Docs site: Zensical → GitHub Pages (parity with IcebergTTX/EBS)

[richardmhope]

Summary

Closes #243.

• Adds the website/ Zensical source and the sibling-identical docs.yml Pages workflow — SHA-pinned actions, least-privilege pages: write + id-token: write deploy, and zensical==0.0.50 pinned (the job holds deploy permissions, so the build tool must not float).
• Splits the oversized README into five pages: the intelligence cycle (direction → collection → analysis → production → dissemination → feedback), deployment (local / Compose+Caddy / k8s, backup-restore, config), security (OIDC, roles, TLP egress gates, hardening, audit/SIEM, supply chain), integrations (MISP, TAXII, RSS, ATT&CK, AI assist, webhooks), and a changelog snippet-included from the repo-root CHANGELOG.md (check_paths fails the build if it moves).
• Styled to the shared Iceberg design system, matching the sibling sites: the family docs stylesheet mapped onto Material (dark rail header, glacial-cyan accent, light/dark toggle), self-hosted Archivo/JetBrains Mono/Spectral derived from the app's own font sheet (static/css/vendor/fonts.css is the source of truth, URLs rewritten), the IcebergAI brand mark, and the fresh Docs: refresh all portal screenshots and the sample PDF #286 screenshot set. No CDN is contacted at view time (the mermaid-fence caveat is documented in zensical.toml).
• website/site/ + website/.cache/ gitignored; website/README.md documents the local preview and the screenshot-refresh flow.
• GitHub Pages is already enabled for the repo (build_type=workflow) — on merge, the workflow publishes to https://icebergai.github.io/IcebergCTI/.

Testing

• Built locally with the pinned zensical==0.0.50 (zensical build --clean — "No issues found") and verified in a browser via Playwright screenshots: hero + cards home page, workflow page with embedded screenshots and nav, and the dark scheme via the palette toggle.

🤖 Generated with Claude Code

[icebergai-review-bot]

IcebergAutoReview

Verdict: request_changes

The documentation site is generally well structured, but the deploy trigger can leave published content stale and one public reliability claim contradicts the implementation.

Findings

• [.github/workflows/docs.yml:9] The site embeds repository-root CHANGELOG.md, but the push path filter includes only website/** and the workflow itself. A changelog-only commit to main therefore will not rebuild or deploy the Changelog page. Add CHANGELOG.md to the trigger paths.
• [website/docs/integrations.md:10] The claim that all external work uses the durable outbox is inaccurate. The outbox covers email, publication webhooks, and RSS polling, while MISP, governed-AI, and writer-triggered inbound requests perform HTTP synchronously. Narrow this statement so operators are not given incorrect retry/durability expectations.

Validation

• Inspected the complete main...HEAD diff and affected implementation context.
• Ran git diff --check main...HEAD successfully.
• Verified all copied screenshots match their repository source images by SHA-256.
• Verified added SVGs contain no scripts, event handlers, external references, or javascript: URLs.
• Verified the documentation CSS references only bundled font assets.
• Compared dissemination/outbox claims against services/dissemination.py, services/jobs.py, services/misp.py, services/ai.py, and services/inbound.py.

Residual risks / optional notes

• The Zensical build was not rerun locally because the pinned executable is not installed and network installation was intentionally avoided; the supplied green CI baseline and author-reported local build were relied upon.

Automated review by Codex 295557be8c05 using IcebergAutoReview.

[icebergai-review-bot]

IcebergAutoReview

Verdict: approve

Both prior blockers are resolved without introducing regressions in the affected context. Changelog-only updates now trigger the Pages workflow, and the integrations documentation accurately distinguishes durable queued work from synchronous interactive HTTP calls.

Findings

• No blocking findings.

Validation

• Inspected git diff 295557b..HEAD and affected surrounding context.
• Ran git diff --check successfully on the follow-up delta.
• Verified website/docs/changelog.md includes repository-root CHANGELOG.md and the workflow path filter now covers it.
• Traced the revised queue/synchronous claims through main.py and the dissemination, jobs, MISP, AI, and inbound services.
• Confirmed HEAD is 775b0ac.

Residual risks / optional notes

• The documentation site build was not rerun locally; current-head green CI remains the authoritative broad validation baseline.

Automated review by Codex 775b0acbf4ca using IcebergAutoReview.