|
| 1 | +--- |
| 2 | +inclusion: manual |
| 3 | +--- |
| 4 | + |
| 5 | +# Publicsite (codifide.com) — Rules |
| 6 | + |
| 7 | +## Version Sync — The Website Must Track the Code |
| 8 | + |
| 9 | +The publicsite is the agent-facing interface to Codifide. Stale content |
| 10 | +misleads agents and users. These rules are enforced by `dispatch-check` |
| 11 | +and are on the Sable auditor checklist. |
| 12 | + |
| 13 | +### Rules |
| 14 | + |
| 15 | +1. **`publicsite/capability.json` and `publicsite/capability.cbor` must be |
| 16 | + regenerated on every release.** Run: |
| 17 | + ```bash |
| 18 | + python3 -m codifide capability > /path/to/publicsite/capability.json |
| 19 | + python3 -m codifide capability --cbor > /path/to/publicsite/capability.cbor |
| 20 | + ``` |
| 21 | + The `generator` field in the published JSON must match the current |
| 22 | + `codifide-python-X.Y.Z` version. A mismatch is a release blocker. |
| 23 | + |
| 24 | +2. **The version stat in `index.html` must match the current release.** |
| 25 | + The `<span class="lang-stat-num">` element showing the version number |
| 26 | + (e.g. `v2.0`) must be updated on every release. The release description |
| 27 | + text alongside it must also reflect the new release. |
| 28 | + |
| 29 | +3. **Any agent-facing doc change (AGENT_QUICKREF.md, FOR_AGENTS.md, |
| 30 | + AGENT_COOKBOOK.md) must be reflected on the site** if the site links to |
| 31 | + or embeds that content. Check `index.html` for stale inline excerpts. |
| 32 | + |
| 33 | +4. **`dispatch-check` enforces rules 1 and 2 automatically.** It compares |
| 34 | + the `generator` field in `publicsite/capability.json` against the live |
| 35 | + manifest and checks the version stat in `index.html`. A mismatch causes |
| 36 | + `dispatch-check` to exit non-zero. |
| 37 | + |
| 38 | +5. **The publicsite update must be committed in the same session as the |
| 39 | + release.** Do not close a release session with a stale publicsite. |
| 40 | + |
| 41 | +### What "same session" means |
| 42 | + |
| 43 | +A release session ends when `dispatch-check` exits 0 and the |
| 44 | +session-close dispatch pair is filed. The publicsite sync must happen |
| 45 | +before that close, not after. |
| 46 | + |
| 47 | +--- |
| 48 | + |
| 49 | +## Vercel Content Security Policy |
| 50 | + |
| 51 | +The `vercel.json` for the publicsite enforces a strict CSP: |
| 52 | + |
| 53 | +``` |
| 54 | +style-src 'self' https://fonts.googleapis.com |
| 55 | +``` |
| 56 | + |
| 57 | +**This means inline `<style>` blocks are blocked by the browser and silently ignored.** |
| 58 | + |
| 59 | +### Rules |
| 60 | + |
| 61 | +1. **Never write inline `<style>` blocks in any HTML file deployed to Vercel.** They will be blocked by the CSP and the page will render unstyled. |
| 62 | + |
| 63 | +2. **All CSS must be in external `.css` files** referenced via `<link rel="stylesheet" href="...">`. |
| 64 | + |
| 65 | +3. **When adding a new page**, create a corresponding `.css` file (e.g. `launch.html` → `launch.css`) and link it externally. |
| 66 | + |
| 67 | +4. **The main design system is `styles.css`** — always link this first, then any page-specific CSS file second. |
| 68 | + |
| 69 | +5. **Do not add `'unsafe-inline'` to the CSP** to work around this — fix the CSS instead. |
| 70 | + |
| 71 | +### Example |
| 72 | + |
| 73 | +Wrong: |
| 74 | +```html |
| 75 | +<style> |
| 76 | + .my-class { color: red; } |
| 77 | +</style> |
| 78 | +``` |
| 79 | + |
| 80 | +Right: |
| 81 | +```html |
| 82 | +<link rel="stylesheet" href="my-page.css" /> |
| 83 | +``` |
0 commit comments