forked from bchanot/claude
Bastien Chanot
e70e1d6c71
Headers were scored three ways: seo-analyzer priced them into the Technical axis at both depths (:619 FULL, :635 LOCAL), depth-matrix.md:29 said drop them, and /harden re-audits them 0-100 against three external validators. The dedup rule and the agent spec contradicted each other; the agent won by default, so the same finding moved two scores in two reports. Arbitrated (user): /harden keeps them, /seo drops them. That confirms the rule that already existed — seo-analyzer was the violator. Constraint: /harden REUSES seo-analyzer, so the capability cannot be deleted, only scoped. Reading is not scoring: - Technical axis definitions no longer name security headers. - STEP 4 still curls them — needed for X-Robots-Tag, canonical/redirect coherence, and the §14 observed-list — but they earn no points under /seo. - Dispatched from /harden: unchanged, headers ARE the job (verified: its scope spec untouched, 16 header references intact). Carve-out: X-Robots-Tag stays in /seo under indexability. It is an indexing directive wearing a header's clothes — `noindex` there deindexes as surely as a meta robots tag. That is what depth-matrix.md:29 means by "unless it directly affects indexability"; the security headers do not. Drop is not silence: mandatory §14 line on FULL naming what was observed live plus a "run /harden <url>" pointer. A user who never runs /harden must not read a clean Technical score as clean headers — same principle as the mandatory COVERAGE line (I5). Verified: make test 35 GREEN / 0 RED.