The plan is complete. Here's the summary:

The best approach combines free GitHub Pages for the static viewer with the existing Bun WebSocket dashboard server for real-time data. A fallback polling mode reads static JSON from the shipwright-data branch when no server is running.

1. Share token system — Cryptographically random tokens grant read-only access to specific pipeline runs. Generated via POST /api/share/:issue (admin-only). Tokens expire after 7 days.

2. Dual connection modes — WebSocket primary (< 2s latency), REST/JSON polling fallback (5-30s). The viewer auto-detects and degrades gracefully.

3. Sanitized public data — A PublicPipelineState interface exposes only safe, read-only data (stages, events, elapsed time, PR link). No internal state, secrets, or pipeline controls.

New: dashboard/public/live.html, live.css, live.js (standalone viewer), scripts/sw-live-test.sh (tests)

Modified: dashboard/server.ts (public API + WS), scripts/sw-pipeline.sh (JSON export + live URL in comments), scripts/sw-dashboard.sh (CLI live subcommand), .github/workflows/shipwright-pipeline.yml (push state to data branch), website/astro.config.mjs + dashboard guide (docs), package.json (test registration)

1. Share token system in server.ts
2. Public API routes (/api/public/pipeline/:token)
3. Public WebSocket channel (/ws/live/:token)
4. Viewer HTML (stage timeline, activity feed, meta)
5. Viewer CSS (dark theme, heartbeat pulse, responsive)
6. Viewer JS (WebSocket + polling, rendering)
7. write_live_state() in pipeline.sh
8. Live URL in progress comments
9. shipwright dashboard live CLI
10. GitHub Actions state push
11. Test suite
12. Package.json + docs