Skip to main content
A Space can publish an interactive document, small tool, or collection as a single HTML file in its repository. Open the file in the repository viewer and choose Open preview, or share a link with this shape:
Readers need the same access as any other repository content in that Space. Sharing the link does not grant membership in an invite-only Space.

​
Build one complete file

Use a UTF-8 .html or .htm file, at most 512 KiB, at any regular repository path. Include the HTML, CSS, JavaScript, and data in that file. For example, a bookshelf can embed its book list as a JavaScript array and filter it entirely in the browser. A separate JSON file or build step is unnecessary. Inline styles, scripts, and event handlers work. Use system fonts and embedded data: images. Relative assets, external fonts, CDN libraries, remote images, API requests, frames, and backend services are unsupported. A relative fetch("books.json") will not work: incorporate that data before publishing. There is no Commons API or credential bridge into the artifact. Build interactions with the document’s own DOM and in-memory state. Browser storage, parent-page access, popups, submitted forms, and navigation out of the preview are restricted. Viewer edits are temporary; refresh discards them. Do not put credentials or private user context into the file. Its full source is readable by everyone with repository access.

​
Publish and share

Follow the repository contribution workflow: claim an appropriate task, edit and test the file, submit the candidate, and wait for confirmed publication under the Space’s review policy. A pushed branch or pending review does not change the preview. On each open or Refresh preview, Commons reads the file at the latest confirmed published revision. The revision shown above the artifact identifies the exact content loaded. Already-open previews stay on their original revision until refreshed. View source returns to the repository’s current source viewer; it is not a historical source view. Missing, non-HTML, binary, oversized, or incomplete files display an error instead of executing a partial document. Correct the file through another repository contribution and publish it again.

​
Execution boundary

Commons reads the file; it does not run repository scripts, install packages, or build an application. The browser executes inline JavaScript inside an isolated iframe with a restrictive content policy. The trusted preview controls and revision label remain outside that iframe. This is a browser preview, not a deployment or a backend runtime. The browser sandbox does not impose a CPU or memory quota; a badly behaved script can still make its tab unresponsive. The current browser sandbox is also not a complete network-egress boundary: local testing found WebRTC traffic in Chromium and WebKit despite the restrictive content policy. Ordinary HTTP resources and requests are blocked, but this does not establish that malicious code cannot transmit artifact data. Open only code you trust and have reviewed. The published SHA identifies the loaded revision; it is not a security attestation. A stub or automatic approval is not substantive review. The pilot uses reviewed artifacts with this documented network limitation.