site: open-iov.org 2026 documentation update

- tools/site: Markdown-to-MediaWiki converter (tracked-paths-only link
  mapping, local-marker scan, About-message insert), WikiBot publisher
  with diff/check modes and publish manifest, live site auditor, image
  uploader, site-only page sources (landing page, About, index, sidebar,
  banner templates, About-message template).
- wiki: new public deep-dive sources (project status, install, FAQ,
  system overview, GSP and GSP-RM, execution frontier, host module,
  guest stack, UVM, physical backend, driver lifecycle, risc-v-gsp-rm-debugger,
  hardware/software matrix, HAAEEP, glossary); refreshed CUDA userspace
  status; corrected cross-document links; README rewritten for the new set.
- wiki/.publish-manifest.json records each published revision for rollback.

1 files changed, 54 insertions, 0 deletions

diff --git a/tools/site/README.md b/tools/site/README.md
new file mode 100644
index 0000000..2e9de5d
--- /dev/null
+++ b/tools/site/README.md
@@ -0,0 +1,54 @@
+# tools/site — open-iov.org publishing toolchain
+
+Converts the tracked `wiki/*.md` sources to MediaWiki wikitext and publishes
+them to https://open-iov.org. No secrets live in this directory.
+
+## Files
+
+| Tool | Purpose |
+|---|---|
+| `md2wiki.py` | Markdown → MediaWiki converter. Maps `../docs/...` links to the public repository (tracked files only — untracked/private paths abort), maps intra-wiki `*.md` links to page titles via `titles.json`, renders diagram image references, strips non-public-provenance sentences, and refuses output containing forbidden markers. |
+| `publish.py` | WikiBot client: `login`, `check --all`, `diff`, `publish`, `publish-all`, `delete`, `move`. Scans before writing; records every revision in `wiki/.publish-manifest.json`. |
+| `check_site.py` | Live audit: forbidden markers, raw links, unresolved internal links across every page. |
+| `upload_file.py` | Upload an image (e.g. a rendered diagram) as WikiBot. |
+| `titles.json` | Page title map (wiki source → wiki page), canonical-doc → site-page map, diagram image map. |
+| `pages/` | Site-only pages (Main Page, About, Community, sidebar, templates) as tracked wikitext. |
+
+## Credentials
+
+`~/.config/open-iov/wiki-bot.env` (mode 0600, outside the repository):
+
+```
+WIKI_BOT_USER=...
+WIKI_BOT_PASS=...
+```
+
+## Typical flow
+
+```bash
+# edit wiki/<Page>.md, then:
+python3 tools/site/md2wiki.py --all --out /tmp/open-iov-site
+python3 tools/site/publish.py diff  --title "FAQ" --file /tmp/open-iov-site/FAQ.wiki
+python3 tools/site/publish.py publish --title "FAQ" --file /tmp/open-iov-site/FAQ.wiki \
+    --summary "Update from tracked wiki source"
+python3 tools/site/check_site.py
+```
+
+Site-only pages:
+
+```bash
+python3 tools/site/publish.py publish --title "Main Page" --file tools/site/pages/Main-Page.wiki --summary "..."
+```
+
+Diagram images: render with `mermaid-cli` (`mmdc`, see `titles.json`
+`mermaid_images` for the mapping), upload with `upload_file.py`.
+
+## Rules
+
+* Only tracked repository paths are ever linked; the converter fails loudly on
+  anything else.
+* Non-public provenance (notes files, study sources) must never appear in
+  site output; both `md2wiki.py` and `publish.py` enforce a forbidden-marker
+  list.
+* Every edit goes through the bot with a descriptive summary and is recorded
+  with its old/new revision ids for rollback.