Rationale
Dependencies must earn their place.
The stack is semantic HTML, modern CSS, and a small vanilla JavaScript module. There is no runtime framework, package manager, design system, analytics SDK, remote font, or third-party script standing between a visitor and the content.
JavaScript only enhances what already works: mobile navigation, reveal transitions, the small site note, and the 404 interaction. Navigation, project content, Field Notes, and the routes back out remain available without it.
Accessibility and performance are baseline work.
Landmarks, heading structure, keyboard focus, touch targets, readable contrast, responsive layouts, and reduced-motion support are designed in rather than bolted on. Images have dimensions to avoid layout shift; below-the-fold galleries are deferred until they are needed.
What CI can actually check.
A dependency-free validator checks structure, internal links, resource hosts, accidental disclosure patterns, the site budget, and the document CSP. GitHub Actions runs it on changes. It is a guardrail, not a substitute for review.
Headers have limits on GitHub Pages.
The site uses a restrictive document-delivered Content Security Policy. It constrains resource loading and reduces the impact of a markup or script-injection mistake, while keeping the site’s small attack surface small. GitHub Pages controls HTTP response headers, so this site does not claim response-header CSP, X-Frame-Options, HSTS, or Permissions-Policy it cannot verify.