Version 1 turns a JSON story into one offline HTML file
Version 1 treats the JSON story specification as the portable source of truth. The agent gathers a question, audience, and evidence, selects a story grammar, then writes the structured scenes. A deterministic renderer produces one self-contained HTML file. The file embeds the canonical SHA-256 of its specification, and the validator can compare a supplied spec with a fresh render byte for byte. That is a much firmer delivery boundary than handing over an opaque page generated inside a chat.
The explainer combines an analogy with the technical mechanism and caveats through what the project calls a Truth Ladder. Evidence sits beside the conclusion it supports, including source status, relevant text, scope, and either a URL or an explicit statement that no locator exists. A reader can follow a global trace or play one scene, reveal teach-back answers, inspect failures, and navigate by keyboard. These are useful mechanics for explaining a system without sanding away the inconvenient parts.
What happened when we ran it
Our sandbox installed 0 packages in 5 seconds at commit e90d5f9 and used 2 MB on disk. The checkout contained 41 files, about 2,613 lines of source, and occupied 0.9 MB. There was no build script or target, so the lab skipped that step. The repository has no Dockerfile and does have a tests directory plus 1 CI workflow file.
Node's built-in test runner completed in 6 seconds with 22 passed and 0 failed. Npm audit found 0 known vulnerabilities, broken down as 0 critical, 0 high, 0 moderate, and 0 low. The clean result is believable because the runtime intentionally has no package dependencies, remote fonts, or third-party rendering libraries. It also means most of the project's risk lives in its own renderer, validator, browser code, and skill instructions rather than a dependency tree.
The measured path is pleasantly small. npm run check goes beyond the 22 focused tests by checking syntax, the canonical example, release-package contents, and a render-and-validate canary from an unpacked archive. On Node.js 22.20 or newer, a separate check exercises isolated Codex and Claude Code installation through the pinned Skills CLI. That separation avoids making the installed skill require the installer's newer Node version.
Version 1 limits authors to four story grammars
Version 1 defines four story types: concept, repository module, engineering tradeoff, and incident. Each has its own summary view and semantic checks. That constraint improves consistency for system explanations, where a free-form animation can look convincing while leaving the audience unsure what actually happened. An incident can expose impact, symptom, and fallback; a repository story can follow a real request through files and modules. The validator has a known shape to inspect.
The cost is range. Fireworks is not a general website generator or a blank presentation canvas. A product launch, sales narrative, classroom syllabus, or live monitoring dashboard may fit awkwardly. The agent should refuse unsupported claims or mark their evidence boundary, which can also make a sparse source set visibly sparse. That is desirable for technical truth and frustrating for anyone who mainly wants a polished visual regardless of what the repository proves.
Installation deserves the same care. The natural-language instructions tell Codex or Claude Code to read SKILL.md, avoid overwriting an existing copy without permission, verify the installed path, and start a new task for discovery. The skills@1.5.23 release canary needs Node.js 22.20 or newer, although the installed skill runs on Node.js 18 or newer. Agent Skills inherit the host agent's permissions, so a zero-dependency package is not a zero-permission package.
Node.js 18 rendering stays offline; native Pages export does not
Node.js 18 can validate and render without a browser or network connection. The generated HTML contains no remote resources, XHR, WebSocket, eval, or HTML-string DOM insertion. A hash allowlist supplies its Content Security Policy. Cited HTTP links remain reader-facing references rather than runtime requests. Rendering is create-only by default, --force must be explicit for a known regular file, and symbolic links are always rejected.
Interactive export happens locally in a modern browser. PDF uses the print dialog, PNG produces a 1600 by 900 scene image, and PPTX or DOCX packages are built without third-party libraries. Native .pages is not faked by changing a filename: Apple Pages must save a real package that can reopen and contains its expected document data. That last route only works on macOS with Pages and the bundled loopback helper.
The loopback service binds to 127.0.0.1 on a chosen port, checks the exact origin and a rotating process token, validates generated DOCX and PNG structures, serializes conversion, and removes task-specific temporary files. The README correctly states the remaining boundary: those checks defend against cross-site browser requests, not other local processes. Anyone sharing a machine with untrusted local code should treat the helper accordingly.
121 stars are interest, not a release history
Fireworks Open ELI5 had 121 stars, 0 open issues and pull requests, and a last push on 2026-08-24. GitHub returned no latest release. The current push and CI file show active work, while an empty queue and no tags provide almost no evidence about support response or upgrade stability. Pin commit e90d5f9 if you need the exact behavior our sandbox measured.
Documentation is unusually exact for a small project. The README distinguishes installer and runtime versions, states storage privacy, names export verification boundaries, and explains what the loopback controls cannot stop. English and Simplified Chinese READMEs are available. Fireworks is a good fit when an answer must become a portable technical artifact with evidence beside each claim. If the audience only needs one diagram, Mermaid will be easier to edit and much easier to embed.