From 11dad76f3e64fff65ad1473518b11b7c48913f63 Mon Sep 17 00:00:00 2001
From: Zoey Rose <zoey@zoeysr.com>
Date: Tue, 11 Aug 2026 16:08:59 +0000
Subject: [PATCH 1/6] feat(metadata): add structured site identity

---
 PROVENANCE.md                |   7 ++
 README.md                    |  20 +++-
 THIRD_PARTY_NOTICES.md       |   4 +
 contracts/icon.schema.json   |  44 +++++++
 docs/ARCHITECTURE.md         |  37 ++++--
 public/favicon.svg           |   8 ++
 public/mask-icon.svg         |   4 +
 src/data/icons.json          |  39 +++++++
 src/layouts/Base.astro       | 101 ++++++++++-------
 src/lib/metadata.ts          | 128 +++++++++++++++++++++
 src/pages/404.astro          |  13 ++-
 src/pages/about.astro        |  14 ++-
 src/pages/downloads.astro    |  12 +-
 src/pages/index.astro        |   9 +-
 src/pages/licenses.astro     |  14 ++-
 tools/site-contract.mjs      | 214 +++++++++++++++++++++++++++++++++--
 tools/site-contract.test.mjs |  80 +++++++++++++
 tools/validate.mjs           |  75 ++++++++++++
 18 files changed, 750 insertions(+), 73 deletions(-)
 create mode 100644 contracts/icon.schema.json
 create mode 100644 public/favicon.svg
 create mode 100644 public/mask-icon.svg
 create mode 100644 src/data/icons.json
 create mode 100644 src/lib/metadata.ts

diff --git a/PROVENANCE.md b/PROVENANCE.md
index a6b984e..650c53a 100644
--- a/PROVENANCE.md
+++ b/PROVENANCE.md
@@ -23,6 +23,13 @@ immutable Git blob object IDs, source and published digests, published
 dimensions, transformations, license, notices, and alternative text in
 `src/data/media.json`.
 
+The crystal favicon and pinned-tab mask under `public/` are new MIT-licensed
+vector artwork authored for website issue #27 by Zoey Rose with Codex
+implementation assistance. Their exact source paths, Git blob object IDs,
+SHA-256 digests, dimensions, transformations, purposes, and notices are closed
+records in `src/data/icons.json`; the checked-in SVG is both retained source and
+published file.
+
 The synthetic download and media records under `tools/` are contract-only test
 data. They do not name or contain a real release or asset and are never
 published by Astro. `src/data/downloads.json` remains empty until exact
diff --git a/README.md b/README.md
index 4ea8610..21b4816 100644
--- a/README.md
+++ b/README.md
@@ -53,6 +53,20 @@ from `public/media/`; their exact source Git blob object IDs, digests,
 dimensions, transformations, licenses, notices, and alternative text are
 recorded in `src/data/media.json`.
 
+Every indexable route constructs a closed, typed page identity through
+`src/lib/metadata.ts`: one unique title and description, canonical URL, robots
+policy, internally consistent Open Graph/Twitter fields, preview image
+dimensions, and alternative text. `atrinik-now` is the documented sitewide
+preview fallback until issue #22 supplies approved replacement artwork; routes
+can select a more relevant record from the same validated media catalog. The
+homepage also emits the canonical Atrinik `WebSite` identity as safely
+serialized inert JSON-LD. The 404 is noindex and deliberately has no canonical,
+social-preview, or structured identity.
+
+The new crystal favicon and pinned-tab mask are compact repository-authored SVG
+files. Their closed authorship, license, source, hash, Git blob, dimensions,
+transformation, purpose, and notice records live in `src/data/icons.json`.
+
 ## Development
 
 Use Node 24.18.1 and npm 11.16.0:
@@ -67,8 +81,10 @@ npm run deploy:dry-run
 The build writes a self-contained static site to `dist/`. Validation rejects
 unproven media, mutable download coordinates, missing attribution or alt text,
 unsafe links, repository-authored client JavaScript, broken internal links, and
-page-weight budget violations. Generated release evidence belongs under ignored
-`build/`.
+page-weight budget violations. It permits only inert, locally serialized
+`type="application/ld+json"` data blocks; executable scripts, script sources,
+event handlers, and JavaScript assets remain forbidden. Generated release
+evidence belongs under ignored `build/`.
 
 `src/data/downloads.json` is a reviewed immutable catalog, not a live release
 feed. Its closed schema keeps a release repository separate from an artifact
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 27ced8b..b0e684d 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -26,3 +26,7 @@ lockfile.
 
 Linked game packages and authored content are not distributed by this source
 repository and retain their own exact licenses and notices.
+
+The favicon and pinned-tab mask are new MIT-licensed repository artwork, not
+third-party game assets. Their authorship and immutable provenance bindings are
+recorded in `src/data/icons.json` and `PROVENANCE.md`.
diff --git a/contracts/icon.schema.json b/contracts/icon.schema.json
new file mode 100644
index 0000000..16a0afe
--- /dev/null
+++ b/contracts/icon.schema.json
@@ -0,0 +1,44 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://atrinik.org/contracts/icon.schema.json",
+  "title": "Atrinik website icon provenance record",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "id",
+    "publicPath",
+    "sourceRepository",
+    "sourcePath",
+    "sourceRevision",
+    "sourceSha256",
+    "publishedSha256",
+    "width",
+    "height",
+    "author",
+    "license",
+    "transformations",
+    "purpose",
+    "notice"
+  ],
+  "properties": {
+    "id": { "type": "string", "pattern": "^[a-z][a-z0-9-]*$" },
+    "publicPath": { "enum": ["/favicon.svg", "/mask-icon.svg"] },
+    "sourceRepository": { "const": "atrinik/website" },
+    "sourcePath": { "type": "string", "pattern": "^public/[a-z-]+\\.svg$" },
+    "sourceRevision": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
+    "sourceSha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "publishedSha256": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+    "width": { "const": 64 },
+    "height": { "const": 64 },
+    "author": { "type": "string", "minLength": 1, "maxLength": 200 },
+    "license": { "const": "MIT" },
+    "transformations": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 10,
+      "items": { "type": "string", "minLength": 1, "maxLength": 300 }
+    },
+    "purpose": { "type": "string", "minLength": 1, "maxLength": 300 },
+    "notice": { "type": "string", "minLength": 1, "maxLength": 500 }
+  }
+}
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 11fc770..0df485c 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -1,12 +1,25 @@
 # Static website architecture
 
 Astro compiles typed local data and `.astro` templates to static HTML and CSS.
-No browser JavaScript or server runtime is emitted by the build. `src/data` is
-the schema-validated structured metadata and catalog input, while `.astro`
-templates contain authored page prose. Closed validators reject unknown
-download/media fields and unsafe coordinates before rendering. Cloudflare can
-transform a deployed response after this build boundary; provider-injected
-security or performance code is not part of `dist/` and is audited separately.
+No browser JavaScript or server runtime is emitted by the build. The only
+permitted `script` element is inert `type="application/ld+json"` data generated
+locally with `<`, `>`, `&`, and JavaScript line separators escaped before raw
+HTML insertion. `src/data` is the schema-validated catalog input, the typed
+metadata factory owns page identity, and `.astro` templates contain authored
+page prose. Closed validators reject unknown download/media/icon fields and
+unsafe coordinates before rendering. Cloudflare can transform a deployed
+response after this build boundary; provider-injected security or performance
+code is not part of `dist/` and is audited separately.
+
+Every indexable page supplies an explicit metadata object with a unique title,
+description, canonical route, index policy, and matched Open Graph/Twitter
+identity. Social images resolve only through `src/data/media.json`, including
+their canonical local URL, dimensions, and alternative text. The temporary
+`atrinik-now` concept image is the explicit sitewide fallback pending issue #22;
+pages may choose a more relevant proven catalog record. The homepage alone owns
+the canonical `WebSite` JSON-LD record for `https://atrinik.org/` and its two
+verified Atrinik GitHub identities. The 404 emits no canonical, preview, or
+structured identity and retains `noindex, nofollow`.
 
 Downloads remain in their owning GitHub releases. Catalog schema version 2
 separates the release repository from the artifact's logical role and marks at
@@ -32,6 +45,13 @@ exact license, transformations, alt text, and notice. Same-repository sources
 are digest-checked from a traversal-safe path. The website never imports an
 asset tree by implication.
 
+The two SVG site icons use a separate closed catalog because they are
+repository-native vector interface artwork rather than page media. Each record
+binds the exact checked-in source/published bytes to a Git blob object ID and
+SHA-256, 64×64 view box, author, MIT license, transformation, purpose, and
+notice. Source validation rejects SVG scripts, event attributes, and external
+references; built pages must link both canonical local files.
+
 The executable validator checks the JSON Schema's locally expressible field
 sets, patterns, formats, bounds, constants, primary-artifact restrictions, and
 archive suffix rules on every run, without adding a general-purpose runtime
@@ -43,7 +63,10 @@ the reviewed Classic release. Tests exercise valid and adversarial forms and
 contract changes must update both representations and their fixtures together.
 
 `public/_headers` supplies a no-script CSP and browser hardening for every
-static response. The built-output validator additionally enforces at most 16
+static response. Inert JSON-LD does not relax `script-src 'none'`. The
+built-output validator rejects every other script element or script attribute,
+parses the JSON-LD, compares it with visible metadata and canonical identity,
+and additionally enforces at most 16
 generated files, 900,000 bytes total, 140,000 aggregate HTML bytes, 40,000
 aggregate CSS bytes, 700,000 aggregate raster image bytes, and zero JavaScript.
 Published image filenames are content-addressed for immutable caching, and
diff --git a/public/favicon.svg b/public/favicon.svg
new file mode 100644
index 0000000..b8ce07b
--- /dev/null
+++ b/public/favicon.svg
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Atrinik crystal</title>
+  <rect width="64" height="64" rx="12" fill="#07111d"/>
+  <path d="M32 7 48 22 40 53H24L16 22 32 7Z" fill="#77e6ff"/>
+  <path d="m32 7 8 46H24L32 7Z" fill="#2e8fff"/>
+  <path d="m16 22 16 7 16-7-8 31H24L16 22Z" fill="#154f91" opacity=".78"/>
+  <path d="M32 7v22l16-7M32 29 16 22" fill="none" stroke="#d8fbff" stroke-width="2" stroke-linejoin="round"/>
+</svg>
diff --git a/public/mask-icon.svg b/public/mask-icon.svg
new file mode 100644
index 0000000..96bc7f2
--- /dev/null
+++ b/public/mask-icon.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <title>Atrinik crystal mask</title>
+  <path d="M32 4 52 22 42 58H22L12 22 32 4Zm0 8-12 12 8 28h8l8-28-12-12Z"/>
+</svg>
diff --git a/src/data/icons.json b/src/data/icons.json
new file mode 100644
index 0000000..a47af6d
--- /dev/null
+++ b/src/data/icons.json
@@ -0,0 +1,39 @@
+{
+  "schemaVersion": 1,
+  "entries": [
+    {
+      "id": "atrinik-favicon",
+      "publicPath": "/favicon.svg",
+      "sourceRepository": "atrinik/website",
+      "sourcePath": "public/favicon.svg",
+      "sourceRevision": "b8ce07b4d6eb9d134268b1f13fba95290f6bb5c2",
+      "sourceSha256": "8b5a901b27d14d2c57bcd844febea646e026cb7ccb34a611837212a2da18ef45",
+      "publishedSha256": "8b5a901b27d14d2c57bcd844febea646e026cb7ccb34a611837212a2da18ef45",
+      "width": 64,
+      "height": 64,
+      "author": "Zoey Rose with Codex implementation assistance",
+      "license": "MIT",
+      "transformations": ["Authored directly as a compact SVG favicon."],
+      "purpose": "Browser favicon depicting the Atrinik crystal mark.",
+      "notice": "New repository-native vector artwork created for atrinik/website issue #27."
+    },
+    {
+      "id": "atrinik-mask-icon",
+      "publicPath": "/mask-icon.svg",
+      "sourceRepository": "atrinik/website",
+      "sourcePath": "public/mask-icon.svg",
+      "sourceRevision": "96bc7f293ea2a809ac45cdb0094cb82862cb2dde",
+      "sourceSha256": "84a60770868f27e7d1ac169d90c62f9293bd57e2b238117a699673f2e92535a2",
+      "publishedSha256": "84a60770868f27e7d1ac169d90c62f9293bd57e2b238117a699673f2e92535a2",
+      "width": 64,
+      "height": 64,
+      "author": "Zoey Rose with Codex implementation assistance",
+      "license": "MIT",
+      "transformations": [
+        "Simplified from the new favicon geometry into a monochrome SVG mask."
+      ],
+      "purpose": "Pinned-tab mask icon depicting the Atrinik crystal mark.",
+      "notice": "New repository-native vector artwork created for atrinik/website issue #27."
+    }
+  ]
+}
diff --git a/src/layouts/Base.astro b/src/layouts/Base.astro
index 18bf9c3..dc91e4e 100644
--- a/src/layouts/Base.astro
+++ b/src/layouts/Base.astro
@@ -1,29 +1,16 @@
 ---
 import site from "../data/site.json";
-import media from "../data/media.json";
 import "../styles/global.css";
+import type { PageMetadata } from "../lib/metadata";
+import { serializeJsonLd } from "../lib/metadata";
 
 interface Props {
-  title?: string;
-  description?: string;
-  canonicalPath?: string;
+  metadata: PageMetadata;
   preloadImage?: string;
-  noindex?: boolean;
 }
 
-const title = Astro.props.title
-  ? `${Astro.props.title} · ${site.title}`
-  : site.title;
-const description = Astro.props.description ?? site.description;
-const canonical = new URL(
-  Astro.props.canonicalPath ?? Astro.url.pathname,
-  site.canonicalOrigin,
-);
+const { metadata } = Astro.props;
 const currentPath = Astro.url.pathname;
-const socialImage = media.entries.find((entry) => entry.id === "atrinik-now");
-if (!socialImage) throw new Error("missing social media record: atrinik-now");
-const socialImageUrl = new URL(socialImage.publicPath, site.canonicalOrigin);
-const socialImageAlt = `Temporary OpenAI-generated website concept artwork: ${socialImage.alt}`;
 const navigation = [
   { label: "Home", href: "/" },
   { label: "About", href: "/about/" },
@@ -39,29 +26,67 @@ const isCurrent = (href: string) =>
   <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width" />
-    <meta name="description" content={description} />
+    <meta name="description" content={metadata.description} />
+    <meta name="robots" content={metadata.robots} />
+    <meta name="color-scheme" content="dark" />
+    <meta name="theme-color" content="#07111d" />
+    <link rel="icon" href="/favicon.svg" type="image/svg+xml" sizes="any" />
+    <link rel="mask-icon" href="/mask-icon.svg" color="#77e6ff" />
     {
-      Astro.props.noindex ? (
-        <meta name="robots" content="noindex, nofollow" />
+      metadata.canonicalUrl ? (
+        <link rel="canonical" href={metadata.canonicalUrl} />
       ) : null
     }
-    <meta name="color-scheme" content="dark" />
-    <meta name="theme-color" content="#07111d" />
-    <link rel="canonical" href={canonical} />
-    <meta property="og:type" content="website" />
-    <meta property="og:site_name" content={site.title} />
-    <meta property="og:title" content={title} />
-    <meta property="og:description" content={description} />
-    <meta property="og:url" content={canonical} />
-    <meta property="og:image" content={socialImageUrl} />
-    <meta property="og:image:alt" content={socialImageAlt} />
-    <meta property="og:image:width" content={String(socialImage.width)} />
-    <meta property="og:image:height" content={String(socialImage.height)} />
-    <meta name="twitter:card" content="summary_large_image" />
-    <meta name="twitter:title" content={title} />
-    <meta name="twitter:description" content={description} />
-    <meta name="twitter:image" content={socialImageUrl} />
-    <meta name="twitter:image:alt" content={socialImageAlt} />
+    {
+      metadata.openGraph ? (
+        <>
+          <meta property="og:type" content={metadata.openGraph.type} />
+          <meta property="og:site_name" content={site.title} />
+          <meta property="og:title" content={metadata.openGraph.title} />
+          <meta
+            property="og:description"
+            content={metadata.openGraph.description}
+          />
+          <meta property="og:url" content={metadata.openGraph.url} />
+          <meta property="og:image" content={metadata.openGraph.image.url} />
+          <meta
+            property="og:image:alt"
+            content={metadata.openGraph.image.alt}
+          />
+          <meta
+            property="og:image:width"
+            content={String(metadata.openGraph.image.width)}
+          />
+          <meta
+            property="og:image:height"
+            content={String(metadata.openGraph.image.height)}
+          />
+        </>
+      ) : null
+    }
+    {
+      metadata.twitter ? (
+        <>
+          <meta name="twitter:card" content={metadata.twitter.card} />
+          <meta name="twitter:title" content={metadata.twitter.title} />
+          <meta
+            name="twitter:description"
+            content={metadata.twitter.description}
+          />
+          <meta name="twitter:image" content={metadata.twitter.image.url} />
+          <meta name="twitter:image:alt" content={metadata.twitter.image.alt} />
+        </>
+      ) : null
+    }
+    {
+      metadata.structuredData?.map((record) => (
+        <script
+          type="application/ld+json"
+          is:inline
+          set:html={serializeJsonLd(record)}
+        />
+      ))
+    }
     {
       Astro.props.preloadImage ? (
         <link
@@ -72,7 +97,7 @@ const isCurrent = (href: string) =>
         />
       ) : null
     }
-    <title>{title}</title>
+    <title>{metadata.title}</title>
   </head>
   <body>
     <a class="skip-link" href="#content">Skip to content</a>
diff --git a/src/lib/metadata.ts b/src/lib/metadata.ts
new file mode 100644
index 0000000..89f65da
--- /dev/null
+++ b/src/lib/metadata.ts
@@ -0,0 +1,128 @@
+import media from "../data/media.json";
+import site from "../data/site.json";
+
+export type RobotsPolicy = "index, follow" | "noindex, nofollow";
+export type OpenGraphType = "website";
+export type TwitterCard = "summary_large_image";
+
+export interface SocialImageMetadata {
+  url: string;
+  width: number;
+  height: number;
+  alt: string;
+}
+
+export interface PageMetadata {
+  title: string;
+  description: string;
+  robots: RobotsPolicy;
+  canonicalUrl?: string;
+  openGraph?: {
+    type: OpenGraphType;
+    title: string;
+    description: string;
+    url: string;
+    image: SocialImageMetadata;
+  };
+  twitter?: {
+    card: TwitterCard;
+    title: string;
+    description: string;
+    image: SocialImageMetadata;
+  };
+  structuredData?: JsonLdValue[];
+}
+
+type JsonLdScalar = string | number | boolean | null;
+export type JsonLdValue =
+  JsonLdScalar | JsonLdValue[] | { [key: string]: JsonLdValue };
+
+interface IndexablePageInput {
+  title: string;
+  description: string;
+  canonicalPath: `/${string}`;
+  socialImageId?: string;
+  structuredData?: JsonLdValue[];
+}
+
+interface NoindexPageInput {
+  title: string;
+  description: string;
+}
+
+// This generated concept image is the explicit sitewide preview fallback until
+// issue #22 supplies provenance-cleared human-created preview artwork.
+export const SOCIAL_IMAGE_FALLBACK_ID = "atrinik-now";
+
+function socialImage(id: string): SocialImageMetadata {
+  const record = media.entries.find((entry) => entry.id === id);
+  if (!record) throw new Error(`missing social media record: ${id}`);
+  return {
+    url: new URL(record.publicPath, site.canonicalOrigin).href,
+    width: record.width,
+    height: record.height,
+    alt: `Temporary OpenAI-generated website concept artwork: ${record.alt}`,
+  };
+}
+
+export function indexablePage({
+  title,
+  description,
+  canonicalPath,
+  socialImageId = SOCIAL_IMAGE_FALLBACK_ID,
+  structuredData,
+}: IndexablePageInput): PageMetadata {
+  const canonicalUrl = new URL(canonicalPath, site.canonicalOrigin).href;
+  const image = socialImage(socialImageId);
+  return {
+    title,
+    description,
+    robots: "index, follow",
+    canonicalUrl,
+    openGraph: {
+      type: "website",
+      title,
+      description,
+      url: canonicalUrl,
+      image,
+    },
+    twitter: {
+      card: "summary_large_image",
+      title,
+      description,
+      image,
+    },
+    ...(structuredData ? { structuredData } : {}),
+  };
+}
+
+export function noindexPage({
+  title,
+  description,
+}: NoindexPageInput): PageMetadata {
+  return { title, description, robots: "noindex, nofollow" };
+}
+
+export function websiteIdentity(): JsonLdValue {
+  return {
+    "@context": "https://schema.org",
+    "@type": "WebSite",
+    "@id": "https://atrinik.org/#website",
+    url: "https://atrinik.org/",
+    name: site.title,
+    description: site.description,
+    sameAs: [
+      "https://github.com/atrinik",
+      "https://github.com/atrinik/website",
+    ],
+  };
+}
+
+export function serializeJsonLd(value: JsonLdValue): string {
+  return JSON.stringify(value)
+    .replaceAll("<", "\\u003c")
+    .replaceAll(">", "\\u003e")
+    .replaceAll("&", "\\u0026")
+    .replaceAll("\u2028", "\\u2028")
+    .replaceAll("\u2029", "\\u2029");
+}
diff --git a/src/pages/404.astro b/src/pages/404.astro
index d112ae4..663b742 100644
--- a/src/pages/404.astro
+++ b/src/pages/404.astro
@@ -1,13 +1,14 @@
 ---
 import Base from "../layouts/Base.astro";
+import { noindexPage } from "../lib/metadata";
+
+const metadata = noindexPage({
+  title: "Page not found · Atrinik",
+  description: "The requested Atrinik page could not be found.",
+});
 ---
 
-<Base
-  title="Page not found"
-  description="The requested Atrinik page could not be found."
-  canonicalPath="/404.html"
-  noindex={true}
->
+<Base metadata={metadata}>
   <header class="page-hero">
     <p class="eyebrow">Error 404</p>
     <h1 class="page-title">This path is lost to the mist.</h1>
diff --git a/src/pages/about.astro b/src/pages/about.astro
index 026bc1b..107d643 100644
--- a/src/pages/about.astro
+++ b/src/pages/about.astro
@@ -1,11 +1,17 @@
 ---
 import Base from "../layouts/Base.astro";
+import { indexablePage } from "../lib/metadata";
+
+const metadata = indexablePage({
+  title: "About Atrinik: Human imagination and open development",
+  description:
+    "Atrinik began in 2009 as a human-developed open-source world. Learn how human creative direction, agentic software work, and direct contributions shape it today.",
+  canonicalPath: "/about/",
+  socialImageId: "atrinik-then",
+});
 ---
 
-<Base
-  title="About"
-  description="Atrinik began in 2009 as a human-developed open-source world. Today its software is maintained and reimplemented primarily through Codex-driven workflows while human code contributions remain welcome."
->
+<Base metadata={metadata}>
   <header class="page-hero">
     <p class="eyebrow">About Atrinik</p>
     <h1 class="page-title">Human imagination. Agentic engineering.</h1>
diff --git a/src/pages/downloads.astro b/src/pages/downloads.astro
index fea7f20..cb322d7 100644
--- a/src/pages/downloads.astro
+++ b/src/pages/downloads.astro
@@ -4,14 +4,18 @@ import DownloadCatalog from "../components/DownloadCatalog.astro";
 import DownloadPrimaryAction from "../components/DownloadPrimaryAction.astro";
 import downloads from "../data/downloads.json";
 import type { DownloadCatalog as DownloadCatalogType } from "../lib/downloads";
+import { indexablePage } from "../lib/metadata";
 
 const catalog: DownloadCatalogType = downloads;
+const metadata = indexablePage({
+  title: "Atrinik Classic downloads and release status",
+  description:
+    "Find the maintained Atrinik Classic release path, verify available packages, and understand why the replacement foundations are not yet a complete game download.",
+  canonicalPath: "/downloads/",
+});
 ---
 
-<Base
-  title="Downloads"
-  description="Find the unified, maintained Atrinik Classic releases and learn the status of the independently released replacement foundations."
->
+<Base metadata={metadata}>
   <header class="page-hero">
     <p class="eyebrow">Choose your path</p>
     <h1 class="page-title">Play the classic. Follow what comes next.</h1>
diff --git a/src/pages/index.astro b/src/pages/index.astro
index 9a75b1a..3e7a918 100644
--- a/src/pages/index.astro
+++ b/src/pages/index.astro
@@ -2,6 +2,7 @@
 import Base from "../layouts/Base.astro";
 import media from "../data/media.json";
 import site from "../data/site.json";
+import { indexablePage, websiteIdentity } from "../lib/metadata";
 
 const getMedia = (id: string) => {
   const record = media.entries.find((entry) => entry.id === id);
@@ -10,6 +11,12 @@ const getMedia = (id: string) => {
 };
 
 const crystal = getMedia("great-blue-crystal");
+const metadata = indexablePage({
+  title: "Atrinik: A world of crystal, memory, and unfinished paths",
+  description: site.description,
+  canonicalPath: "/",
+  structuredData: [websiteIdentity()],
+});
 const chronicle = [
   {
     media: getMedia("atrinik-then"),
@@ -32,7 +39,7 @@ const chronicle = [
 ];
 ---
 
-<Base preloadImage={crystal.publicPath}>
+<Base metadata={metadata} preloadImage={crystal.publicPath}>
   <section class="home-hero" aria-labelledby="hero-title">
     <div class="hero-copy">
       <p class="eyebrow">An open-source role-playing world</p>
diff --git a/src/pages/licenses.astro b/src/pages/licenses.astro
index 8fd8df7..8bcfecd 100644
--- a/src/pages/licenses.astro
+++ b/src/pages/licenses.astro
@@ -1,12 +1,18 @@
 ---
 import Base from "../layouts/Base.astro";
 import site from "../data/site.json";
+import { indexablePage } from "../lib/metadata";
+
+const metadata = indexablePage({
+  title: "Atrinik authorship, provenance, and license boundaries",
+  description:
+    "Understand the distinct authorship, provenance, attribution, and license boundaries for Atrinik software, game content, and website presentation media.",
+  canonicalPath: "/licenses/",
+  socialImageId: "atrinik-beyond",
+});
 ---
 
-<Base
-  title="Licenses"
-  description="Understand Atrinik's human-directed content policy, attribution, provenance, and license boundaries for creative game content, agentically developed software, and temporary generated website media."
->
+<Base metadata={metadata}>
   <header class="page-hero">
     <p class="eyebrow">Licenses and provenance</p>
     <h1 class="page-title">Every part keeps its own terms.</h1>
diff --git a/tools/site-contract.mjs b/tools/site-contract.mjs
index 46922da..80efa6d 100644
--- a/tools/site-contract.mjs
+++ b/tools/site-contract.mjs
@@ -448,6 +448,65 @@ export function validateMedia(record) {
     throw new Error("invalid media transformations");
 }
 
+export function validateIcon(record) {
+  const required = [
+    "id",
+    "publicPath",
+    "sourceRepository",
+    "sourcePath",
+    "sourceRevision",
+    "sourceSha256",
+    "publishedSha256",
+    "width",
+    "height",
+    "author",
+    "license",
+    "transformations",
+    "purpose",
+    "notice",
+  ];
+  if (Object.keys(record).sort().join("\n") !== required.sort().join("\n"))
+    throw new Error("icon fields differ from the closed contract");
+  if (
+    !/^[a-z][a-z0-9-]*$/u.test(record.id) ||
+    !new Set(["/favicon.svg", "/mask-icon.svg"]).has(record.publicPath) ||
+    record.sourcePath !== `public${record.publicPath}` ||
+    record.sourceRepository !== "atrinik/website"
+  )
+    throw new Error("invalid icon identity/path");
+  if (
+    !revisionPattern.test(record.sourceRevision) ||
+    !sha256Pattern.test(record.sourceSha256) ||
+    !sha256Pattern.test(record.publishedSha256) ||
+    record.sourceSha256 !== record.publishedSha256
+  )
+    throw new Error("invalid icon digest");
+  if (record.width !== 64 || record.height !== 64)
+    throw new Error("invalid icon dimensions");
+  for (const field of ["author", "purpose", "notice"])
+    if (
+      typeof record[field] !== "string" ||
+      record[field].trim() !== record[field] ||
+      record[field].length === 0 ||
+      record[field].length > 500
+    )
+      throw new Error(`invalid icon ${field}`);
+  if (
+    record.license !== "MIT" ||
+    !Array.isArray(record.transformations) ||
+    record.transformations.length < 1 ||
+    record.transformations.length > 10 ||
+    record.transformations.some(
+      (item) =>
+        typeof item !== "string" ||
+        item.trim() !== item ||
+        item.length === 0 ||
+        item.length > 300,
+    )
+  )
+    throw new Error("invalid icon license or transformations");
+}
+
 export async function readJson(path) {
   return JSON.parse(await readFile(path, "utf8"));
 }
@@ -624,6 +683,138 @@ function decodeHtmlAttribute(value) {
     .replaceAll("&amp;", "&");
 }
 
+function metadataContent(html, attribute, key) {
+  const pattern = new RegExp(
+    `<meta ${attribute}="${key.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}" content="([^"]+)"\\s*/?>`,
+    "gu",
+  );
+  const values = [...html.matchAll(pattern)].map((match) =>
+    decodeHtmlAttribute(match[1]),
+  );
+  if (values.length !== 1)
+    throw new Error(`metadata must contain exactly one ${key}`);
+  return values[0];
+}
+
+export function parseInertJsonLd(html) {
+  const scripts = [
+    ...html.matchAll(/<script\b([^>]*)>([\s\S]*?)<\/script>/giu),
+  ];
+  if ([...html.matchAll(/<script\b/giu)].length !== scripts.length)
+    throw new Error("malformed or unclosed script block");
+  return scripts.map(([, rawAttributes, body]) => {
+    if (rawAttributes.trim() !== 'type="application/ld+json"')
+      throw new Error("executable or attributed script block forbidden");
+    if (/[<>&\u2028\u2029]/u.test(body))
+      throw new Error("JSON-LD is not safely serialized");
+    try {
+      return JSON.parse(body);
+    } catch {
+      throw new Error("JSON-LD is not valid JSON");
+    }
+  });
+}
+
+export function validatePageMetadata(
+  html,
+  { canonicalUrl = null, websiteIdentity = false } = {},
+) {
+  const titleMatches = [...html.matchAll(/<title>([^<]+)<\/title>/gu)];
+  if (titleMatches.length !== 1)
+    throw new Error("metadata must contain exactly one title");
+  const title = decodeHtmlAttribute(titleMatches[0][1]);
+  const description = metadataContent(html, "name", "description");
+  const robots = metadataContent(html, "name", "robots");
+  const jsonLd = parseInertJsonLd(html);
+  const canonicalMatches = [
+    ...html.matchAll(/<link rel="canonical" href="([^"]+)"\s*\/?>/gu),
+  ];
+
+  if (canonicalUrl === null) {
+    if (
+      robots !== "noindex, nofollow" ||
+      canonicalMatches.length !== 0 ||
+      /<meta (?:property="og:|name="twitter:)/u.test(html) ||
+      jsonLd.length !== 0
+    )
+      throw new Error(
+        "noindex page acquired canonical, preview, or structured identity",
+      );
+    return { title, description, canonicalUrl: null };
+  }
+
+  if (robots !== "index, follow")
+    throw new Error("indexable page has the wrong robots policy");
+  if (
+    canonicalMatches.length !== 1 ||
+    decodeHtmlAttribute(canonicalMatches[0][1]) !== canonicalUrl
+  )
+    throw new Error("page canonical differs from its route contract");
+  const ogType = metadataContent(html, "property", "og:type");
+  const ogTitle = metadataContent(html, "property", "og:title");
+  const ogDescription = metadataContent(html, "property", "og:description");
+  const ogUrl = metadataContent(html, "property", "og:url");
+  const ogImage = metadataContent(html, "property", "og:image");
+  const ogImageAlt = metadataContent(html, "property", "og:image:alt");
+  const ogWidth = metadataContent(html, "property", "og:image:width");
+  const ogHeight = metadataContent(html, "property", "og:image:height");
+  const twitterCard = metadataContent(html, "name", "twitter:card");
+  const twitterTitle = metadataContent(html, "name", "twitter:title");
+  const twitterDescription = metadataContent(
+    html,
+    "name",
+    "twitter:description",
+  );
+  const twitterImage = metadataContent(html, "name", "twitter:image");
+  const twitterImageAlt = metadataContent(html, "name", "twitter:image:alt");
+  const imageUrl = new URL(ogImage);
+  if (
+    ogType !== "website" ||
+    ogTitle !== title ||
+    ogDescription !== description ||
+    ogUrl !== canonicalUrl ||
+    imageUrl.origin !== "https://atrinik.org" ||
+    !imageUrl.pathname.startsWith("/media/") ||
+    !/^[1-9][0-9]*$/u.test(ogWidth) ||
+    !/^[1-9][0-9]*$/u.test(ogHeight) ||
+    ogImageAlt.length < 20 ||
+    twitterCard !== "summary_large_image" ||
+    twitterTitle !== title ||
+    twitterDescription !== description ||
+    twitterImage !== ogImage ||
+    twitterImageAlt !== ogImageAlt
+  )
+    throw new Error("Open Graph and Twitter metadata are inconsistent");
+
+  if (websiteIdentity) {
+    if (jsonLd.length !== 1)
+      throw new Error("homepage must contain one WebSite identity");
+    const identity = jsonLd[0];
+    if (
+      identity === null ||
+      typeof identity !== "object" ||
+      Array.isArray(identity) ||
+      identity["@context"] !== "https://schema.org" ||
+      identity["@type"] !== "WebSite" ||
+      identity["@id"] !== "https://atrinik.org/#website" ||
+      identity.url !== "https://atrinik.org/" ||
+      identity.name !== "Atrinik" ||
+      identity.description !== description ||
+      JSON.stringify(identity.sameAs) !==
+        JSON.stringify([
+          "https://github.com/atrinik",
+          "https://github.com/atrinik/website",
+        ])
+    )
+      throw new Error(
+        "homepage WebSite identity differs from its verified contract",
+      );
+  } else if (jsonLd.length !== 0)
+    throw new Error("route emitted unowned structured identity");
+
+  return { title, description, canonicalUrl };
+}
+
 export async function validateDist(
   root,
   { allowedMedia = new Map(), allowedReleaseUrls = new Set() } = {},
@@ -645,6 +836,8 @@ export async function validateDist(
     if (extension === ".html") {
       totals.html += size;
       const html = await readFile(path, "utf8");
+      const relativePath = relative(root, path).replaceAll(sep, "/");
+      const is404 = relativePath === "404.html";
       for (const pattern of [
         /<html lang="en">/u,
         /<main[ >]/u,
@@ -652,22 +845,29 @@ export async function validateDist(
         /aria-label="Primary navigation"/u,
         /<title>[^<]+<\/title>/u,
         /<meta name="description" content="[^"]+"\s*\/?>/u,
-        /<link rel="canonical" href="https:\/\/atrinik\.org\/[^"]*"\s*\/?>/u,
-        /<meta property="og:title" content="[^"]+"\s*\/?>/u,
-        /<meta property="og:description" content="[^"]+"\s*\/?>/u,
-        /<meta property="og:image" content="https:\/\/atrinik\.org\/media\/[^"]+"\s*\/?>/u,
-        /<meta name="twitter:card" content="summary_large_image"\s*\/?>/u,
       ])
         if (!pattern.test(html))
           throw new Error(`accessibility shell missing in ${path}`);
+      if (
+        !is404 &&
+        [
+          /<link rel="canonical" href="https:\/\/atrinik\.org\/[^"]*"\s*\/?>/u,
+          /<meta property="og:title" content="[^"]+"\s*\/?>/u,
+          /<meta property="og:description" content="[^"]+"\s*\/?>/u,
+          /<meta property="og:image" content="https:\/\/atrinik\.org\/media\/[^"]+"\s*\/?>/u,
+          /<meta name="twitter:card" content="summary_large_image"\s*\/?>/u,
+        ].some((pattern) => !pattern.test(html))
+      )
+        throw new Error(`social metadata shell missing in ${path}`);
       if ([...html.matchAll(/<h1[ >]/gu)].length !== 1)
         throw new Error(`page must have exactly one h1 in ${path}`);
       if (
-        relative(root, path).replaceAll(sep, "/") === "404.html" &&
+        is404 &&
         !/<meta name="robots" content="noindex, nofollow"\s*\/?>/u.test(html)
       )
         throw new Error("404 page must be excluded from indexing");
-      if (/<script[ >]/iu.test(html) || /\son[a-z]+=/iu.test(html))
+      parseInertJsonLd(html);
+      if (/\son[a-z]+=/iu.test(html))
         throw new Error(`client script/event handler forbidden in ${path}`);
       for (const match of html.matchAll(/<img\b[^>]*>/giu)) {
         containsImages = true;
diff --git a/tools/site-contract.test.mjs b/tools/site-contract.test.mjs
index 7a49501..95e75c6 100644
--- a/tools/site-contract.test.mjs
+++ b/tools/site-contract.test.mjs
@@ -27,8 +27,10 @@ import {
   validateDownloadCatalog,
   validateDownloadSchemaDefinition,
   validateDownloadsPresentation,
+  validateIcon,
   validateLocalMediaSource,
   validateMedia,
+  validatePageMetadata,
   validatePresentationCss,
   validateRedirects,
 } from "./site-contract.mjs";
@@ -38,6 +40,9 @@ const root = resolve(import.meta.dirname, "..");
 const accessibleShell =
   '<!doctype html><html lang="en"><head><title>Title</title><meta name="description" content="Description"><link rel="canonical" href="https://atrinik.org/"><meta property="og:title" content="Title"><meta property="og:description" content="Description"><meta property="og:image" content="https://atrinik.org/media/social.00000000.webp"><meta name="twitter:card" content="summary_large_image"></head><body><a href="#content">Skip</a><nav aria-label="Primary navigation"></nav><main id="content"><h1>Title</h1></main></body></html>';
 
+const completeMetadataShell =
+  '<!doctype html><html lang="en"><head><title>About Atrinik</title><meta name="description" content="A useful description"><meta name="robots" content="index, follow"><link rel="canonical" href="https://atrinik.org/about/"><meta property="og:type" content="website"><meta property="og:title" content="About Atrinik"><meta property="og:description" content="A useful description"><meta property="og:url" content="https://atrinik.org/about/"><meta property="og:image" content="https://atrinik.org/media/social.00000000.webp"><meta property="og:image:alt" content="A useful social image alternative"><meta property="og:image:width" content="1120"><meta property="og:image:height" content="630"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="About Atrinik"><meta name="twitter:description" content="A useful description"><meta name="twitter:image" content="https://atrinik.org/media/social.00000000.webp"><meta name="twitter:image:alt" content="A useful social image alternative"></head><body></body></html>';
+
 const validMedia = {
   id: "licensed-image",
   publicPath: "/media/licensed.44444444.webp",
@@ -55,6 +60,23 @@ const validMedia = {
   notice: "Copyright Example Author",
 };
 
+const validIcon = {
+  id: "atrinik-favicon",
+  publicPath: "/favicon.svg",
+  sourceRepository: "atrinik/website",
+  sourcePath: "public/favicon.svg",
+  sourceRevision: "2".repeat(40),
+  sourceSha256: "3".repeat(64),
+  publishedSha256: "3".repeat(64),
+  width: 64,
+  height: 64,
+  author: "Example Author",
+  license: "MIT",
+  transformations: ["Authored as SVG."],
+  purpose: "Browser favicon.",
+  notice: "Example notice.",
+};
+
 function riffWebp(chunk, payload, totalBytes) {
   const minimumBytes = 20 + payload.length + (payload.length % 2);
   const length = totalBytes ?? minimumBytes;
@@ -414,6 +436,64 @@ test("media records require complete provenance and safe paths", () => {
   );
 });
 
+test("icon records require closed local SVG provenance", () => {
+  assert.doesNotThrow(() => validateIcon(validIcon));
+  assert.throws(
+    () => validateIcon({ ...validIcon, publicPath: "/remote.svg" }),
+    /icon identity/u,
+  );
+  assert.throws(
+    () => validateIcon({ ...validIcon, publishedSha256: "4".repeat(64) }),
+    /icon digest/u,
+  );
+  assert.throws(
+    () => validateIcon({ ...validIcon, width: 32 }),
+    /icon dimensions/u,
+  );
+});
+
+test("page metadata stays complete, consistent, and safely inert", () => {
+  assert.deepEqual(
+    validatePageMetadata(completeMetadataShell, {
+      canonicalUrl: "https://atrinik.org/about/",
+    }),
+    {
+      title: "About Atrinik",
+      description: "A useful description",
+      canonicalUrl: "https://atrinik.org/about/",
+    },
+  );
+  assert.throws(
+    () =>
+      validatePageMetadata(
+        completeMetadataShell.replace(
+          '<meta name="twitter:title" content="About Atrinik">',
+          '<meta name="twitter:title" content="Different">',
+        ),
+        { canonicalUrl: "https://atrinik.org/about/" },
+      ),
+    /inconsistent/u,
+  );
+  assert.throws(
+    () =>
+      validatePageMetadata(
+        completeMetadataShell.replace(
+          "</head>",
+          '<script src="/app.js"></script></head>',
+        ),
+        { canonicalUrl: "https://atrinik.org/about/" },
+      ),
+    /script block/u,
+  );
+  const noindex =
+    '<html><head><title>Not found</title><meta name="description" content="Missing"><meta name="robots" content="noindex, nofollow"></head></html>';
+  assert.doesNotThrow(() => validatePageMetadata(noindex));
+  assert.throws(
+    () => validatePageMetadata(`${noindex}<script>alert(1)</script>`),
+    /script block/u,
+  );
+});
+
 test("same-repository media binds source bytes and Git blob object", async (context) => {
   const root = await mkdtemp(join(tmpdir(), "atrinik-website-source-test-"));
   context.after(async () => rm(root, { recursive: true }));
diff --git a/tools/validate.mjs b/tools/validate.mjs
index be39813..f529874 100644
--- a/tools/validate.mjs
+++ b/tools/validate.mjs
@@ -10,8 +10,10 @@ import {
   validateDownloadCatalog,
   validateDownloadSchemaDefinition,
   validateDownloadsPresentation,
+  validateIcon,
   validateLocalMediaSource,
   validateMedia,
+  validatePageMetadata,
   validateRedirects,
 } from "./site-contract.mjs";
 
@@ -22,6 +24,7 @@ if (!new Set(["source", "dist"]).has(mode))
 
 const downloads = await readJson(resolve(root, "src/data/downloads.json"));
 const media = await readJson(resolve(root, "src/data/media.json"));
+const icons = await readJson(resolve(root, "src/data/icons.json"));
 validateDownloadCatalog(downloads);
 if (
   media.schemaVersion !== 1 ||
@@ -30,6 +33,13 @@ if (
 )
   throw new Error("invalid media catalog envelope");
 media.entries.forEach(validateMedia);
+if (
+  icons.schemaVersion !== 1 ||
+  !Array.isArray(icons.entries) ||
+  icons.entries.length !== 2
+)
+  throw new Error("invalid icon catalog envelope");
+icons.entries.forEach(validateIcon);
 if (
   new Set(media.entries.map((record) => record.id)).size !==
   media.entries.length
@@ -70,6 +80,24 @@ for (const record of media.entries) {
   )
     throw new Error(`published media digest mismatch: ${record.id}`);
 }
+for (const record of icons.entries) {
+  await validateLocalMediaSource(root, record);
+  if (
+    (await digest(resolve(root, `public${record.publicPath}`))) !==
+    record.publishedSha256
+  )
+    throw new Error(`published icon digest mismatch: ${record.id}`);
+  const source = await readFile(
+    resolve(root, `public${record.publicPath}`),
+    "utf8",
+  );
+  if (
+    !source.startsWith("<svg ") ||
+    !source.includes('viewBox="0 0 64 64"') ||
+    /<script|\son[a-z]+=|(?:href|src)\s*=/iu.test(source)
+  )
+    throw new Error(`unsafe icon source: ${record.id}`);
+}
 
 const site = await readJson(resolve(root, "src/data/site.json"));
 if (site.canonicalOrigin !== "https://atrinik.org")
@@ -135,6 +163,7 @@ for (const directive of [
     throw new Error(`missing security header ${directive}`);
 for (const path of [
   "contracts/download.schema.json",
+  "contracts/icon.schema.json",
   "contracts/media.schema.json",
   "LICENSE",
   "PROVENANCE.md",
@@ -152,6 +181,7 @@ validateDownloadSchemaDefinition(downloadSchema, fixture);
 const mediaSchema = await readJson(
   resolve(root, "contracts/media.schema.json"),
 );
+const iconSchema = await readJson(resolve(root, "contracts/icon.schema.json"));
 const mediaFields = [
   "id",
   "publicPath",
@@ -173,6 +203,27 @@ if (
   mediaSchema.required.sort().join("\n") !== mediaFields.sort().join("\n")
 )
   throw new Error("declarative and executable catalog schemas drifted");
+const iconFields = [
+  "id",
+  "publicPath",
+  "sourceRepository",
+  "sourcePath",
+  "sourceRevision",
+  "sourceSha256",
+  "publishedSha256",
+  "width",
+  "height",
+  "author",
+  "license",
+  "transformations",
+  "purpose",
+  "notice",
+];
+if (
+  iconSchema.additionalProperties !== false ||
+  iconSchema.required.sort().join("\n") !== iconFields.sort().join("\n")
+)
+  throw new Error("declarative and executable icon schemas drifted");
 
 const packageManifest = await readJson(resolve(root, "package.json"));
 const dependencyPolicy = await readJson(
@@ -236,6 +287,30 @@ if (mode === "dist") {
     throw new Error(
       "social metadata omits the generated website-media exception",
     );
+  const pageContracts = [
+    ["index.html", "https://atrinik.org/", true],
+    ["about/index.html", "https://atrinik.org/about/", false],
+    ["downloads/index.html", "https://atrinik.org/downloads/", false],
+    ["licenses/index.html", "https://atrinik.org/licenses/", false],
+    ["404.html", null, false],
+  ];
+  const identities = [];
+  for (const [path, canonicalUrl, websiteIdentity] of pageContracts) {
+    const html = await readFile(resolve(root, `dist/${path}`), "utf8");
+    for (const icon of icons.entries)
+      if (!html.includes(`href="${icon.publicPath}"`))
+        throw new Error(`${path} omits icon ${icon.id}`);
+    identities.push(
+      validatePageMetadata(html, { canonicalUrl, websiteIdentity }),
+    );
+  }
+  for (const field of ["title", "description", "canonicalUrl"]) {
+    const values = identities
+      .map((identity) => identity[field])
+      .filter((value) => value !== null);
+    if (new Set(values).size !== values.length)
+      throw new Error(`indexable page ${field} values are not unique`);
+  }
   validateDownloadsPresentation(
     await readFile(resolve(root, "dist/downloads/index.html"), "utf8"),
     downloads,

From 3818a4a85ec8c42f8bc285f9dcc2afcf4cacffbc Mon Sep 17 00:00:00 2001
From: Zoey Rose <zoey@zoeysr.com>
Date: Tue, 11 Aug 2026 16:19:37 +0000
Subject: [PATCH 2/6] fix(metadata): close validation bypasses

---
 src/lib/metadata.ts          |   4 +-
 src/pages/licenses.astro     |   1 -
 tools/site-contract.mjs      |  95 +++++++++++++++++++++++++----
 tools/site-contract.test.mjs | 115 ++++++++++++++++++++++++++++++++++-
 tools/validate.mjs           |  81 ++++++++++++++++--------
 5 files changed, 254 insertions(+), 42 deletions(-)

diff --git a/src/lib/metadata.ts b/src/lib/metadata.ts
index 89f65da..7bd4fed 100644
--- a/src/lib/metadata.ts
+++ b/src/lib/metadata.ts
@@ -61,7 +61,9 @@ function socialImage(id: string): SocialImageMetadata {
     url: new URL(record.publicPath, site.canonicalOrigin).href,
     width: record.width,
     height: record.height,
-    alt: `Temporary OpenAI-generated website concept artwork: ${record.alt}`,
+    alt: record.author.includes("OpenAI image generation")
+      ? `Temporary OpenAI-generated website concept artwork: ${record.alt}`
+      : record.alt,
   };
 }
 
diff --git a/src/pages/licenses.astro b/src/pages/licenses.astro
index 8bcfecd..e6813c1 100644
--- a/src/pages/licenses.astro
+++ b/src/pages/licenses.astro
@@ -8,7 +8,6 @@ const metadata = indexablePage({
   description:
     "Understand the distinct authorship, provenance, attribution, and license boundaries for Atrinik software, game content, and website presentation media.",
   canonicalPath: "/licenses/",
-  socialImageId: "atrinik-beyond",
 });
 ---
 
diff --git a/tools/site-contract.mjs b/tools/site-contract.mjs
index 80efa6d..493f24f 100644
--- a/tools/site-contract.mjs
+++ b/tools/site-contract.mjs
@@ -483,12 +483,13 @@ export function validateIcon(record) {
     throw new Error("invalid icon digest");
   if (record.width !== 64 || record.height !== 64)
     throw new Error("invalid icon dimensions");
-  for (const field of ["author", "purpose", "notice"])
+  const stringBounds = { author: 200, purpose: 300, notice: 500 };
+  for (const [field, maximum] of Object.entries(stringBounds))
     if (
       typeof record[field] !== "string" ||
       record[field].trim() !== record[field] ||
       record[field].length === 0 ||
-      record[field].length > 500
+      record[field].length > maximum
     )
       throw new Error(`invalid icon ${field}`);
   if (
@@ -507,6 +508,35 @@ export function validateIcon(record) {
     throw new Error("invalid icon license or transformations");
 }
 
+export function validateIconCatalog(entries) {
+  if (!Array.isArray(entries) || entries.length !== 2)
+    throw new Error("invalid icon catalog envelope");
+  entries.forEach(validateIcon);
+  const ids = new Set(entries.map(({ id }) => id));
+  const paths = new Set(entries.map(({ publicPath }) => publicPath));
+  if (
+    ids.size !== entries.length ||
+    paths.size !== entries.length ||
+    [...paths].sort().join("\n") !==
+      ["/favicon.svg", "/mask-icon.svg"].sort().join("\n")
+  )
+    throw new Error(
+      "icon catalog identities and paths must be unique and complete",
+    );
+}
+
+export function validateSvgIconSource(source, id = "icon") {
+  if (
+    typeof source !== "string" ||
+    !source.startsWith("<svg ") ||
+    !source.includes('viewBox="0 0 64 64"') ||
+    /<script|<style|\son[a-z][a-z0-9_-]*\s*=|\sstyle\s*=|(?:href|src)\s*=|@import|url\s*\(/iu.test(
+      source,
+    )
+  )
+    throw new Error(`unsafe icon source: ${id}`);
+}
+
 export async function readJson(path) {
   return JSON.parse(await readFile(path, "utf8"));
 }
@@ -697,12 +727,42 @@ function metadataContent(html, attribute, key) {
 }
 
 export function parseInertJsonLd(html) {
-  const scripts = [
-    ...html.matchAll(/<script\b([^>]*)>([\s\S]*?)<\/script>/giu),
-  ];
-  if ([...html.matchAll(/<script\b/giu)].length !== scripts.length)
-    throw new Error("malformed or unclosed script block");
-  return scripts.map(([, rawAttributes, body]) => {
+  const lower = html.toLowerCase();
+  const scripts = [];
+  let cursor = 0;
+  while (cursor < html.length) {
+    let opening = lower.indexOf("<script", cursor);
+    const strayClosing = lower.indexOf("</script", cursor);
+    while (
+      opening !== -1 &&
+      !/[\s>]/u.test(lower[opening + "<script".length] ?? "")
+    )
+      opening = lower.indexOf("<script", opening + "<script".length);
+    if (strayClosing !== -1 && (opening === -1 || strayClosing < opening))
+      throw new Error("malformed or unclosed script block");
+    if (opening === -1) break;
+    const openingEnd = lower.indexOf(">", opening + "<script".length);
+    if (openingEnd === -1)
+      throw new Error("malformed or unclosed script block");
+    const closing = lower.indexOf("</script", openingEnd + 1);
+    if (closing === -1) throw new Error("malformed or unclosed script block");
+    const nested = lower.indexOf("<script", openingEnd + 1);
+    if (nested !== -1 && nested < closing)
+      throw new Error("nested script block forbidden");
+    const closingNameEnd = closing + "</script".length;
+    const closingEnd = lower.indexOf(">", closingNameEnd);
+    if (
+      closingEnd === -1 ||
+      lower.slice(closingNameEnd, closingEnd).trim() !== ""
+    )
+      throw new Error("malformed or unclosed script block");
+    scripts.push({
+      rawAttributes: html.slice(opening + "<script".length, openingEnd),
+      body: html.slice(openingEnd + 1, closing),
+    });
+    cursor = closingEnd + 1;
+  }
+  return scripts.map(({ rawAttributes, body }) => {
     if (rawAttributes.trim() !== 'type="application/ld+json"')
       throw new Error("executable or attributed script block forbidden");
     if (/[<>&\u2028\u2029]/u.test(body))
@@ -717,7 +777,7 @@ export function parseInertJsonLd(html) {
 
 export function validatePageMetadata(
   html,
-  { canonicalUrl = null, websiteIdentity = false } = {},
+  { canonicalUrl = null, websiteIdentity = false, allowedMedia = null } = {},
 ) {
   const titleMatches = [...html.matchAll(/<title>([^<]+)<\/title>/gu)];
   if (titleMatches.length !== 1)
@@ -768,12 +828,20 @@ export function validatePageMetadata(
   const twitterImage = metadataContent(html, "name", "twitter:image");
   const twitterImageAlt = metadataContent(html, "name", "twitter:image:alt");
   const imageUrl = new URL(ogImage);
+  const expectedImage = allowedMedia?.get(imageUrl.pathname);
+  const expectedImageAlt = expectedImage
+    ? expectedImage.author.includes("OpenAI image generation")
+      ? `Temporary OpenAI-generated website concept artwork: ${expectedImage.alt}`
+      : expectedImage.alt
+    : null;
   if (
     ogType !== "website" ||
     ogTitle !== title ||
     ogDescription !== description ||
     ogUrl !== canonicalUrl ||
     imageUrl.origin !== "https://atrinik.org" ||
+    imageUrl.search !== "" ||
+    imageUrl.hash !== "" ||
     !imageUrl.pathname.startsWith("/media/") ||
     !/^[1-9][0-9]*$/u.test(ogWidth) ||
     !/^[1-9][0-9]*$/u.test(ogHeight) ||
@@ -782,7 +850,12 @@ export function validatePageMetadata(
     twitterTitle !== title ||
     twitterDescription !== description ||
     twitterImage !== ogImage ||
-    twitterImageAlt !== ogImageAlt
+    twitterImageAlt !== ogImageAlt ||
+    (allowedMedia !== null &&
+      (!expectedImage ||
+        Number(ogWidth) !== expectedImage.width ||
+        Number(ogHeight) !== expectedImage.height ||
+        ogImageAlt !== expectedImageAlt))
   )
     throw new Error("Open Graph and Twitter metadata are inconsistent");
 
@@ -867,7 +940,7 @@ export async function validateDist(
       )
         throw new Error("404 page must be excluded from indexing");
       parseInertJsonLd(html);
-      if (/\son[a-z]+=/iu.test(html))
+      if (/\son[a-z][a-z0-9_-]*\s*=/iu.test(html))
         throw new Error(`client script/event handler forbidden in ${path}`);
       for (const match of html.matchAll(/<img\b[^>]*>/giu)) {
         containsImages = true;
diff --git a/tools/site-contract.test.mjs b/tools/site-contract.test.mjs
index 95e75c6..f325c04 100644
--- a/tools/site-contract.test.mjs
+++ b/tools/site-contract.test.mjs
@@ -21,6 +21,7 @@ import {
   limits,
   digest,
   gitBlobObjectId,
+  parseInertJsonLd,
   readWebpDimensions,
   validateDist,
   validateDownload,
@@ -28,11 +29,13 @@ import {
   validateDownloadSchemaDefinition,
   validateDownloadsPresentation,
   validateIcon,
+  validateIconCatalog,
   validateLocalMediaSource,
   validateMedia,
   validatePageMetadata,
   validatePresentationCss,
   validateRedirects,
+  validateSvgIconSource,
 } from "./site-contract.mjs";
 
 const root = resolve(import.meta.dirname, "..");
@@ -43,6 +46,18 @@ const accessibleShell =
 const completeMetadataShell =
   '<!doctype html><html lang="en"><head><title>About Atrinik</title><meta name="description" content="A useful description"><meta name="robots" content="index, follow"><link rel="canonical" href="https://atrinik.org/about/"><meta property="og:type" content="website"><meta property="og:title" content="About Atrinik"><meta property="og:description" content="A useful description"><meta property="og:url" content="https://atrinik.org/about/"><meta property="og:image" content="https://atrinik.org/media/social.00000000.webp"><meta property="og:image:alt" content="A useful social image alternative"><meta property="og:image:width" content="1120"><meta property="og:image:height" content="630"><meta name="twitter:card" content="summary_large_image"><meta name="twitter:title" content="About Atrinik"><meta name="twitter:description" content="A useful description"><meta name="twitter:image" content="https://atrinik.org/media/social.00000000.webp"><meta name="twitter:image:alt" content="A useful social image alternative"></head><body></body></html>';
 
+const allowedSocialMedia = new Map([
+  [
+    "/media/social.00000000.webp",
+    {
+      width: 1120,
+      height: 630,
+      alt: "A useful social image alternative",
+      author: "Example Human",
+    },
+  ],
+]);
+
 const validMedia = {
   id: "licensed-image",
   publicPath: "/media/licensed.44444444.webp",
@@ -450,12 +465,49 @@ test("icon records require closed local SVG provenance", () => {
     () => validateIcon({ ...validIcon, width: 32 }),
     /icon dimensions/u,
   );
+  assert.doesNotThrow(() =>
+    validateIconCatalog([
+      validIcon,
+      {
+        ...validIcon,
+        id: "atrinik-mask-icon",
+        publicPath: "/mask-icon.svg",
+        sourcePath: "public/mask-icon.svg",
+      },
+    ]),
+  );
+  assert.throws(
+    () => validateIconCatalog([validIcon, { ...validIcon }]),
+    /unique and complete/u,
+  );
+  assert.throws(
+    () => validateIcon({ ...validIcon, author: "a".repeat(201) }),
+    /icon author/u,
+  );
+  assert.doesNotThrow(() =>
+    validateSvgIconSource('<svg viewBox="0 0 64 64"><path d="M0 0"/></svg>'),
+  );
+  assert.throws(
+    () =>
+      validateSvgIconSource(
+        '<svg viewBox="0 0 64 64" onload = "alert(1)"></svg>',
+      ),
+    /unsafe icon/u,
+  );
+  assert.throws(
+    () =>
+      validateSvgIconSource(
+        '<svg viewBox="0 0 64 64"><style>@import url(https://tracker.example/icon.css)</style></svg>',
+      ),
+    /unsafe icon/u,
+  );
 });
 
 test("page metadata stays complete, consistent, and safely inert", () => {
   assert.deepEqual(
     validatePageMetadata(completeMetadataShell, {
       canonicalUrl: "https://atrinik.org/about/",
+      allowedMedia: allowedSocialMedia,
     }),
     {
       title: "About Atrinik",
@@ -470,7 +522,10 @@ test("page metadata stays complete, consistent, and safely inert", () => {
           '<meta name="twitter:title" content="About Atrinik">',
           '<meta name="twitter:title" content="Different">',
         ),
-        { canonicalUrl: "https://atrinik.org/about/" },
+        {
+          canonicalUrl: "https://atrinik.org/about/",
+          allowedMedia: allowedSocialMedia,
+        },
       ),
     /inconsistent/u,
   );
@@ -481,17 +536,67 @@ test("page metadata stays complete, consistent, and safely inert", () => {
           "</head>",
           '<script src="/app.js"></script></head>',
         ),
-        { canonicalUrl: "https://atrinik.org/about/" },
+        {
+          canonicalUrl: "https://atrinik.org/about/",
+          allowedMedia: allowedSocialMedia,
+        },
       ),
     /script block/u,
   );
   const noindex =
     '<html><head><title>Not found</title><meta name="description" content="Missing"><meta name="robots" content="noindex, nofollow"></head></html>';
   assert.doesNotThrow(() => validatePageMetadata(noindex));
+  assert.throws(
+    () =>
+      validatePageMetadata(
+        completeMetadataShell.replace('content="1120"', 'content="1119"'),
+        {
+          canonicalUrl: "https://atrinik.org/about/",
+          allowedMedia: allowedSocialMedia,
+        },
+      ),
+    /inconsistent/u,
+  );
   assert.throws(
     () => validatePageMetadata(`${noindex}<script>alert(1)</script>`),
     /script block/u,
   );
+  assert.deepEqual(
+    parseInertJsonLd(
+      '<script type="application/ld+json">{"text":"\\u003c/script\\u003e"}</script>',
+    ),
+    [{ text: "</script>" }],
+  );
+  assert.throws(
+    () =>
+      parseInertJsonLd(
+        '<script type="application/ld+json">{"text":"</script>"}</script>',
+      ),
+    /safely serialized|valid JSON|script/u,
+  );
+  assert.deepEqual(
+    parseInertJsonLd(
+      '<script type="application/ld+json">{"safe":true}</script >',
+    ),
+    [{ safe: true }],
+  );
+  assert.deepEqual(
+    parseInertJsonLd(
+      '<SCRIPT type="application/ld+json">{"safe":true}</ScRiPt>',
+    ),
+    [{ safe: true }],
+  );
+  assert.throws(
+    () =>
+      parseInertJsonLd(
+        '<script type="application/ld+json">{"safe":true}</script ignored>',
+      ),
+    /malformed/u,
+  );
+  assert.throws(
+    () => parseInertJsonLd("</script><p>stray closing tag</p>"),
+    /malformed/u,
+  );
 });
 
 test("same-repository media binds source bytes and Git blob object", async (context) => {
@@ -785,6 +890,12 @@ test("static output rejects scripts, broken links, and excessive files", async (
   );
   await assert.rejects(validateDist(root), /exactly one h1/u);
   await writeFile(join(root, "index.html"), accessibleShell);
+  await writeFile(
+    join(root, "index.html"),
+    accessibleShell.replace("<main", '<main onload = "alert(1)"'),
+  );
+  await assert.rejects(validateDist(root), /event handler/u);
+  await writeFile(join(root, "index.html"), accessibleShell);
   await writeFile(join(root, "bad.js"), "alert(1)");
   await assert.rejects(validateDist(root), /performance budget/u);
 });
diff --git a/tools/validate.mjs b/tools/validate.mjs
index f529874..b6f5578 100644
--- a/tools/validate.mjs
+++ b/tools/validate.mjs
@@ -10,11 +10,12 @@ import {
   validateDownloadCatalog,
   validateDownloadSchemaDefinition,
   validateDownloadsPresentation,
-  validateIcon,
+  validateIconCatalog,
   validateLocalMediaSource,
   validateMedia,
   validatePageMetadata,
   validateRedirects,
+  validateSvgIconSource,
 } from "./site-contract.mjs";
 
 const root = resolve(import.meta.dirname, "..");
@@ -33,13 +34,8 @@ if (
 )
   throw new Error("invalid media catalog envelope");
 media.entries.forEach(validateMedia);
-if (
-  icons.schemaVersion !== 1 ||
-  !Array.isArray(icons.entries) ||
-  icons.entries.length !== 2
-)
-  throw new Error("invalid icon catalog envelope");
-icons.entries.forEach(validateIcon);
+if (icons.schemaVersion !== 1) throw new Error("invalid icon catalog envelope");
+validateIconCatalog(icons.entries);
 if (
   new Set(media.entries.map((record) => record.id)).size !==
   media.entries.length
@@ -91,12 +87,7 @@ for (const record of icons.entries) {
     resolve(root, `public${record.publicPath}`),
     "utf8",
   );
-  if (
-    !source.startsWith("<svg ") ||
-    !source.includes('viewBox="0 0 64 64"') ||
-    /<script|\son[a-z]+=|(?:href|src)\s*=/iu.test(source)
-  )
-    throw new Error(`unsafe icon source: ${record.id}`);
+  validateSvgIconSource(source, record.id);
 }
 
 const site = await readJson(resolve(root, "src/data/site.json"));
@@ -287,21 +278,51 @@ if (mode === "dist") {
     throw new Error(
       "social metadata omits the generated website-media exception",
     );
-  const pageContracts = [
-    ["index.html", "https://atrinik.org/", true],
-    ["about/index.html", "https://atrinik.org/about/", false],
-    ["downloads/index.html", "https://atrinik.org/downloads/", false],
-    ["licenses/index.html", "https://atrinik.org/licenses/", false],
-    ["404.html", null, false],
-  ];
+  const htmlPaths = (await filesBelow(resolve(root, "dist"))).filter((path) =>
+    path.endsWith(".html"),
+  );
   const identities = [];
-  for (const [path, canonicalUrl, websiteIdentity] of pageContracts) {
-    const html = await readFile(resolve(root, `dist/${path}`), "utf8");
-    for (const icon of icons.entries)
-      if (!html.includes(`href="${icon.publicPath}"`))
-        throw new Error(`${path} omits icon ${icon.id}`);
+  const allowedMedia = new Map(
+    media.entries.map((record) => [record.publicPath, record]),
+  );
+  for (const path of htmlPaths) {
+    const relativePath = relative(resolve(root, "dist"), path).replaceAll(
+      sep,
+      "/",
+    );
+    let canonicalUrl = null;
+    if (relativePath !== "404.html") {
+      const canonicalPath =
+        relativePath === "index.html"
+          ? "/"
+          : relativePath.endsWith("/index.html")
+            ? `/${relativePath.slice(0, -"index.html".length)}`
+            : `/${relativePath}`;
+      canonicalUrl = new URL(canonicalPath, site.canonicalOrigin).href;
+      if (!sitemapUrls.includes(canonicalUrl))
+        throw new Error(
+          `indexable generated route is absent from sitemap: ${relativePath}`,
+        );
+    }
+    const html = await readFile(path, "utf8");
+    const faviconLinks = [
+      ...html.matchAll(
+        /<link rel="icon" href="\/favicon\.svg" type="image\/svg\+xml" sizes="any"\s*\/?>/gu,
+      ),
+    ];
+    const maskLinks = [
+      ...html.matchAll(
+        /<link rel="mask-icon" href="\/mask-icon\.svg" color="#[0-9a-fA-F]{6}"\s*\/?>/gu,
+      ),
+    ];
+    if (faviconLinks.length !== 1 || maskLinks.length !== 1)
+      throw new Error(`${relativePath} has incomplete or duplicate icon links`);
     identities.push(
-      validatePageMetadata(html, { canonicalUrl, websiteIdentity }),
+      validatePageMetadata(html, {
+        canonicalUrl,
+        websiteIdentity: canonicalUrl === "https://atrinik.org/",
+        allowedMedia,
+      }),
     );
   }
   for (const field of ["title", "description", "canonicalUrl"]) {
@@ -311,6 +332,12 @@ if (mode === "dist") {
     if (new Set(values).size !== values.length)
       throw new Error(`indexable page ${field} values are not unique`);
   }
+  const generatedCanonicalUrls = identities
+    .map(({ canonicalUrl }) => canonicalUrl)
+    .filter((value) => value !== null)
+    .sort();
+  if (generatedCanonicalUrls.join("\n") !== [...sitemapUrls].sort().join("\n"))
+    throw new Error("generated indexable routes and sitemap differ");
   validateDownloadsPresentation(
     await readFile(resolve(root, "dist/downloads/index.html"), "utf8"),
     downloads,

From fdaeb53eab30390af9c0792648ed15c6871b547e Mon Sep 17 00:00:00 2001
From: Zoey Rose <zoey@zoeysr.com>
Date: Tue, 11 Aug 2026 16:27:29 +0000
Subject: [PATCH 3/6] fix(metadata): reject slash-delimited handlers

---
 tools/site-contract.mjs      |  6 +++---
 tools/site-contract.test.mjs | 13 +++++++++++++
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/tools/site-contract.mjs b/tools/site-contract.mjs
index 493f24f..9a8d780 100644
--- a/tools/site-contract.mjs
+++ b/tools/site-contract.mjs
@@ -530,7 +530,7 @@ export function validateSvgIconSource(source, id = "icon") {
     typeof source !== "string" ||
     !source.startsWith("<svg ") ||
     !source.includes('viewBox="0 0 64 64"') ||
-    /<script|<style|\son[a-z][a-z0-9_-]*\s*=|\sstyle\s*=|(?:href|src)\s*=|@import|url\s*\(/iu.test(
+    /<script|<style|(?:\s|\/)on[a-z][a-z0-9_-]*\s*=|(?:\s|\/)style\s*=|(?:href|src)\s*=|@import|url\s*\(/iu.test(
       source,
     )
   )
@@ -735,7 +735,7 @@ export function parseInertJsonLd(html) {
     const strayClosing = lower.indexOf("</script", cursor);
     while (
       opening !== -1 &&
-      !/[\s>]/u.test(lower[opening + "<script".length] ?? "")
+      !/[\s/>]/u.test(lower[opening + "<script".length] ?? "")
     )
       opening = lower.indexOf("<script", opening + "<script".length);
     if (strayClosing !== -1 && (opening === -1 || strayClosing < opening))
@@ -940,7 +940,7 @@ export async function validateDist(
       )
         throw new Error("404 page must be excluded from indexing");
       parseInertJsonLd(html);
-      if (/\son[a-z][a-z0-9_-]*\s*=/iu.test(html))
+      if (/(?:\s|\/)on[a-z][a-z0-9_-]*\s*=/iu.test(html))
         throw new Error(`client script/event handler forbidden in ${path}`);
       for (const match of html.matchAll(/<img\b[^>]*>/giu)) {
         containsImages = true;
diff --git a/tools/site-contract.test.mjs b/tools/site-contract.test.mjs
index f325c04..ea62ab6 100644
--- a/tools/site-contract.test.mjs
+++ b/tools/site-contract.test.mjs
@@ -494,6 +494,13 @@ test("icon records require closed local SVG provenance", () => {
       ),
     /unsafe icon/u,
   );
+  assert.throws(
+    () =>
+      validateSvgIconSource(
+        '<svg viewBox="0 0 64 64"/onload= "alert(1)"></svg>',
+      ),
+    /unsafe icon/u,
+  );
   assert.throws(
     () =>
       validateSvgIconSource(
@@ -597,6 +604,7 @@ test("page metadata stays complete, consistent, and safely inert", () => {
     () => parseInertJsonLd("</script><p>stray closing tag</p>"),
     /malformed/u,
   );
+  assert.throws(() => parseInertJsonLd("<script/>alert(1)"), /script/u);
 });
 
 test("same-repository media binds source bytes and Git blob object", async (context) => {
@@ -895,6 +903,11 @@ test("static output rejects scripts, broken links, and excessive files", async (
     accessibleShell.replace("<main", '<main onload = "alert(1)"'),
   );
   await assert.rejects(validateDist(root), /event handler/u);
+  await writeFile(
+    join(root, "index.html"),
+    accessibleShell.replace("<main", "<main><img/onerror=alert(1)><span"),
+  );
+  await assert.rejects(validateDist(root), /event handler/u);
   await writeFile(join(root, "index.html"), accessibleShell);
   await writeFile(join(root, "bad.js"), "alert(1)");
   await assert.rejects(validateDist(root), /performance budget/u);

From 7a0daf8636a15395f3b81e3341663810882e2352 Mon Sep 17 00:00:00 2001
From: Zoey Rose <zoey@zoeysr.com>
Date: Tue, 11 Aug 2026 16:03:08 +0000
Subject: [PATCH 4/6] feat(home): lead with player-first Classic pitch

---
 src/pages/index.astro | 27 +++++++++++++++------------
 tools/validate.mjs    | 21 +++++++++++++++++++++
 2 files changed, 36 insertions(+), 12 deletions(-)

diff --git a/src/pages/index.astro b/src/pages/index.astro
index 3e7a918..9661a5d 100644
--- a/src/pages/index.astro
+++ b/src/pages/index.astro
@@ -12,8 +12,9 @@ const getMedia = (id: string) => {
 
 const crystal = getMedia("great-blue-crystal");
 const metadata = indexablePage({
-  title: "Atrinik: A world of crystal, memory, and unfinished paths",
-  description: site.description,
+  title: "Free, open-source online role-playing game",
+  description:
+    "Atrinik is a free, open-source multiplayer online role-playing game. Download the maintained Atrinik Classic client for Windows while the replacement foundations remain in development.",
   canonicalPath: "/",
   structuredData: [websiteIdentity()],
 });
@@ -42,16 +43,18 @@ const chronicle = [
 <Base metadata={metadata} preloadImage={crystal.publicPath}>
   <section class="home-hero" aria-labelledby="hero-title">
     <div class="hero-copy">
-      <p class="eyebrow">An open-source role-playing world</p>
-      <h1 id="hero-title">A world of crystal, memory, and unfinished paths.</h1>
+      <p class="eyebrow">Free, open-source online role-playing game</p>
+      <h1 id="hero-title">
+        Atrinik is a cooperative fantasy role-playing game.
+      </h1>
       <p class="hero-lede">
-        Atrinik is a cooperative fantasy world of islands, ruins, and
-        crystal-lit mysteries—playable through the unified, maintained Classic
-        line, and being rebuilt on new foundations for what comes next.
+        Atrinik is a multiplayer adventure through isometric islands, ruins, and
+        crystal-lit mysteries. Atrinik Classic is the playable, maintained
+        release for Windows; the replacement game remains in development.
       </p>
       <div class="hero-actions">
         <a class="button button--primary" href="/downloads/">
-          Explore Classic <span aria-hidden="true">→</span>
+          Download Atrinik Classic <span aria-hidden="true">→</span>
         </a>
         <a
           class="button button--ghost"
@@ -66,12 +69,12 @@ const chronicle = [
           <dd>Playable &amp; maintained</dd>
         </div>
         <div>
-          <dt>Next generation</dt>
-          <dd>Foundations in development</dd>
+          <dt>Windows</dt>
+          <dd>Supported client download</dd>
         </div>
         <div>
-          <dt>Source</dt>
-          <dd>Open on GitHub</dd>
+          <dt>Next generation</dt>
+          <dd>Foundations in development</dd>
         </div>
       </dl>
     </div>
diff --git a/tools/validate.mjs b/tools/validate.mjs
index b6f5578..33e60c5 100644
--- a/tools/validate.mjs
+++ b/tools/validate.mjs
@@ -269,6 +269,27 @@ if (mode === "dist") {
     .replaceAll("&#39;", "'")
     .replaceAll("&quot;", '"')
     .replaceAll("&amp;", "&");
+  const homeProposition = [
+    "Free, open-source online role-playing game · Atrinik",
+    "Atrinik is a free, open-source multiplayer online role-playing game. Download the maintained Atrinik Classic client for Windows while the replacement foundations remain in development.",
+    "Atrinik is a cooperative fantasy role-playing game.",
+    "Atrinik Classic is the playable, maintained release for Windows; the replacement game remains in development.",
+    '<a class="button button--primary" href="/downloads/">',
+    "Download Atrinik Classic",
+    "temporary concept artwork",
+  ];
+  for (const phrase of homeProposition)
+    if (!decodedHome.includes(phrase))
+      throw new Error(`home omits player proposition: ${phrase}`);
+  for (const metadata of [
+    "<title>Free, open-source online role-playing game · Atrinik</title>",
+    '<meta property="og:title" content="Free, open-source online role-playing game · Atrinik"',
+    '<meta name="twitter:title" content="Free, open-source online role-playing game · Atrinik"',
+  ])
+    if (!decodedHome.includes(metadata))
+      throw new Error(
+        `home metadata drifts from player proposition: ${metadata}`,
+      );
   for (const field of identityFields)
     if (!decodedHome.includes(site.identity[field]))
       throw new Error(`home omits site identity ${field}`);

From 54a468a7e720b3683060462eb15d64416b042085 Mon Sep 17 00:00:00 2001
From: Zoey Rose <zoey@zoeysr.com>
Date: Tue, 11 Aug 2026 16:15:06 +0000
Subject: [PATCH 5/6] fix(home): keep player pitch aligned and visible

---
 src/data/site.json           |  8 +++
 src/lib/metadata.ts          |  2 +-
 src/pages/index.astro        | 20 +++-----
 tools/site-contract.mjs      | 94 ++++++++++++++++++++++++++++++++++++
 tools/site-contract.test.mjs | 44 +++++++++++++++++
 tools/validate.mjs           | 27 +++--------
 6 files changed, 160 insertions(+), 35 deletions(-)

diff --git a/src/data/site.json b/src/data/site.json
index fe2d0a9..11ae10c 100644
--- a/src/data/site.json
+++ b/src/data/site.json
@@ -2,6 +2,14 @@
   "title": "Atrinik",
   "description": "Atrinik is an open-source role-playing world under human creative direction, with primarily Codex-driven software development and human code contributions welcome.",
   "canonicalOrigin": "https://atrinik.org",
+  "homepage": {
+    "title": "Free, open-source online role-playing game",
+    "description": "Atrinik is a free, open-source online role-playing game. Download Atrinik Classic for Windows; the replacement remains in development.",
+    "eyebrow": "Free, open-source online role-playing game",
+    "heading": "Atrinik is a cooperative fantasy game.",
+    "introduction": "Explore Atrinik’s isometric islands, ruins, and crystal-lit mysteries with other players. The maintained Classic release is available for Windows; the replacement game remains in development.",
+    "primaryAction": "Download Atrinik Classic"
+  },
   "privacy": {
     "applicationAnalytics": false,
     "applicationCookies": false,
diff --git a/src/lib/metadata.ts b/src/lib/metadata.ts
index 7bd4fed..a84b6e7 100644
--- a/src/lib/metadata.ts
+++ b/src/lib/metadata.ts
@@ -112,7 +112,7 @@ export function websiteIdentity(): JsonLdValue {
     "@id": "https://atrinik.org/#website",
     url: "https://atrinik.org/",
     name: site.title,
-    description: site.description,
+    description: site.homepage.description,
     sameAs: [
       "https://github.com/atrinik",
       "https://github.com/atrinik/website",
diff --git a/src/pages/index.astro b/src/pages/index.astro
index 9661a5d..ba2a408 100644
--- a/src/pages/index.astro
+++ b/src/pages/index.astro
@@ -12,9 +12,8 @@ const getMedia = (id: string) => {
 
 const crystal = getMedia("great-blue-crystal");
 const metadata = indexablePage({
-  title: "Free, open-source online role-playing game",
-  description:
-    "Atrinik is a free, open-source multiplayer online role-playing game. Download the maintained Atrinik Classic client for Windows while the replacement foundations remain in development.",
+  title: `${site.homepage.title} · ${site.title}`,
+  description: site.homepage.description,
   canonicalPath: "/",
   structuredData: [websiteIdentity()],
 });
@@ -43,18 +42,13 @@ const chronicle = [
 <Base metadata={metadata} preloadImage={crystal.publicPath}>
   <section class="home-hero" aria-labelledby="hero-title">
     <div class="hero-copy">
-      <p class="eyebrow">Free, open-source online role-playing game</p>
-      <h1 id="hero-title">
-        Atrinik is a cooperative fantasy role-playing game.
-      </h1>
-      <p class="hero-lede">
-        Atrinik is a multiplayer adventure through isometric islands, ruins, and
-        crystal-lit mysteries. Atrinik Classic is the playable, maintained
-        release for Windows; the replacement game remains in development.
-      </p>
+      <p class="eyebrow">{site.homepage.eyebrow}</p>
+      <h1 id="hero-title">{site.homepage.heading}</h1>
+      <p class="hero-lede">{site.homepage.introduction}</p>
       <div class="hero-actions">
         <a class="button button--primary" href="/downloads/">
-          Download Atrinik Classic <span aria-hidden="true">→</span>
+          {site.homepage.primaryAction}
+          <span aria-hidden="true">→</span>
         </a>
         <a
           class="button button--ghost"
diff --git a/tools/site-contract.mjs b/tools/site-contract.mjs
index 9a8d780..6b695ea 100644
--- a/tools/site-contract.mjs
+++ b/tools/site-contract.mjs
@@ -888,6 +888,100 @@ export function validatePageMetadata(
   return { title, description, canonicalUrl };
 }
 
+function normalizedText(fragment) {
+  return decodeHtmlAttribute(fragment.replaceAll(/<[^>]+>/gu, " "))
+    .replaceAll(/\s+/gu, " ")
+    .trim();
+}
+
+export function validateHomepagePhraseSet(homepage) {
+  const fields = [
+    "description",
+    "eyebrow",
+    "heading",
+    "introduction",
+    "primaryAction",
+    "title",
+  ];
+  if (
+    homepage === null ||
+    typeof homepage !== "object" ||
+    Object.keys(homepage).sort().join("\n") !== fields.join("\n") ||
+    fields.some(
+      (field) =>
+        typeof homepage[field] !== "string" ||
+        homepage[field].trim() !== homepage[field] ||
+        homepage[field].length < 10 ||
+        homepage[field].length > 300,
+    ) ||
+    homepage.title.length > 70 ||
+    homepage.description.length > 160
+  )
+    throw new Error("invalid homepage phrase set");
+}
+
+export function validateHomepagePresentation(html, homepage, siteTitle) {
+  validateHomepagePhraseSet(homepage);
+  if (typeof html !== "string" || typeof siteTitle !== "string")
+    throw new Error("invalid homepage presentation input");
+
+  const elementText = (pattern, label) => {
+    const match = pattern.exec(html);
+    if (!match) throw new Error(`homepage omits ${label}`);
+    return normalizedText(match[1]);
+  };
+  const expectedTitle = `${homepage.title} · ${siteTitle}`;
+  const titles = [
+    elementText(/<title>([^<]*)<\/title>/u, "title"),
+    elementText(
+      /<meta property="og:title" content="([^"]*)"\s*\/?>/u,
+      "Open Graph title",
+    ),
+    elementText(
+      /<meta name="twitter:title" content="([^"]*)"\s*\/?>/u,
+      "Twitter title",
+    ),
+  ];
+  if (titles.some((title) => title !== expectedTitle))
+    throw new Error("homepage title metadata drifts from phrase set");
+
+  const descriptions = [
+    elementText(
+      /<meta name="description" content="([^"]*)"\s*\/?>/u,
+      "search description",
+    ),
+    elementText(
+      /<meta property="og:description" content="([^"]*)"\s*\/?>/u,
+      "Open Graph description",
+    ),
+    elementText(
+      /<meta name="twitter:description" content="([^"]*)"\s*\/?>/u,
+      "Twitter description",
+    ),
+  ];
+  if (descriptions.some((description) => description !== homepage.description))
+    throw new Error("homepage description metadata drifts from phrase set");
+
+  if (
+    elementText(/<h1 id="hero-title">([\s\S]*?)<\/h1>/u, "hero H1") !==
+      homepage.heading ||
+    elementText(/<p class="eyebrow">([\s\S]*?)<\/p>/u, "hero eyebrow") !==
+      homepage.eyebrow ||
+    elementText(
+      /<p class="hero-lede">([\s\S]*?)<\/p>/u,
+      "hero introduction",
+    ) !== homepage.introduction
+  )
+    throw new Error("homepage visible proposition drifts from phrase set");
+
+  const primaryAction = elementText(
+    /<a class="button button--primary" href="\/downloads\/">([\s\S]*?)<\/a>/u,
+    "canonical primary action",
+  );
+  if (primaryAction !== `${homepage.primaryAction} →`)
+    throw new Error("homepage primary action drifts from phrase set");
+}
+
 export async function validateDist(
   root,
   { allowedMedia = new Map(), allowedReleaseUrls = new Set() } = {},
diff --git a/tools/site-contract.test.mjs b/tools/site-contract.test.mjs
index ea62ab6..34c592b 100644
--- a/tools/site-contract.test.mjs
+++ b/tools/site-contract.test.mjs
@@ -30,6 +30,8 @@ import {
   validateDownloadsPresentation,
   validateIcon,
   validateIconCatalog,
+  validateHomepagePhraseSet,
+  validateHomepagePresentation,
   validateLocalMediaSource,
   validateMedia,
   validatePageMetadata,
@@ -92,6 +94,48 @@ const validIcon = {
   notice: "Example notice.",
 };
 
+const homepage = {
+  description:
+    "Atrinik is a free, open-source online role-playing game. Download Atrinik Classic for Windows; the replacement remains in development.",
+  eyebrow: "Free, open-source online role-playing game",
+  heading: "Atrinik is a cooperative fantasy game.",
+  introduction:
+    "Explore Atrinik’s isometric islands, ruins, and crystal-lit mysteries with other players. The maintained Classic release is available for Windows; the replacement game remains in development.",
+  primaryAction: "Download Atrinik Classic",
+  title: "Free, open-source online role-playing game",
+};
+
+const homepageHtml = `<title>${homepage.title} · Atrinik</title><meta name="description" content="${homepage.description}"><meta property="og:title" content="${homepage.title} · Atrinik"><meta property="og:description" content="${homepage.description}"><meta name="twitter:title" content="${homepage.title} · Atrinik"><meta name="twitter:description" content="${homepage.description}"><h1 id="hero-title">${homepage.heading}</h1><p class="eyebrow">${homepage.eyebrow}</p><p class="hero-lede">${homepage.introduction}</p><a class="button button--primary" href="/downloads/">${homepage.primaryAction} <span aria-hidden="true">→</span></a>`;
+
+test("homepage phrase set stays structurally aligned", () => {
+  assert.doesNotThrow(() => validateHomepagePhraseSet(homepage));
+  assert.doesNotThrow(() =>
+    validateHomepagePresentation(homepageHtml, homepage, "Atrinik"),
+  );
+  for (const drift of [
+    homepageHtml.replace('name="description"', 'name="summary"'),
+    homepageHtml.replace('property="og:description"', 'property="og:summary"'),
+    homepageHtml.replace(
+      'name="twitter:description"',
+      'name="twitter:summary"',
+    ),
+    homepageHtml.replace('id="hero-title"', 'id="other-title"'),
+    homepageHtml.replace('href="/downloads/"', 'href="/about/"'),
+  ])
+    assert.throws(
+      () => validateHomepagePresentation(drift, homepage, "Atrinik"),
+      /homepage|description|primary|H1/u,
+    );
+  assert.throws(
+    () =>
+      validateHomepagePhraseSet({
+        ...homepage,
+        description: "x".repeat(161),
+      }),
+    /phrase set/u,
+  );
+});
+
 function riffWebp(chunk, payload, totalBytes) {
   const minimumBytes = 20 + payload.length + (payload.length % 2);
   const length = totalBytes ?? minimumBytes;
diff --git a/tools/validate.mjs b/tools/validate.mjs
index 33e60c5..d6fe706 100644
--- a/tools/validate.mjs
+++ b/tools/validate.mjs
@@ -11,6 +11,8 @@ import {
   validateDownloadSchemaDefinition,
   validateDownloadsPresentation,
   validateIconCatalog,
+  validateHomepagePhraseSet,
+  validateHomepagePresentation,
   validateLocalMediaSource,
   validateMedia,
   validatePageMetadata,
@@ -93,6 +95,7 @@ for (const record of icons.entries) {
 const site = await readJson(resolve(root, "src/data/site.json"));
 if (site.canonicalOrigin !== "https://atrinik.org")
   throw new Error("privacy/canonical contract drift");
+validateHomepagePhraseSet(site.homepage);
 const privacyFields = [
   "applicationAnalytics",
   "applicationCookies",
@@ -269,27 +272,9 @@ if (mode === "dist") {
     .replaceAll("&#39;", "'")
     .replaceAll("&quot;", '"')
     .replaceAll("&amp;", "&");
-  const homeProposition = [
-    "Free, open-source online role-playing game · Atrinik",
-    "Atrinik is a free, open-source multiplayer online role-playing game. Download the maintained Atrinik Classic client for Windows while the replacement foundations remain in development.",
-    "Atrinik is a cooperative fantasy role-playing game.",
-    "Atrinik Classic is the playable, maintained release for Windows; the replacement game remains in development.",
-    '<a class="button button--primary" href="/downloads/">',
-    "Download Atrinik Classic",
-    "temporary concept artwork",
-  ];
-  for (const phrase of homeProposition)
-    if (!decodedHome.includes(phrase))
-      throw new Error(`home omits player proposition: ${phrase}`);
-  for (const metadata of [
-    "<title>Free, open-source online role-playing game · Atrinik</title>",
-    '<meta property="og:title" content="Free, open-source online role-playing game · Atrinik"',
-    '<meta name="twitter:title" content="Free, open-source online role-playing game · Atrinik"',
-  ])
-    if (!decodedHome.includes(metadata))
-      throw new Error(
-        `home metadata drifts from player proposition: ${metadata}`,
-      );
+  validateHomepagePresentation(home, site.homepage, site.title);
+  if (!decodedHome.includes("temporary concept artwork"))
+    throw new Error("home omits the concept-art disclosure");
   for (const field of identityFields)
     if (!decodedHome.includes(site.identity[field]))
       throw new Error(`home omits site identity ${field}`);

From 1e07d3bef7b84797825f606b6d58489975a0b204 Mon Sep 17 00:00:00 2001
From: Zoey Rose <zoey@zoeysr.com>
Date: Tue, 11 Aug 2026 16:45:39 +0000
Subject: [PATCH 6/6] fix(metadata): reject quote-adjacent handlers

---
 tools/site-contract.mjs      |  4 ++--
 tools/site-contract.test.mjs | 12 ++++++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/tools/site-contract.mjs b/tools/site-contract.mjs
index 6b695ea..1d79592 100644
--- a/tools/site-contract.mjs
+++ b/tools/site-contract.mjs
@@ -530,7 +530,7 @@ export function validateSvgIconSource(source, id = "icon") {
     typeof source !== "string" ||
     !source.startsWith("<svg ") ||
     !source.includes('viewBox="0 0 64 64"') ||
-    /<script|<style|(?:\s|\/)on[a-z][a-z0-9_-]*\s*=|(?:\s|\/)style\s*=|(?:href|src)\s*=|@import|url\s*\(/iu.test(
+    /<script|<style|(?:\s|\/|["'])on[a-z][a-z0-9_-]*\s*=|(?:\s|\/)style\s*=|(?:href|src)\s*=|@import|url\s*\(/iu.test(
       source,
     )
   )
@@ -1034,7 +1034,7 @@ export async function validateDist(
       )
         throw new Error("404 page must be excluded from indexing");
       parseInertJsonLd(html);
-      if (/(?:\s|\/)on[a-z][a-z0-9_-]*\s*=/iu.test(html))
+      if (/(?:\s|\/|["'])on[a-z][a-z0-9_-]*\s*=/iu.test(html))
         throw new Error(`client script/event handler forbidden in ${path}`);
       for (const match of html.matchAll(/<img\b[^>]*>/giu)) {
         containsImages = true;
diff --git a/tools/site-contract.test.mjs b/tools/site-contract.test.mjs
index 34c592b..e7f2401 100644
--- a/tools/site-contract.test.mjs
+++ b/tools/site-contract.test.mjs
@@ -545,6 +545,13 @@ test("icon records require closed local SVG provenance", () => {
       ),
     /unsafe icon/u,
   );
+  assert.throws(
+    () =>
+      validateSvgIconSource(
+        '<svg viewBox="0 0 64 64"><g id="x"onload="alert(1)"/></svg>',
+      ),
+    /unsafe icon/u,
+  );
   assert.throws(
     () =>
       validateSvgIconSource(
@@ -952,6 +959,11 @@ test("static output rejects scripts, broken links, and excessive files", async (
     accessibleShell.replace("<main", "<main><img/onerror=alert(1)><span"),
   );
   await assert.rejects(validateDist(root), /event handler/u);
+  await writeFile(
+    join(root, "index.html"),
+    accessibleShell.replace("<main", '<main id="x"onload=alert(1)'),
+  );
+  await assert.rejects(validateDist(root), /event handler/u);
   await writeFile(join(root, "index.html"), accessibleShell);
   await writeFile(join(root, "bad.js"), "alert(1)");
   await assert.rejects(validateDist(root), /performance budget/u);