[JacobStephens2]

Summary

Make thirdshift.app's four public pages easier to discover and identify in search and link previews.

 homepage
-  slogan-only search title
+  GitHub issues to pull requests with coding agents
+  canonical URL and WebSite site-name data
 guide / manual / prompts
+  page-specific Open Graph and Twitter cards
+  canonical URL on prompts
+ robots.txt → sitemap.xml → all four canonical pages

The manual's metadata comes from its existing generator; the prompts page's changes are in its handwritten head. Clarify the homepage and prompts descriptions and the manual's search title. Preserve both implementations through the upstream reconciliation.

Closes #803

Evidence

• Before: The three new browser tests failed on the missing homepage canonical, missing sitemap advertisement, and missing site-name data.
  After: All three pass with JavaScript disabled. cd site && npm test passes all 16 tests, including generated manual consistency.
• cargo check, cargo fmt --check, cargo clippy --all-targets -- -D warnings, cargo test prompts_page (11 prompt checks), and python3 -m unittest discover -s scripts -p 'test_*.py' pass.
• Full Rust suite: cargo test passes. The final reconciliation changes only site files; the site suite and prompt-generation checks pass again after that merge.

Seams tested

• Public HTML as served to Chromium with JavaScript disabled: search/share metadata and homepage structured data.
• Served robots.txt and sitemap.xml: XML validity, four public URLs, reachable pages, and canonical agreement.

Review coverage

Independent Standards and Spec reviews used git diff main...HEAD, with main at 77ed4b40c6abf4a62c70397067605e36be13d771. Standards raised one minor duplication finding in the new tests, addressed in 13422a7 and confirmed resolved. Spec raised no findings. Both reviewers checked the final reconciliation at ba2bbcb and read all nine changed files, including the generated manual's changed HTML and its generator. Unread changed files: none. Generated-output exclusions: none.

Security guidance review of 77ed4b40c6abf4a62c70397067605e36be13d771...ba2bbcb9d7b31c7c416ab8e2bcae9f428559656f: all nine changed files and supporting documentation/prompt generation, browser client, test-server, CI and static-publication code reviewed. Applied injection, browser, HTTP, discovery/data-disclosure and generated-input/release guidance, with the repository's documented trust boundaries and ADR-0015. No introduced Security findings. Source inspection only; no proof-of-concept candidate required execution. No source changes or test execution in this session.

Unaddressed findings

• Standards: None.
• Spec: None.
• Security: None.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

Static metadata and crawler discovery files; reverting restores the previous site behavior.

Blast Radius: Site

Built with codex · gpt-6.1-sol · high

CI notes

• Run 39249267679 was cancelled after the newer PR run started: Linux and all four macOS shards report “The operation was canceled,” and the unchanged macOS aggregate rejects RESULT: cancelled; the branch diff changes only site files, and site-test passed.