phase: 01_fix_history_xss

**Phase 01 — final verification pass (all criteria green)**

- Verified M-1 fix in `src/terminal.js`: ArrowUp / ArrowDown(`>0`) / ArrowDown-else now route through `updateDisplay()` (`textContent`); no `innerHTML` sink touches `cmdLine`/`commandHistory`.
- `grep -n innerHTML src/terminal.js` → 12 hits, all allowed (static prompt literals, `clear`/prank wipes, `outLine.innerHTML = output` gated on the static canned `neofetch` string). **C1 ✓**
- XSS regression test at `tests/e2e/02-terminal.spec.js:156` present + passing; re-proved it is a real guard: re-injected the old `innerHTML` recall into `dist/terminal.*.js` → test failed (`#xss-marker` received 1); rebuild → byte-identical to `src/`. **C2 ✓**
- `./build.sh` → `dist/` OK; `npm test` → **45 passed (0 failed)**; `bash .agents/validate.sh` → **exit 0** (suite + repo-hygiene gates). **C3 ✓**
- Branch coverage of modified code: all 3 recall arms asserted (ArrowUp ×2 specs, ArrowDown `>0` in the existing history spec, ArrowDown-else → empty prompt in the new spec) → >90% gate met; no JS coverage/lint toolchain exists in the locked stack, so lint = `node --check src/*.js tests/e2e/*.js playwright.config.js` + `bash -n build.sh .agents/validate.sh` — clean.
- C4 ✓ terminal/vim/achievements/menu specs all green; only the three recall branches changed.
- Docs (step 6, full README/AGENTS review): README — run section now states the image already contains the built `dist/` (mount `dist/`, never `src/`); new “Serving & configuration” section for `nginx.conf`, incl. **empirically measured** (built image on 127.0.0.1:8124) that `/`, `/index.html` and hashed assets currently return *only* cache headers — the `add_header` non-merge gap = finding M-4/Phase 03; TLS/HSTS-at-edge rule; Quadlet section fixed (unit is not in this repo; Quadlet generates `homepage.service`, so `… start homepage.service`, and `systemctl enable` is a no-op for transient Quadlet units → `[Install]` + `daemon-reload` + linger); Development gained the Node 20+ floor, `npx playwright install chromium`, and `.agents/validate.sh`. AGENTS.md — added the validate.sh gate, flagged `./scripts/check-headers.sh` as not yet in the repo (Phase 03), and scoped the M-1 rule with the allowed-`innerHTML` list.
- Notable: `.agents/PLAN.md` still says “44 tests” (3 places) and its §7 roadmap omits phases 04/05 — left untouched per the no-PLAN-edit rule; flag for the next PLAN review. No live-infra touched (temp podman image built/removed for the header measurement only).
- Next pending phase: `02_simulate_fetch_commands`.

.agents/phases/todo/04_huntington_role/00_phase.md

@@ -0,0 +1,50 @@
+# Phase 04 — Add Huntington National Bank role to work experience
+
+**Story:** n/a
+**Context:** `src/index.html` `#experience` timeline, `.agents/PLAN.md` §2 (static-first — content-only change, no new technology)
+
+## Objective
+Update the work-experience timeline with the user's current role: **Lead MLOps
+Engineer at Huntington National Bank (Jun 2026 – Present)**, inserted as the
+new first (most recent) timeline entry with three bullet points covering the
+agentic vulnerability-remediation toolkit, LLM harness skills for business
+automation, and the 6-person offshore team building the developer landing
+zone. The previous Nimbis "DevOps Manager" entry is updated from
+`Jan 2022 – Present` to `Jan 2022 – Apr 2026`. Lock the change with a
+Playwright regression test.
+
+## Dependencies
+— (none)
+
+## Tasks
+1. `01_add_timeline_entry.md` — Insert the new Huntington National Bank timeline entry at the top of the `#experience` timeline and update the Nimbis DevOps Manager end date.
+2. `02_experience_regression_test.md` — Add a Playwright test proving the new entry is first, complete, and correctly dated, and that the Nimbis entry no longer claims "Present".
+
+## Testing & Quality
+- Unit/integration: no JS logic changes in this phase — `src/index.html`
+  content only. The quality gate is the E2E regression test (task 2) plus the
+  full suite.
+- Coverage: **>90%** on new/modified code — vacuously satisfied (no
+  JS/CSS/TS code is modified); the E2E suite is the binding gate.
+- E2E: full Playwright suite (`npm test`) green.
+- The phase is "Complete" only when the **entire** project test suite passes
+  100% (every test in the project, not just this phase's — pre-existing
+  failures included) and achieves **>90% code coverage** on new/modified code.
+
+## Documentation & Consistency
+- The final pass reviews `README.md` and `AGENTS.md` in full against the
+  project as it stands after this phase — fixing every inconsistency found,
+  **including pre-existing ones not caused by this phase**.
+- Tasks update `README.md`/`AGENTS.md` immediately when their own changes are
+  user-visible (setup, commands, configuration, features, conventions).
+
+## Completion Criteria
+- [ ] `grep -c "Huntington National Bank" dist/index.html` returns 1 and
+      `grep -n "Jun 2026" dist/index.html` shows the `– Present` date span
+- [ ] Nimbis "DevOps Manager" date reads `Jan 2022 – Apr 2026` in
+      `dist/index.html` (no second `– Present` entry in `#experience`)
+- [ ] new regression test present in `tests/e2e/01-page.spec.js` and passing
+- [ ] `./build.sh && npm test` fully green (45+ tests)
+- [ ] no behavior change in completed work (terminal, vim, achievements, menu)
+- [ ] README.md and AGENTS.md are accurate and consistent with the whole
+      project (verified in the final pass)