# Launch Proof

> Check a new website or web app before it goes live, from what it actually serves. Paste the response headers, the
> HTML head, robots.txt, the sitemap, llms.txt and the web manifest; the browser runs the launch checklist for
> security headers, SEO and GEO, Open Graph and social cards, and favicons, reads robots.txt the way crawlers do (a
> crawler with its own group ignores the * group), holds the AI crawlers to the policy for the kind of site, and
> writes robots.txt, the security headers for Vercel, Cloudflare Pages, Netlify or nginx, and manifest.json. Metered
> runs write the launch report by phase - blockers, recommended fixes, checks to do by hand, the order - and the files
> that need words: llms.txt, a title and description per page at the right length, the social card text and the
> JSON-LD. Built on the SkillSafe skill @samber/site-launch-checklist, from samber/cc-skills (MIT), by Samuel Berthe.
> It never invents a URL, a page, a score or a tool result.

https://launch-proof.skillsafe.ai/

## What is free
- Phase 4, security: Content-Security-Policy at the chosen tightness (no 'unsafe-inline' scripts, frame-ancestors, object-src), HSTS for a year with includeSubDomains and preload, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy, version fingerprints, secret keys in the page.
- Phase 5, SEO and GEO: robots.txt and its sitemap line, whether search engines may crawl, the AI-crawler policy per crawler, the sitemap, llms.txt, JSON-LD types, title 50-60 and description 150-160 characters, the canonical, a stray noindex, hreflang and x-default when multilingual.
- Phase 6, social: the five Open Graph tags, a 1200 by 630 og:image with alt, og:locale, the Twitter card.
- Phase 7, favicons: SVG and PNG icons, apple-touch-icon, a complete manifest, no deprecated tiles.
- The AI-crawler policy by site type: doc and marketing sites allow the AI crawlers and block Bytespider and Amazonbot; portfolios allow GPTBot, ClaudeBot, PerplexityBot and Google-Extended; paid courses and SaaS apps block them all.
- Generated files: robots.txt, the security headers for the host (vercel.json, _headers, nginx add_header), manifest.json. Exports: the checks (.csv), everything (.json).

## The metered lanes
Two tasks on gpt-terra, metered per run, routed by `task`. Input string fields: `task` (report or files), `site`, `served`, `carry` (files only: the report's blockers and fixes) and `facts`.
- `report` replies with `summary`, `phases` (phases 4 to 7, each with `status`, `blockers`, `fixes` and `manual`), `order` and `caveats`.
- `files` replies with `summary`, `llms_txt`, `meta` (path, title, description per page), `og` (title, description, image_alt), `jsonld` and `caveats`.
The page holds every reply to its own checks: every fail row a blocker and every warn row a fix, each phase's status following from them, blockers before fixes; titles of 50-60 and descriptions of 150-160 characters, llms.txt in the llmstxt.org shape, Organization and WebSite JSON-LD, and no URL the site does not have.

## Links
- API tutorial: https://launch-proof.skillsafe.ai/api.html
- Source skill: https://skillsafe.ai/skill/@samber/site-launch-checklist