Harden the public Gloss launch

launch/verify-launch.mjs

@@ -19,6 +19,9 @@ const report = JSON.parse(readFileSync(reportPath, "utf8"));
 const index = JSON.parse(readFileSync(indexPath, "utf8"));
 const requirements = JSON.parse(readFileSync(requirementsPath, "utf8"));
 const html = readFileSync(join(site, "index.html"), "utf8");
+const headers = readFileSync(join(site, "_headers"), "utf8");
+const robots = readFileSync(join(site, "robots.txt"), "utf8");
+const sitemap = readFileSync(join(site, "sitemap.xml"), "utf8");
 
 function assert(condition, message) {
   if (!condition) throw new Error(message);
@@ -82,6 +85,18 @@ const requiredCopy = [
 for (const copy of requiredCopy) assert(html.includes(copy), `Homepage is missing required copy: ${copy}`);
 assert(!/official leaderboard[^<]{0,80}(live|launched|ready)/i.test(html), "Homepage overclaims official leaderboard readiness");
 assert(html.includes("https://github.com/aronchick/gloss"), "Homepage must lead to GitHub");
+assert(html.includes('<link rel="canonical" href="https://gloss.tools/">'), "Homepage canonical URL is missing");
+assert(html.includes('"codeRepository": "https://github.com/aronchick/gloss"'), "Homepage structured data must lead to GitHub");
+assert(robots.includes("Allow: /") && robots.includes("Sitemap: https://gloss.tools/sitemap.xml"), "robots.txt must expose the public site map");
+assert(sitemap.includes("<loc>https://gloss.tools/</loc>"), "sitemap.xml must contain the production homepage");
+for (const header of [
+  "X-Content-Type-Options: nosniff",
+  "Referrer-Policy: strict-origin-when-cross-origin",
+  "Permissions-Policy: camera=(), microphone=(), geolocation=()",
+  "X-Frame-Options: DENY",
+]) {
+  assert(headers.includes(header), `Cloudflare Pages header is missing: ${header}`);
+}
 
 const localAssetPattern = /(?:href|src)="\/(?!\/)([^"?#]*)/g;
 for (const match of html.matchAll(localAssetPattern)) {

site/_headers

@@ -0,0 +1,11 @@
+/*
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+  Permissions-Policy: camera=(), microphone=(), geolocation=()
+  X-Frame-Options: DENY
+
+/evidence/*
+  Cache-Control: public, max-age=300, must-revalidate
+
+/media/*
+  Cache-Control: public, max-age=3600

site/index.html

@@ -4,17 +4,34 @@
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <meta name="description" content="Gloss is the open benchmark for generated PowerPoint files that need to look right and be built right. Inspect the evidence and contribute on GitHub.">
+    <meta name="robots" content="index,follow,max-image-preview:large">
     <meta name="theme-color" content="#f4f6fa">
+    <link rel="canonical" href="https://gloss.tools/">
+    <link rel="sitemap" type="application/xml" href="/sitemap.xml">
     <meta property="og:title" content="Gloss — a screenshot is not a PowerPoint">
     <meta property="og:description" content="An open benchmark for visual fidelity and native OOXML structure. Built in public on GitHub.">
     <meta property="og:image" content="https://gloss.tools/media/gloss-launch-poster.png">
+    <meta property="og:site_name" content="Gloss">
     <meta property="og:type" content="website">
     <meta property="og:url" content="https://gloss.tools">
     <meta name="twitter:card" content="summary_large_image">
     <title>Gloss — a screenshot is not a PowerPoint</title>
     <link rel="icon" href="/favicon.svg" type="image/svg+xml">
     <link rel="stylesheet" href="/site.css">
     <script src="/site.js" defer></script>
+    <script type="application/ld+json">
+      {
+        "@context": "https://schema.org",
+        "@type": "SoftwareSourceCode",
+        "name": "Gloss",
+        "alternateName": "Generative Layout & OOXML Scoring System",
+        "description": "An open benchmark for generated PowerPoint files that measures rendered fidelity and native OOXML structure.",
+        "url": "https://gloss.tools/",
+        "codeRepository": "https://github.com/aronchick/gloss",
+        "license": "https://www.apache.org/licenses/LICENSE-2.0",
+        "programmingLanguage": ["Python", "JavaScript"]
+      }
+    </script>
   </head>
   <body>
     <a class="skip-link" href="#main">Skip to content</a>

site/robots.txt

@@ -0,0 +1,4 @@
+User-agent: *
+Allow: /
+
+Sitemap: https://gloss.tools/sitemap.xml

site/sitemap.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
+  <url>
+    <loc>https://gloss.tools/</loc>
+    <changefreq>weekly</changefreq>
+    <priority>1.0</priority>
+  </url>
+</urlset>