[lagarcia38]

Adds /sphere/hello-world/, a step-by-step SPHERE ICS hello world across three utilities (hydro power, water treatment, water distribution). It also links the page from the P1 page's "What's next". Stacked on #16.

What the page is

• Steps:
  1. meet the region;
  2. pick a utility;
  3. play the incident;
  4. see what SPHERE gives each team.
• Each step has an Expected: result.
• Steps 1–3 frame the CTF1 briefing replay (Take 1, cut before every controller decision, no outcomes). Buttons send the replay's own keys (0–3, Space).
• Step 4 shows the plant SPHERE builds for each team:
  • six machines from one model file: OpenPLC controller, OpenPLC plant simulator on a field link, HMI, engineering workstation, DMZ gateway, and a zone firewall that captures traffic;
  • access through an XDC;
  • a diagram tracing an HMI poll through the firewall;
  • the Rockwell rack photo with a link to the P1 page.
• Step 4 also shows every role as swappable:
  • a toggle switches the diagram between the CTF1 all-virtual build and a real-hardware build: ControlLogix racks for controller and simulator, a FactoryTalk panel, a Windows Studio 5000 workstation, and EtherNet/IP polling;
  • a table lists what can fill each role. The HMI can be FUXA, ScadaBR, or FactoryTalk (virtual or a hardware panel); the workstation can be a Windows/Ubuntu VM or a physical workstation; the utility and the network also vary.
• The replay spans the full window at its 16:9 shape.
• The page leaves out staff-only material: addresses, attack catalog, and infrastructure host names.

Where it comes from

• These files are generated by the course tool challenges/ctf1-ics/tools/sphere_hello_world.py (cs6494-fall2026, branch claude/sphere-hello-world, local commit beea1aa).
• theater.html is the unchanged build_theater.build("briefing") output.
• A 3D variant (same tool with --floor3d) needs Brotli headers, so it isn't part of this static site. It was previewed locally with tools/serve_theater.py.

Before merging

• The course's DEPLOY.md says no public deployment of the CTF1 material is authorized. This page publishes the briefing replay, so it needs the instructor's OK.
• Merging deploys to iotrustlab.com.

Checks

• npm run lint clean; npm run lint:links 0 failures; npm run build OK.
• Browser checks:
  • the four utility buttons open each site's panel in the embedded replay;
  • no horizontal scroll at 375 px;
  • the console is clean.
• The course unit suite: 241 ran, 239 passed, 2 skipped.

🤖 Generated with Claude Code