Built and verified a maintained Arista-stencil-only audit/status website lane in an isolated local branch, eliminating the known path, dependency, broken-link, and credential-handling risks without changing or publishing the Arista source repositories.

Arista stencil audit/status website lane

Scope and outcome

• Host: rdmsm4x only.
• Canonical website repository: /Users/richh/dev/sites/dev.dataroo.net.
• Isolated worktree: /Users/richh/dev/_worktrees/dev-dataroo-net/codex-arista-stencil-site-20260827.
• Branch: codex/arista-stencil-site-20260827.
• Commit: 48cf963b326f2290905dc224b0a9fb4a51d3e8bc.
• Base: main at 4ea83f0a185b1cb7ebb0caa88555e19f86ab270b.
• Result: local implementation complete and ownership lease released; not integrated, pushed, deployed, published, or exposed beyond loopback.
• The user-supplied /Users/richh/dev/dev.dataroo.net path did not exist. Existing fleet and project records established /Users/richh/dev/sites/dev.dataroo.net as the canonical website repository, so the new lane was created there as sites/arista-stencil-status.

Files and state changed

• Added the maintained site under /Users/richh/dev/_worktrees/dev-dataroo-net/codex-arista-stencil-site-20260827/sites/arista-stencil-status/, including the Sites/Vinext application, an explicit provenance importer, dependency lockfile, unit/render/browser tests, local hosting metadata without a hosted-site identity, and handoff/rollback/validation documentation.
• Added repository-level contract coverage at /Users/richh/dev/_worktrees/dev-dataroo-net/codex-arista-stencil-site-20260827/tests/test_arista_stencil_site_contract.py.
• Added design and implementation plans under /Users/richh/dev/_worktrees/dev-dataroo-net/codex-arista-stencil-site-20260827/docs/plans/.
• Added browser and reference evidence under /Users/richh/dev/_worktrees/dev-dataroo-net/codex-arista-stencil-site-20260827/docs/evidence/2026-08-27-arista-stencil-site/.
• Updated the worktree root README.md to index the stencil lane.
• Updated /Users/richh/Library/Mobile Documents/com~apple~CloudDocs/Codex/projects/AGENTS.md principles/PROJECTS.md with the completed local milestone and exact commit.
• Updated /Users/richh/.agent-coordination/checkins/codex-rdmsm4x-devsite-arista-stencil-site-20260827.json, marked the local lane complete and unintegrated, released ownership, and synchronized the check-in. rdmpw3265m was unreachable during sync; the other reachable fleet peers received the current check-ins.
• Created this changelog at /Users/richh/dev/LLM/Claude/changelogs/rdmsm4x-changelog-20260827-0541-arista-stencil-status-site-lane.md.

Read-only inputs and exclusions honored

• Read-only provenance root: /Users/richh/dev/lib/arista/arista_stencils at commit 31d0b98091aacbac5dabecc2fa04dce2426b47e6.
• Read-only nested status-site: /Users/richh/dev/lib/arista/arista_stencils/status-site at commit 80d884a19ab6ea0933be05cec42321a3424f9062.
• Both source repositories remained clean after the work.
• The unrelated tracked PLAN (1).md remained unchanged and was never copied into the website lane.
• No VSSX libraries, immutable Arista source assets, /Users/richh/Documents/arista_stencils, credentials, secret-bearing files, or ignored generator were changed or copied.
• The credential-shaped literal reported by PUBLISHING.md was treated only as a privacy boundary. Its value was never opened, printed, copied, or recorded.
• The importer reads only an explicit HTML/public-preview allowlist, rejects residual /Users/ paths, and rejects missing required stencil semantics. A fixture test makes a fake ignored generator unreadable to prove the import path does not access it.

Maintained website behavior

• Replaced the missing local ./build/sites-vite-plugin contract with @openai/[email protected] in a supported Vinext/Vite structure.
• Added / for Status and /audit for Audit while keeping the detailed generated reports visually dominant inside a compact maintained shell.
• Preserved the working-snapshot semantics and counts: 338 masters, 50 verified exact-source masters, 288 legacy replacements, 98 missing active faceplates, and 21 priority requests.
• Preserved separate physical and logical families, filtering, completion-state controls, CSV export, responsive behavior, and light/dark presentation.
• Removed the stale /Users/rich/Documents/arista_stencils/source_assets/arista.com path from portable output. A repository-wide public-output scan found no absolute /Users/ path.
• In hosted rendering, VSSX is explicitly identified as local-only and broken local-file actions are suppressed. Immutable VSSX content was not copied.

Dependency findings

• Revalidated the old nested status-site lockfile before changing the maintained lane. Its production graph still reported four high-severity affected nodes: Next.js 16.2.6 plus transitive PostCSS 8.5.14, Sharp 0.34.5, and NanoID 3.3.12. The old full graph reported 1 low, 4 moderate, and 16 high findings, 21 total.
• The maintained lockfile resolves Next.js 16.3.3, React 19.2.8, Vinext 1.0.0-beta.8, Vite 8.2.2, supported PostCSS/Sharp/NanoID revisions, and reports zero vulnerabilities in both production-only and full audits.
• ESLint remains on 9.39.4. The current npm registry labels that release deprecated, but a trial of ESLint 10.9.1 made the current Next.js plugin peer graph invalid. The attempted lockfile change was reverted; npm ls, lint, and both audits are clean. This is a documented maintenance watch rather than an unverified forced upgrade.
• Vinext currently labels the two routes as Unknown during build; both routes return HTTP 200 and pass production-browser tests. This informational classification is recorded in validation documentation.

Commands run and verification evidence

• scutil --get ComputerName, fleet topology and coordination reads, repository status/branch/worktree inspections, and peer inbox/check-in inspection established host, owner, canonical root, dirty state, and isolation before mutation.
• /Users/richh/dev/fleet/maintenance/scripts/fleet_checkin_sync.zsh synchronized the completion lease to reachable peers.
• /usr/bin/python3 -m unittest discover -s tests -v: 34 tests passed.
• npm ci: 507 packages installed; 508 packages audited; zero vulnerabilities.
• npm test: snapshot import plus unit/render verification; 6 tests passed.
• npm run lint: passed with no errors or warnings.
• npm run test:browser: production build plus four Google Chrome scenarios passed. Coverage includes Status and Audit routes, exact metrics, filters, completion state, CSV export, responsive mobile layout, dark presentation, absence of broken VSSX actions, and zero captured console errors, page errors, hydration errors, or loopback request failures.
• npm audit --omit=dev --audit-level=high: zero vulnerabilities.
• npm audit --audit-level=high: zero vulnerabilities.
• npm ls --depth=0: clean dependency tree.
• Public-output privacy scan: 3 public text files examined; zero absolute user paths and zero credential assignments.
• Staged-content scan before commit: 404 staged files, 32 text files, zero secret-pattern suspects, zero PLAN (1).md, VSSX, or .env files.
• git diff --check, post-commit git diff HEAD --exit-code, and post-commit status checks passed; branch is clean at the commit above.
• Browser runtime used local Google Chrome 152.0.7977.65. Toolchain observed: Node.js 24.19.0 and npm 11.18.0.

Provenance evidence

• Snapshot manifest: /Users/richh/dev/_worktrees/dev-dataroo-net/codex-arista-stencil-site-20260827/sites/arista-stencil-status/public/snapshot/manifest.json.
• Imported status HTML: 216,542 bytes; SHA-256 5f7639f0ae4e95421e5efb7fb32f482c50366887efaf4303c9ed17b96d2b9942.
• Imported audit HTML: 231,933 bytes; SHA-256 94e4f5db7c41f7f417bd537c23d253ecb9f179ff395be84ad1af917fc02330e9.
• Imported public-preview asset set: 369 files, 42,066,290 bytes; tree SHA-256 f21ddb9f1ec06e0cd8c6ed5098c501f6b52a2d5dfd41fabbb61f058328dee7aa.

Backup and rollback

• No destructive migration or overwrite occurred, so no content backup was required. The existing canonical main checkout and all of its pre-existing dirty/untracked user files remained untouched.
• The complete result is isolated by Git at commit 48cf963b326f2290905dc224b0a9fb4a51d3e8bc, with base commit 4ea83f0a185b1cb7ebb0caa88555e19f86ab270b as the pre-change reference.
• Before integration, rollback is to remove the linked worktree and local feature branch only after confirming no new local delta and obtaining owner approval for deletion.
• After any future integration, rollback is a normal revert of the integration commit; do not rewrite published history.
• Detailed steps are in /Users/richh/dev/_worktrees/dev-dataroo-net/codex-arista-stencil-site-20260827/sites/arista-stencil-status/docs/ROLLBACK.md.

Outstanding owner actions

• Choose whether to merge the local branch, keep it isolated, or separately authorize a push/PR.
• Deployment, publication, site-identity assignment, public/private access changes, external communications, and pushes remain explicitly unapproved.
• Revisit the ESLint 10 peer-dependency transition and Vinext route-classification message when their upstream dependency graph supports a clean upgrade.