docs(site): lead with in-browser CSV flow; reframe CLI as scripted/batch path

The "Things to try" cards now lead with "Encrypt your own CSV — in your
browser" — matching the new demo capability where dropping a .csv opens
a key-generation + encrypt + download panel with a one-click verify.

The CLI section is preserved but reframed from "Convert your own CSV"
(implying it was the only path) to "For scripted or batch use — the CLI"
with an explicit note that the hosted WebAssembly demo is already
commercial-tier and needs no local build for the interactive path.>

Author: Johnson-Ogundeji

assets/build_site.py

@@ -746,9 +746,9 @@ def _compline(nm, ic, ds):
         ("Open + commercial dual-licensed", "Source-available under the Forge Source-Available License for inspection; commercial terms for production use — see the repo."),
     ]
     forge_tests = [
-        ("Open the bundled sample", "One click loads <code>sample.parquet</code> from the demo bundle so you can verify the round-trip path without leaving the page.", "Open the demo →", forge_demo_url),
-        ("Bring your own .parquet", "Drag a Parquet file from your machine onto the drop zone — schema, row groups and a paged preview render in under a second; nothing leaves your browser.", "Try it →", forge_demo_url),
-        ("Decrypt an AES-256 PME file", "Tick <em>Encrypted file (AES-256 PME)</em>, paste a footer key (64 hex chars) and an optional column key, then drop the file — the demo decrypts client-side and reveals the data only if your keys are correct. From there: <strong>Download .parquet</strong> saves the original bytes (encrypted files stay encrypted — safe to forward), and <strong>Download CSV</strong> / <strong>Download JSON</strong> export the decrypted rows. All three are client-side, no network round-trip.", "Open the encrypted-file flow →", forge_demo_url),
+        ("Encrypt your own CSV — in your browser", "Drag a <code>.csv</code> onto the demo. A panel opens, generates a fresh AES-256 key for you (via <code>crypto.getRandomValues</code>), takes an AAD prefix, and the <strong>Encrypt &amp; download .parquet</strong> button writes an encrypted Parquet straight back to your machine. A one-click <em>Decrypt it here to verify</em> button then re-feeds it through the decryption path with the same key + AAD pre-filled — closing the round trip without leaving the page.", "Open the in-browser flow →", forge_demo_url),
+        ("Decrypt an AES-256 PME file", "Already have an encrypted Parquet? Tick <em>Encrypted file (AES-256 PME)</em>, paste a footer key (64 hex chars) and optional column key, then drop the file. From there: <strong>Download .parquet</strong> saves the original bytes (encrypted files stay encrypted — safe to forward), and <strong>Download CSV</strong> / <strong>Download JSON</strong> export the decrypted rows. All client-side, no network round-trip.", "Open the encrypted-file flow →", forge_demo_url),
+        ("Open the bundled sample, or bring any .parquet", "One drop loads the bundled <code>sample.parquet</code> from the demo, or any Parquet from your machine — schema, row groups and a paged preview render in under a second; nothing leaves your browser.", "Open the demo →", forge_demo_url),
     ]
     # Precautions surfaced before encryption — strong-encryption tools delete data
     # safely on purpose. Users need to know what they own (the key) and what the
@@ -829,10 +829,10 @@ def _compline(nm, ic, ds):
 <div class="grid g3">{forge_safety_html}</div></div></section>
 
 <section><div class="wrap">
-<div class="sec-head"><div class="kick">Convert your own CSV</div><h2>The four-step recipe</h2>
-<p class="lead">Take a CSV from your machine, turn it into an encrypted Parquet file, and decrypt it in the demo above — all on the command line. Requires a one-time local build of the CLI.</p></div>
+<div class="sec-head"><div class="kick">For scripted or batch use — the CLI</div><h2>Same flow, on the command line</h2>
+<p class="lead">The browser demo above handles single-file, interactive use. For scripted pipelines, batch jobs, or anything you want under version control, the <code>signet_cli</code> binary gives you the same encrypted round trip on the command line.</p></div>
 <div class="grid g2">{forge_cli_html}</div>
-<div class="statusbox" style="margin-top:20px"><strong>Why the local build:</strong> the encryption flags depend on the commercial-tier writer surface in the library, which is off by default. Reconfiguring with <code>-DSIGNET_ENABLE_COMMERCIAL=ON</code> turns it on for your local build only — it does not change the licence of the repository or your obligations under it. See <a href="{forge_repo_url}/blob/main/LICENSE_COMMERCIAL" target="_blank" rel="noopener">LICENSE_COMMERCIAL</a> on the Forge repository for commercial-use terms.</div>
+<div class="statusbox" style="margin-top:20px"><strong>Why the local build:</strong> the encryption flags depend on the commercial-tier writer surface in the library, which is off by default for CLI builds. Reconfiguring with <code>-DSIGNET_ENABLE_COMMERCIAL=ON</code> turns it on for your local build only — it does not change the licence of the repository or your obligations under it. See <a href="{forge_repo_url}/blob/main/LICENSE_COMMERCIAL" target="_blank" rel="noopener">LICENSE_COMMERCIAL</a> on the Forge repository for commercial-use terms. <em>(The hosted WebAssembly demo is already built with the commercial flag — you don't need it for the in-browser flow above.)</em></div>
 </div></section>
 
 <section class="band"><div class="wrap"><div class="sec-head"><div class="kick">What it does</div><h2>Capabilities</h2></div><div class="grid g3">{forge_caps_html}</div></div></section>

website/signet-forge.html

@@ -47,16 +47,16 @@ <h1>Signet Forge™</h1>
 </div></section>
 
 <section><div class="wrap"><div class="sec-head"><div class="kick">Three things to try</div><h2>Immediate test scenarios</h2><p class="lead">Concrete proofs you can run today — each one ends in your browser, with no server roundtrip.</p></div>
-<div class="grid g3"><div class="cap"><div class="dot">01</div><h4>Open the bundled sample</h4><p>One click loads <code>sample.parquet</code> from the demo bundle so you can verify the round-trip path without leaving the page.</p><a class="btn btn-ghost" href="https://signetstack.github.io/SIGNET_FORGE/demo/" target="_blank" rel="noopener" style="margin-top:12px">Open the demo →</a></div><div class="cap"><div class="dot">02</div><h4>Bring your own .parquet</h4><p>Drag a Parquet file from your machine onto the drop zone — schema, row groups and a paged preview render in under a second; nothing leaves your browser.</p><a class="btn btn-ghost" href="https://signetstack.github.io/SIGNET_FORGE/demo/" target="_blank" rel="noopener" style="margin-top:12px">Try it →</a></div><div class="cap"><div class="dot">03</div><h4>Decrypt an AES-256 PME file</h4><p>Tick <em>Encrypted file (AES-256 PME)</em>, paste a footer key (64 hex chars) and an optional column key, then drop the file — the demo decrypts client-side and reveals the data only if your keys are correct. From there: <strong>Download .parquet</strong> saves the original bytes (encrypted files stay encrypted — safe to forward), and <strong>Download CSV</strong> / <strong>Download JSON</strong> export the decrypted rows. All three are client-side, no network round-trip.</p><a class="btn btn-ghost" href="https://signetstack.github.io/SIGNET_FORGE/demo/" target="_blank" rel="noopener" style="margin-top:12px">Open the encrypted-file flow →</a></div></div></div></section>
+<div class="grid g3"><div class="cap"><div class="dot">01</div><h4>Encrypt your own CSV — in your browser</h4><p>Drag a <code>.csv</code> onto the demo. A panel opens, generates a fresh AES-256 key for you (via <code>crypto.getRandomValues</code>), takes an AAD prefix, and the <strong>Encrypt &amp; download .parquet</strong> button writes an encrypted Parquet straight back to your machine. A one-click <em>Decrypt it here to verify</em> button then re-feeds it through the decryption path with the same key + AAD pre-filled — closing the round trip without leaving the page.</p><a class="btn btn-ghost" href="https://signetstack.github.io/SIGNET_FORGE/demo/" target="_blank" rel="noopener" style="margin-top:12px">Open the in-browser flow →</a></div><div class="cap"><div class="dot">02</div><h4>Decrypt an AES-256 PME file</h4><p>Already have an encrypted Parquet? Tick <em>Encrypted file (AES-256 PME)</em>, paste a footer key (64 hex chars) and optional column key, then drop the file. From there: <strong>Download .parquet</strong> saves the original bytes (encrypted files stay encrypted — safe to forward), and <strong>Download CSV</strong> / <strong>Download JSON</strong> export the decrypted rows. All client-side, no network round-trip.</p><a class="btn btn-ghost" href="https://signetstack.github.io/SIGNET_FORGE/demo/" target="_blank" rel="noopener" style="margin-top:12px">Open the encrypted-file flow →</a></div><div class="cap"><div class="dot">03</div><h4>Open the bundled sample, or bring any .parquet</h4><p>One drop loads the bundled <code>sample.parquet</code> from the demo, or any Parquet from your machine — schema, row groups and a paged preview render in under a second; nothing leaves your browser.</p><a class="btn btn-ghost" href="https://signetstack.github.io/SIGNET_FORGE/demo/" target="_blank" rel="noopener" style="margin-top:12px">Open the demo →</a></div></div></div></section>
 
 <section class="band"><div class="wrap">
 <div class="sec-head"><div class="kick" style="color:#F59E0B">Before you encrypt · read this once</div><h2>Important precautions</h2>
 <p class="lead">Signet Forge gives you real cryptographic guarantees. That cuts both ways: when the system says a file is unrecoverable, it really is. These are the seven things every user should know before encrypting their first file.</p></div>
 <div class="grid g3"><div class="cap"><div class="dot" style="background:#F59E0B;color:#fff">!</div><h4>Generate keys with a CSPRNG, not by hand</h4><p>Use <code>openssl rand -hex 32</code> (or your platform's equivalent) for every file. Hand-typed or guessable keys collapse AES-256 to whatever your imagination is — usually a few bits of real entropy.</p></div><div class="cap"><div class="dot" style="background:#F59E0B;color:#fff">!</div><h4>Save the key before you close the terminal</h4><p>When you run <code>KEY=$(openssl rand -hex 32)</code>, that 64-character hex string only exists in your shell's environment. Close the tab without copying it into a password manager (1Password, Bitwarden, <code>pass</code>) and the file becomes permanently unreadable. <strong>That is by design — it is the crypto-shred guarantee, not a bug.</strong></p></div><div class="cap"><div class="dot" style="background:#F59E0B;color:#fff">!</div><h4>The AAD prefix must match — character for character</h4><p>If you encrypted with <code>--aad-prefix "mydata-2026-05-31"</code>, you must type that <em>exact</em> string into the demo's AAD field. A capital letter, a missing dash, an extra space — any difference makes the GCM tag fail to verify, and there is no recovery path.</p></div><div class="cap"><div class="dot" style="background:#F59E0B;color:#fff">!</div><h4>Use a trusted device</h4><p>The demo keeps your file in the browser — no upload, no server, no telemetry — but the device itself still sees the plaintext after decryption. Don't use shared kiosks, active screen-sharing sessions, or machines with cross-device clipboard sync turned on while you paste keys.</p></div><div class="cap"><div class="dot" style="background:#F59E0B;color:#fff">!</div><h4>Never share keys over email, chat or SMS</h4><p>Treat an AES-256 key the way you'd treat a password: send it through a password-manager share, a Signal / age / GPG-encrypted channel, or a vault — never inline in a message that gets logged, indexed or back-up-synced in plaintext.</p></div><div class="cap"><div class="dot" style="background:#F59E0B;color:#fff">!</div><h4>Public demo is for evaluation; production wants the local build</h4><p>The hosted demo loads its JS and WebAssembly from this site for convenience. For regulated PII / financial / health data, build the CLI or library locally with <code>-DSIGNET_ENABLE_COMMERCIAL=ON</code> so the entire compile, key-handling and storage surface stays inside your trust boundary.</p></div><div class="cap"><div class="dot" style="background:#F59E0B;color:#fff">!</div><h4>Downloading an encrypted .parquet is just sharing the ciphertext</h4><p>The <strong>Download .parquet</strong> button is a passthrough — it writes the exact bytes you uploaded. An encrypted file <em>stays</em> encrypted on disk and is safe to email, attach or upload to shared storage. But sharing the file does <em>not</em> share the key — the recipient still needs the footer key, optional column key, and the same AAD prefix to decrypt. Send those separately, through a different channel.</p></div><div class="cap"><div class="dot" style="background:#F59E0B;color:#fff">!</div><h4>Report vulnerabilities responsibly</h4><p>Found a real cryptographic or implementation issue? Use the coordinated-disclosure path in <a href="https://github.com/SIGNETSTACK/SIGNET_FORGE/blob/main/SECURITY.md" target="_blank" rel="noopener">SECURITY.md</a> on the Forge repository — please don't open a public issue.</p></div></div></div></section>
 
 <section><div class="wrap">
-<div class="sec-head"><div class="kick">Convert your own CSV</div><h2>The four-step recipe</h2>
-<p class="lead">Take a CSV from your machine, turn it into an encrypted Parquet file, and decrypt it in the demo above — all on the command line. Requires a one-time local build of the CLI.</p></div>
+<div class="sec-head"><div class="kick">For scripted or batch use — the CLI</div><h2>Same flow, on the command line</h2>
+<p class="lead">The browser demo above handles single-file, interactive use. For scripted pipelines, batch jobs, or anything you want under version control, the <code>signet_cli</code> binary gives you the same encrypted round trip on the command line.</p></div>
 <div class="grid g2"><div class="cap"><div class="dot">01</div><h4>Build the CLI (one time)</h4><pre><code>cd /path/to/SIGNET_FORGE
 cmake --preset release -DSIGNET_ENABLE_COMMERCIAL=ON
 cmake --build --preset release --target signet_cli
@@ -66,7 +66,7 @@ <h1>Signet Forge™</h1>
     --footer-key  $KEY \
     --column-key  $KEY \
     --aad-prefix  "mydata-YYYY-MM-DD"</code></pre></div><div class="cap"><div class="dot">04</div><h4>Open the file in the demo above</h4>Tick <em>Encrypted file (AES-256 PME)</em>, paste <code>$KEY</code> into both the footer and column key fields, type the exact same AAD prefix, then drop the <code>.parquet</code> file. Decryption happens entirely in your browser.</div></div>
-<div class="statusbox" style="margin-top:20px"><strong>Why the local build:</strong> the encryption flags depend on the commercial-tier writer surface in the library, which is off by default. Reconfiguring with <code>-DSIGNET_ENABLE_COMMERCIAL=ON</code> turns it on for your local build only — it does not change the licence of the repository or your obligations under it. See <a href="https://github.com/SIGNETSTACK/SIGNET_FORGE/blob/main/LICENSE_COMMERCIAL" target="_blank" rel="noopener">LICENSE_COMMERCIAL</a> on the Forge repository for commercial-use terms.</div>
+<div class="statusbox" style="margin-top:20px"><strong>Why the local build:</strong> the encryption flags depend on the commercial-tier writer surface in the library, which is off by default for CLI builds. Reconfiguring with <code>-DSIGNET_ENABLE_COMMERCIAL=ON</code> turns it on for your local build only — it does not change the licence of the repository or your obligations under it. See <a href="https://github.com/SIGNETSTACK/SIGNET_FORGE/blob/main/LICENSE_COMMERCIAL" target="_blank" rel="noopener">LICENSE_COMMERCIAL</a> on the Forge repository for commercial-use terms. <em>(The hosted WebAssembly demo is already built with the commercial flag — you don't need it for the in-browser flow above.)</em></div>
 </div></section>
 
 <section class="band"><div class="wrap"><div class="sec-head"><div class="kick">What it does</div><h2>Capabilities</h2></div><div class="grid g3"><div class="cap"><div class="dot">01</div><h4>Encrypted Apache Parquet</h4><p>Modular column-level encryption (PME) layered on Apache Parquet — encrypt some columns, leave others in the clear, decrypt with the keys you control.</p></div><div class="cap"><div class="dot">02</div><h4>Post-quantum by design</h4><p>AES-256-GCM today, with a clean migration path to NIST-standardized post-quantum primitives (ML-KEM, ML-DSA) — so records you write today survive the quantum era.</p></div><div class="cap"><div class="dot">03</div><h4>Reads in the browser</h4><p>A WebAssembly build runs the decrypt+decode path entirely client-side: the file never leaves the user's machine — no upload, no server, no telemetry.</p></div><div class="cap"><div class="dot">04</div><h4>Zero runtime dependencies</h4><p>C++20 core, no Apache Arrow or third-party Parquet runtime — every byte that touches your data is in this one repo, auditable end-to-end.</p></div><div class="cap"><div class="dot">05</div><h4>MiFID II &amp; EU AI Act aligned</h4><p>Footer KeyValue metadata carries signing traces, lineage tokens and policy IDs end-to-end — the file is the record of record.</p></div><div class="cap"><div class="dot">06</div><h4>Open + commercial dual-licensed</h4><p>Source-available under the Forge Source-Available License for inspection; commercial terms for production use — see the repo.</p></div></div></div></section>