@@ -17,7 +17,16 @@ permissions:
   actions: read
 
 concurrency:
-  group: deploy-cloudflare-${{ inputs.target || 'site' }}
+  # Every Test run that completes starts this workflow, including pull request
+  # runs and cancelled main runs. Their deploy job skips, but a run in the
+  # deploy group still replaces the run waiting there. On 2026-10-07 a pull
+  # request's run cancelled the queued deploy of #526, so main stayed
+  # undeployed. Only a successful main push can deploy, so every other run
+  # takes a group of its own.
+  group: >-
+    ${{ (github.event_name == 'workflow_run' && (github.event.workflow_run.event != 'push' || github.event.workflow_run.conclusion != 'success'))
+    && format('deploy-cloudflare-noop-{0}', github.run_id)
+    || format('deploy-cloudflare-{0}', inputs.target || 'site') }}
   # A deploy in flight must finish. This workflow applies D1 migrations and then
   # deploys the signer and public Worker, then runs smoke and rollback. Cancelling
   # between those steps leaves migrated data against the previous Worker.
@@ -85,8 +94,10 @@ jobs:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
 
+      # Retries a transient Cloudflare API fault, such as code 10013. Any other
+      # failure stops the job at once.
       - name: Deploy Artifact signer
-        run: pnpm --filter @skilld/artifact-signer-worker deploy:production
+        run: pnpm production:deploy-signer
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
 
@@ -49,6 +49,10 @@ These exact strings. Do not paraphrase them per page.
 | Demo provenance | {Agent logo} {model}, such as Opus 5.5 | guidance only: the recording line on the Skill page panel and the homepage stage. Screen readers and the title get "Recorded with {agent}, {model}". No date and no GitHub link: the Skill page is where visitors inspect a Skill |
 | Demo outdated | Recorded on an older version of this Skill. | guidance only: under the Demo panel when the Skill moved past the recorded commit |
 | Home section: changes | Keep up with skill changes. | guidance only: the homepage section heading for watching and the digest |
+| Home section: why | What skilld does differently. | guidance only: the homepage Why band heading, after trending. No line under it: the three columns from `HOME_WHY_REASONS` follow directly, each a title, `summary`, and picture. Their skills.sh lines stay on `/vs/skills-sh` |
+| Why trust line | Built by Harlan Wilton · Compare with skills.sh | guidance only: the line that closes the homepage Why band. The avatar and name link Harlan's GitHub, and the button opens `/vs/skills-sh`. The columns carry every claim, so the line carries none |
+| Why reasons | Human first · Preview the output · Independent and open source · Open trending weights · No more skill bloat · Know what it runs · Know what it costs · No telemetry | guidance only: the reason titles. Each has a one-line `summary` for the homepage and a full `line` for the comparison. The homepage shows the first three, which Harlan chose on 2026-10-07. `WHY_REASONS` in `app/utils/why-skilld.ts` holds each title, its line, and the sourced skills.sh line, and both surfaces read it. The Preview line opens with the Demos line above. Open trending weights links the ranking code, so its weights must match `shared/trending-skill-score.ts`. Know what it runs never claims a Skill is safe |
+| Comparison H1 | skilld vs skills.sh | guidance only: the `/vs/skills-sh` H1. Its lead says what skills.sh is before what skilld is. Every skills.sh fact carries its source link and the date it was checked |
 | Home section: authoring | Write a skill for your project. | guidance only: the homepage section heading for making a Skill |
 | Nav: developers | Developers | guidance only: the header menu trigger, and the group label in the mobile menu. The menu holds the four items below |
 | Nav: CLI | CLI · Search, run, install, and keep Skills current. | guidance only: the first compact row in the Developers menu: name, line. Links `/cli`. The mobile menu shows the name only. The line is the CLI line, so change that first |
@@ -66,7 +70,7 @@ These exact strings. Do not paraphrase them per page.
 | CLI claims line | Open-source CLI · No telemetry · 19 Agent targets | guidance only: the `/cli` claims line. The page counts the `--agent` values of `skilld install --help` |
 | CLI install label | Install the CLI | guidance only: the label beside the CLI install chip on `/cli`. A switch above the chip picks `macOS / Linux`, `Windows`, or `npm`, and `macOS / Linux` is preselected |
 | CLI install consequence | One native binary. It upgrades itself from signed releases. · Needs Node.js. npm handles upgrades. | guidance only: the line under the CLI install chip on `/cli`. The first is for `macOS / Linux` and `Windows`, the second for `npm`. `crates/skilld-command/src/upgrade.rs` in the CLI decides both. If it changes, change these strings |
-| Claim: open source | open-source CLI | guidance only: the CLI. Never call skilld.dev or its site open source |
+| Claim: open source | open source | guidance only: the CLI and the site. `skilld-dev/skilld` and `skilld-dev/skilld.dev` are both public under MIT, checked 2026-10-07. If either repository goes private, narrow the claim to the one a reader can clone. "No telemetry" still names the CLI only |
 | Claim: telemetry | no telemetry | guidance only: the CLI. Its README states that it sends no telemetry or analytics. Never say it of the site, which keeps anonymous analytics |
 | Claim: privacy | analytics without cookies or IPs | guidance only: analytics and privacy copy. Never the bare "privacy-friendly" |
 | Claim: comparison | skills.sh alternative | guidance only: always a link to `/vs/skills-sh` |
@@ -147,6 +151,16 @@ Each status shows a title, then a detail line:
 
 Found Skills replace the search results under the heading `Skills for this task`, with the line `A language model picked these from a few searches of the registry.`
 
+### Behavior readings
+
+The Skill behaviors panel shows a behavior reading under each SKILL.md match that needs approval. GLOSSARY.md defines the term and ADR-0016 the mechanism.
+Name the model plainly, as a language model. Never call a reading a review, a scan, a safety call, or a false positive.
+The strings live in `layers/registry/app/components/_SkillBehaviors.vue`.
+
+- Each match: `SKILL.md:42 · Quoted example. {reason}`. `behaviorVerdictLabel` in `shared/behavior-readings.ts` owns the five labels: `Instruction`, `Quoted example`, `Prohibition`, `Documentation`, `Unclear`.
+- Panel note, shown when a match has a reading: `A language model read each match that needs approval in its context. Its reading is no guarantee and changes no approval.`
+- The skilld CLI approval message adds `(model reading: quoted example. {reason})` to each match, and ends its list with `A language model on skilld.dev wrote each model reading. A reading is no guarantee and changes no approval.` The CLI owns that string, so change it there first.
+
 ## Discord digest
 
 The weekly card uses `Trending skills this week` as its title and links to the trending page.
@@ -225,7 +239,6 @@ near-miss is also banned.
 | people (for our audience) | dev, devs | They are developers, and "people" is a vaguer word doing a smaller job. "Developers" in full is fine where the short form reads clipped |
 | first person in a CTA | the content, then the destination | "We send this every Monday" spends the words on us. "Trending skills to your inbox every Monday" gives the reader both things that matter |
 | privacy-friendly (bare) | analytics without cookies or IPs | A bare privacy claim cannot be checked. The mechanism can |
-| open source (for the site or skilld.dev) | open-source CLI | A reader must be able to clone what the claim names, and the claim names the CLI |
 
 **Exception, the humans-versus-generated claim.** When the contrast is authorship by a human
 against machine generation, "human" and "person" are the right words and "dev" weakens the
 
@@ -347,6 +347,9 @@ Rules for every texture:
 | Skill | Name, then owner, then the curator note or the curator count |
 | Collection | Name, description, curator, then the curator note or the first Skills |
 | Curator | Avatar, name, handle with counts, description, then the first Skills |
+| Demo | The demo's picture under a band: the lockup, then "What /{name} made" and the recording line. Its own frame, below |
+
+**Demo card.** A demo page shares what the Agent made, so its card is a picture first, and `OgLayout` does not frame it. `OgImage/Demo.takumi.vue` puts the film's poster frame, or the page's first screen, in a window that fills the card below a band. The band has the lockup on the left. On the right, it has "What /{name} made" and the recording line. It has no Braille names field: the picture is the content. Rose inside the picture is depicted content, so the lockup's dot stays the card's one rose element.
 
 ### Motifs
 
 
@@ -33,6 +33,7 @@ Shared terms match the skilld CLI glossary (`skilld-dev/skilld/GLOSSARY.md`). Th
 | skilld token | `cli_tokens`, `layers/identity` | Author 1—N token | "skilld token" |
 | provenance | Skill detail, cards | Skill 1—1 author and source link | "written by", "source" |
 | behavior | `skilld-protocol/behaviors`, Skill page | Skill 1—N behavior | "Skill behaviors" |
+| behavior reading | `behavior-review` check result, Skill page, skilld CLI | behavior match 1—1 behavior reading | "model reading" |
 | Skillgen | `workers/skill-harness`, `/skillgen` | Repository 1—N pull request | "Skillgen" |
 | task search | search box, `layers/registry` | sentence 1—N Skill | "Find skills for this task" |
 
@@ -228,6 +229,18 @@ Existing route paths, table names, and protocol fields keep their identifiers.
 
 **Never:** permission, capability, risk, threat, scan result, "safe", "secure". No match never means the Skill does nothing.
 
+### behavior reading
+
+**Is:** a language model's reading of one match of a behavior marked "Needs approval": what the matched line does where it stands, as one of five verdicts, with a reason of at most 20 words. The `behavior-review` check result carries the readings of one Artifact. See ADR-0016.
+
+**Verdicts:** Instruction, Quoted example, Prohibition, Documentation, Unclear.
+
+**Use for:** the line under a match in the Skill behaviors panel, and the CLI approval message. Always say a language model wrote it, and that it changes no approval.
+
+**Never:** review result, AI review, verdict (as the noun in UI), clearance, scan, audit, "safe", "cleared", "false positive". A reading never removes the approval a behavior needs.
+
+**Collides with:** behavior. A behavior is the pattern match, and it decides the approval. A reading only annotates one match.
+
 ### Owner
 
 **Is:** the GitHub organization or user that hosts Skill Repositories. A proxied entity, never a row skilld.dev owns. Lives at `/gh/[owner]`.
 
@@ -0,0 +1,105 @@
+<script setup lang="ts">
+import type { RecentPullRequest } from '#shared/open-source-pull-requests'
+import type { TrendingBoardRow } from '#shared/trending-range'
+import type { HomeDemoItem } from '~/utils/home-demos'
+import { HOME_WHY_REASONS, WHY_REASONS } from '~/utils/why-skilld'
+import WhyTrustLine from './why/_WhyTrustLine.vue'
+import WhyVisual from './why/_WhyVisual.vue'
+
+/**
+ * What skilld does differently from skills.sh, as three columns: a title, one
+ * line, and a small picture of the real interface. The skills.sh side of each
+ * reason lives on `/vs/skills-sh`, so the homepage stays light.
+ *
+ * From 1024px the columns share one subgrid, so the titles, lines and pictures
+ * each sit on one row, and every column ends at the same height.
+ */
+const { trendingRow, demos, pulls } = defineProps<{
+  /** The first trending row ranked by posts, for the people picture. */
+  trendingRow: TrendingBoardRow | null
+  /** The approved demos, for the previews picture. */
+  demos: readonly HomeDemoItem[]
+  /** Recently merged pull requests, for the open source picture. */
+  pulls: readonly RecentPullRequest[]
+}>()
+
+const reasons = HOME_WHY_REASONS.map(id => WHY_REASONS[id])
+</script>
+
+<template>
+  <section id="why" class="home-wm" aria-labelledby="why-heading">
+    <span class="home-watermark" aria-hidden="true">Why</span>
+    <div class="mx-auto max-w-6xl px-4 py-12 sm:px-6 md:py-16">
+      <h2 id="why-heading" class="home-h2 text-balance">
+        What skilld <span class="home-ink">does differently</span>.
+      </h2>
+
+      <ul class="home-why mt-8 list-none p-0">
+        <li v-for="reason in reasons" :key="reason.id" class="home-why__col">
+          <h3 class="home-why__title">
+            <UIcon :name="reason.icon" class="size-4 shrink-0 text-muted" aria-hidden="true" />
+            {{ reason.title }}
+          </h3>
+          <p class="home-why__line">
+            {{ reason.summary }}
+          </p>
+          <WhyVisual :id="reason.id" :trending-row="trendingRow" :demos :pulls compact class="home-why__visual" />
+        </li>
+      </ul>
+
+      <WhyTrustLine class="mt-8" />
+    </div>
+  </section>
+</template>
+
+<style scoped>
+.home-why {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr);
+  gap: 2.5rem;
+}
+
+.home-why__col {
+  display: flex;
+  min-width: 0;
+  flex-direction: column;
+}
+
+/* One subgrid: each row takes its tallest cell, so the pictures stretch to match. */
+@media (min-width: 64rem) {
+  .home-why {
+    grid-template-columns: repeat(3, minmax(0, 1fr));
+    grid-template-rows: auto auto 1fr;
+    column-gap: 1.5rem;
+    row-gap: 0;
+  }
+
+  .home-why__col {
+    display: grid;
+    grid-row: span 3;
+    grid-template-rows: subgrid;
+  }
+}
+
+.home-why__title {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  font-size: 1rem;
+  font-weight: 600;
+  line-height: 1.5rem;
+  color: var(--ui-text-highlighted);
+}
+
+.home-why__line {
+  margin-top: 0.25rem;
+  font-size: 0.875rem;
+  line-height: 1.6;
+  color: var(--ui-text-muted);
+  text-wrap: pretty;
+}
+
+.home-why__visual {
+  margin-top: 1rem;
+}
+</style>
@@ -0,0 +1,83 @@
+<script setup lang="ts">
+import { ogCount, ogText } from '../../utils/og-props'
+import { OG_INK, OG_MUTED, OG_RULE, OG_SURFACE } from '../../utils/og-style'
+
+// Declared as the wire types the OG image URL can deliver, not as the types the
+// template wants. A size arrives as a number or a string.
+const props = defineProps<{
+  name?: string | number | null
+  recording?: string | number | null
+  image?: string | number | null
+  imageWidth?: string | number | null
+  imageHeight?: string | number | null
+}>()
+
+// A demo card is a window onto what the Agent made, under a band that names the
+// demo and how it was recorded. The picture fills the window's width from its
+// top edge, so a page shows its header and a film its frame, and the card's
+// bottom edge cuts the rest.
+const WIDTH = 1200
+const GUTTER = 56
+const BAND = 104
+const WINDOW_WIDTH = WIDTH - GUTTER * 2
+// Room for the title right of the lockup, and the average advance of one
+// character, in em, of a title that is mostly a Skill name.
+const TITLE_ROOM = 880
+const TITLE_EM = 0.5
+
+const safeTitle = computed(() => `What /${ogText(props.name)} made`)
+// A Skill name runs to 64 characters, so a long one shrinks to keep one line.
+const titleSize = computed(() => Math.max(20, Math.min(30, Math.floor(TITLE_ROOM / (safeTitle.value.length * TITLE_EM)))))
+const safeRecording = computed(() => ogText(props.recording))
+const safeImage = computed(() => ogText(props.image))
+const scaledHeight = computed(() => {
+  const naturalWidth = ogCount(props.imageWidth)
+  const naturalHeight = ogCount(props.imageHeight)
+  return naturalWidth && naturalHeight ? Math.round(naturalHeight * WINDOW_WIDTH / naturalWidth) : 0
+})
+</script>
+
+<template>
+  <div
+    data-theme="dark"
+    class="flex flex-col w-full h-full relative overflow-hidden font-sans"
+    :style="{ background: 'oklch(0.14 0.008 60)', color: OG_INK }"
+  >
+    <div
+      class="flex items-center justify-between shrink-0"
+      :style="{ height: `${BAND}px`, paddingLeft: `${GUTTER}px`, paddingRight: `${GUTTER}px` }"
+    >
+      <OgBrand :size="30" />
+      <div class="flex flex-col items-end" :style="{ gap: '6px' }">
+        <span :style="{ fontSize: `${titleSize}px`, fontWeight: 600, letterSpacing: '-0.03em', lineHeight: 1.1 }">
+          {{ safeTitle }}
+        </span>
+        <span v-if="safeRecording" class="font-mono" :style="{ fontSize: '18px', color: OG_MUTED }">
+          {{ safeRecording }}
+        </span>
+      </div>
+    </div>
+    <div
+      class="flex overflow-hidden"
+      :style="{
+        marginLeft: `${GUTTER}px`,
+        width: `${WINDOW_WIDTH}px`,
+        flexGrow: 1,
+        background: OG_SURFACE,
+        border: `1px solid ${OG_RULE}`,
+        borderBottom: 'none',
+        borderTopLeftRadius: '14px',
+        borderTopRightRadius: '14px',
+      }"
+    >
+      <img
+        v-if="safeImage && scaledHeight"
+        :src="safeImage"
+        alt=""
+        :width="WINDOW_WIDTH"
+        :height="scaledHeight"
+        :style="{ width: `${WINDOW_WIDTH}px`, height: `${scaledHeight}px`, flexShrink: 0 }"
+      >
+    </div>
+  </div>
+</template>