apps/marketing — Jekyll Static Site

Runs on Vercel (framework=jekyll), fronted by Cloudflare. Public content only.

Rules

No secrets, no service_role, no privileged auth logic. This is a fully public, statically-generated site. The only “auth” awareness allowed is reading a non-sensitive .webglo.org cookie to relabel nav (do NOT call a portal API on every page view).
Headers/CSP live in apps/marketing/vercel.json, NOT in _headers (that file is a dead Cloudflare Pages artifact — editing it does nothing on prod).
Build artifacts: assets/css/main.css and assets/js/site.min.js are generated by npm run build:css / build:js (Vercel runs these on deploy). Edit assets/js/site.js, never site.min.js (it’s gitignored and regenerated).
Performance budget (see docs/reviews/2026-07-01-codebase-review.md): no runtime 3D libs for decoration; lazy-load video/heavy media; optimized/sized images; honor prefers-reduced-motion.
Inline <script> is discouraged — the CSP still allows unsafe-inline, but the goal is to remove it (security F11), so don’t add new inline scripts.

May NOT import from apps/portal/** or workers/**. Cross-app links are URLs, not imports.

Data in _data/*.yml, includes in _includes/, layouts in _layouts/. Blog in _posts/.
Legal pages: the .md file is the live content (/policy/); the small .html twin is a legacy-URL redirect stub (/policy.html → /policy/) — keep both.