleStage의 실제 Black Box 3D 관람 공간. 여러 캐릭터가 좌석에 앉아 스크린을 함께 바라보고 리액션합니다.",
+      "screenshotAltEn": "Actual MingleStage Black Box 3D room with characters seated together, facing a shared screen and reacting.",
+      "caseStudy": {
+        "problemKo": "단순 동시 재생에서는 친구가 곁에 있는 공간감과 모임 운영 흐름이 약했습니다.",
+        "problemEn": "Basic watch synchronization lacks a sense of shared place and an intuitive flow for hosting a small screening.",
+        "decisionKo": "웹 브라우저에 3D 좌석·캐릭터 리액션을 구현하고, 역할별 재생 제어와 방 초대 링크·공개 가입·다국어 안내를 결합했습니다. 운영은 Web/Realtime 분리, 불변 이미지, 사용자 연결 보호와 백업 검증으로 관리합니다.",
+        "decisionEn": "I combined a browser 3D venue, seats and avatar reactions with role-based playback, room invitations, open signup and multilingual guidance. Deployment separates Web and Realtime with immutable images, connection safeguards and verified backup.",
+        "evidenceKo": "2026년 10월 17일 최신 Web을 운영에 배포했습니다. 8개 합성 클라이언트의 재생 상태·권한·재접속 테스트, 실제 WebKit 로그인 가독성 검사, CI와 분산 HTTPS 확인을 수행했습니다. 이 증거는 실제 8명이 함께 영상을 본 검증과 구분됩니다.",
+        "evidenceEn": "The current Web was deployed on October 17, 2026, with isolated eight-synthetic-peer media-state and reconnect checks, real WebKit-engine sign-in contrast QA, CI and distributed HTTPS reachability probes. These tests do not imply eight humans verified audiovisual sync.",
+        "resultKo": "실제 공개 도메인에서 무료 얼리 액세스를 사용할 수 있고, 새 사용자의 입장·영상 시작·피드백을 중심으로 개선을 이어가는 단계입니다.",
+        "resultEn": "Free early access is live on the public domain. The next product cycle focuses on real users' entry, first playback and feedback rather than treating synthetic QA as human adoption."
+      }
+    },
     {
       "name": "Soursea",
       "slug": "soursea",

docs/reviews/2026-10-18-minglestage-portfolio-security.md

@@ -0,0 +1,24 @@
+# Portfolio MingleStage featured-card dependency security follow-up
+
+2026-10-18 PDT. Candidate: writingdeveloper/portfolio PR #38, branch codex/minglestage-portfolio-launch-20261017.
+
+## Why
+MingleStage Early Access case study and genuine optimized 3D venue screenshot are implemented but not public on writingdeveloper.blog. The unrelated existing portfolio build ran every functional step successfully; its pre-existing high/critical npm audit alerts blocked PR #38. Do not represent this as a product runtime issue on minglestage.app.
+
+## Remediation implemented in this isolated PR worktree
+- Upgrade Next.js and eslint-config-next to 16.4.2 (previous lock was 16.3.3, inside the critical advisory range).
+- Upgrade sharp to 0.35.5 and source-map-js to >=1.2.2.
+- Restrict transitive brace-expansion versions under minimatch 3, 9, and 10 to patched minimums without forcing incompatible major versions.
+- Fresh npm install updated lockfile, with subsequent npm ci dry-run matching the lockfile.
+
+## Local independent checks on patched worktree
+- npm run type-check PASS; npm run lint PASS; npm run format:check PASS; npm test 198/198 PASS.
+- Next 16.4.2 production build PASS, all 138 static routes/paths generated. This validates app compilation, NOT exposure safety.
+- npm audit --audit-level=high **STILL REPORTS 7 HIGH AND 0 CRITICAL** (previous lock: 10 high and 1 critical). The remaining high findings are @keystatic/next -> chokidar 3 -> braces 3.0.3 and eslint-config-next -> fast-glob -> micromatch -> braces 3.0.3. Installed upstream braces 3.0.3 remains flagged by npm audit, with no safe direct published patch available in the observed dependency range.
+- This is a real improvement in a review candidate, NOT zero security findings and NOT a production deployment.
+
+## Follow-up decisions
+1. Continue PR #38 security review with the existing Keystatic boundary/retention review on PR #33. A compatibility breaking @keystatic/next downgrade from npm audit fix --force is not acceptable without migration and production QA.
+2. Never rewrite or disable the full npm audit gate to make CI pass. A deliberate, documented security-risk exception would be a separate owner decision; no exception is granted by this report.
+3. Keep MingleStage marketing's already-published public GitHub profile link and MingleStage landing/guide live while the portfolio PR waits.
+4. Do not close PRs #32, #33, #35, #39 or overwrite parallel session worktrees. New integration should reconcile those PRs only after vulnerability and build compatibility review.