Remove the workshop scenario selection step from the initial tutorial flow

[Copilot]

The workshop currently pauses on a scenario-selection screen before the tutorial starts, which adds friction too early in the experience. This change starts the tutorial immediately after entry-path selection while preserving the existing scenario-driven flow behind the scenes via the default scenario.

• Workshop flow

  • Remove the separate scenario setup screen from WorkshopExperience.
  • Route entry-path selection directly into the tutorial.
  • Keep the existing default scenario (daily-status) as the implicit flow selector.

• State and URL behavior

  • Persist the default scenario in session state instead of leaving scenarioId empty during setup transitions.
  • Normalize journey-only hashes to tutorial URLs that include the default scenario.
  • Preserve existing deep-link behavior for full journey + scenario + step hashes.

• Test updates

  • Update Playwright coverage to reflect the simplified entry flow.
  • Add coverage for journey-only hashes resolving to the default scenario.

const createDefaultState = () => ({
	entryPathId: defaultEntryPath?.id,
	journeyId: defaultEntryPath?.journeyId || manifest.defaults.journeyId,
	scenarioId: manifest.defaults.scenarioId,
	stepKey: initialStep,
});

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. Test Quality Sentinel skipped.

[github-actions]

✅ PR Code Quality Reviewer completed the code quality review.

[github-actions]

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #46763 does not have the 'implementation' label and has 0 new lines of code in business logic directories (threshold: 100).

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

[Copilot]

Pull request overview

Simplifies workshop onboarding by starting the default scenario immediately after entry-path selection.

Changes:

• Removes scenario-selection UI and defaults to daily-status.
• Updates URL/state handling and Playwright coverage.
• Includes unrelated workflow/status maintenance changes.

Show a summary per file

File	Description
docs/tests/workshop.spec.ts	Updates workshop navigation tests.
docs/src/content/docs/agent-factory-status.mdx	Adds Daily VulnHunter status entry.
docs/src/components/workshop/WorkshopExperience.astro	Removes scenario picker and updates routing/state.
.github/workflows/daily-vulnhunter-scan.lock.yml	Upgrades generated workflow dependencies.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/4 changed files
• Comments generated: 3
• Review effort level: Medium

[github-actions]

The changes are clean and consistent. Removing the scenario selection step simplifies the onboarding flow — defaulting to manifest.defaults.scenarioId is applied correctly in all state paths (createDefaultState, parseHashUrl, readState, applyHashState, and setJourney). The buildHashUrl simplification is correct since the setup-scenario screen no longer exists. Tests are updated to match the new flow. No issues found.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · 15.5 AIC · ⌖ 5.42 AIC · ⊞ 5K

[github-actions]

Skills-Based Review

Applied /tdd and /codebase-design — one minor observation, otherwise a clean and well-executed simplification.

Key Themes and Highlights

Key Themes

• Test coupling to default value: New tests assert daily-status as a literal string. If manifest.defaults.scenarioId changes, these tests break without a clear signal — see inline comment.

Positive Highlights

• Removal of scenarioStepCountsByJourney precomputation is a good deep-module improvement.
• Replacing the empty-string sentinel with manifest.defaults.scenarioId throughout makes the state machine easier to reason about.
• Test names updated to reflect new behaviour, reading as specifications.
• New journey-only-hash test covers the key regression path introduced by URL routing change.
• Dead code (showSetupStep, tunnelPanel) removed cleanly alongside the UI change.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · 34.3 AIC · ⌖ 4.5 AIC · ⊞ 6.7K
_{Comment /matt to run again}

Comments that could not be inline-anchored

docs/tests/workshop.spec.ts:555

[/tdd] Test hardcodes daily-status as the expected default scenario ID, coupling the assertion directly to the current default value rather than verifying the behaviour contract.

If the default scenario is ever changed in manifest.defaults.scenarioId, this test will fail with a cryptic URL mismatch rather than a meaningful message.

<details>
<summary>💡 Suggestion</summary>

Consider reading the default scenario ID from the manifest or a shared constant, or at minimum add a comment th…

[github-actions]

Two correctness bugs in the simplified state machine and one test coverage gap that leaves the new click-to-tutorial flow unverified.

Blocking issues summary

1. applyHashState drops the stepKey reset (high)

The refactor removed the else-branch that called getFallbackStepKey() when no scenario was in the hash. The new if (parsed.stepKey) guard means a journey-only hash (#j=github) never resets state.stepKey. Users with session state from a previous run will resume at a stale step position — the new deep-link feature ("treats journey-only hashes as a tutorial start") is broken for returning users. See inline comment.

2. Invalid scenario IDs silently fall back to default (medium→high)

The old code sent users with invalid/renamed scenario IDs in their bookmarks to the picker so they could correct the problem. The new code silently substitutes manifest.defaults.scenarioId. This is a silent regression for any shared or bookmarked link that includes a now-invalid s= param. See inline comment.

3. No UI-click test covers the URL rewrite after entry-path selection (medium)

The new test for journey-only hashes uses page.goto to pre-seed the hash, but the click path — the primary new behavior — is never asserted to produce &s=daily-status in the URL. See inline comment.

🔎 Code quality review by PR Code Quality Reviewer · 79.8 AIC · ⌖ 4.92 AIC · ⊞ 5.6K
_{Comment /review to run again}

Comments that could not be inline-anchored

docs/src/components/workshop/WorkshopExperience.astro:383

applyHashState no longer resets stepKey when no step is present in the hash — a stale step from session storage or a previous journey persists silently, resuming the tutorial at the wrong position.

<details>
<summary>💡 Details and suggested fix</summary>

The old code had an explicit else branch that reset stepKey:

if (parsed.scenarioId) {
  state.scenarioId = parsed.scenarioId;
} else {
  state.scenarioId = '';
  state.stepKey = getFallbackStepKey(); // reset here
}

The n…

docs/src/components/workshop/WorkshopExperience.astro:308

Invalid/deleted scenario IDs in bookmarked URLs silently fall back to the default scenario with no user feedback — users with broken deep-links will see the wrong tutorial content without knowing why.

<details>
<summary>💡 Details</summary>

Old behavior:

const scenarioId = rawScenarioId && manifest.scenarios.find((s) => s.id === rawScenarioId) ? rawScenarioId : null;
if (!scenarioId) return { screen: 'setup-scenario', journeyId, scenarioId: null, stepKey: null };

An invalid scen…

docs/tests/workshop.spec.ts:555

The new journey-only hash test uses page.goto instead of a UI click, leaving the UI-driven hash rewrite path untested — the test validates hash-navigation-by-URL but not the entry-path-click path that actually produces that URL.

<details>
<summary>💡 Details</summary>

The test added at line 550:

test('treats journey-only hashes as a tutorial start with the default scenario', async ({ page }) => {
  await page.goto(`${WORKSHOP_URL}#j=github`);
  await page.waitForLoadState('netw…

</details>

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.82.14