Claims That Check Themselves: CI for Public Surfaces

This site’s llms.txt, sitemap, and JSON-LD are not maintained — they are generated from the same source content as the pages, with CI drift checks that fail the build when artifacts go stale. The generator is the enforcement mechanism.

Public Files Are Claims

A site's machine-readable surface — its sitemap, its llms.txt, its AI policy files, its structured data — is a set of claims the site makes about itself: what exists here, what the entity is, what may be quoted. Those claims carry the same obligation as the visible prose. They are also the easiest to get wrong, because the failure is silent. Hand-maintained copies drift away from the source one edit at a time, and nothing alarms when they do.

The drift is structural rather than a discipline failure. Two copies of the same fact, edited in different places at different times, diverge. The only durable fix is to make the copies not copies: one source, generated surfaces, and a build that refuses to ship the gap.

One Source, Many Surfaces

On this site the pattern is concrete:

• Discovery files. llms.txt, llms-full.txt, and ai.txt are generated at build time from the same source content that renders the visible pages. A claim removed from the source disappears from the files on the next build, and a claim that exists only in a txt file cannot happen.
• Sitemap. The sitemap is generated from the articles array — the same data structure the writing index renders from. A route that exists must appear; a route that does not exist cannot.
• Structured data. Article JSON-LD reads the same fields — title, date, author, tags — that render the page. The machine-readable attribution and the visible byline are one fact stated twice by construction, not by vigilance.
• Agent-facing policy. The public AGENTS.md plays the same role for agent readers: plain statements of what the entity is and what may be quoted, reviewed like copy rather than maintained like a wiki.

The generator is the enforcement mechanism. A policy document can say "surfaces must agree"; generation makes agreement the default state and makes divergence impossible without a build failure to show for it.

The Drift Check

Generation alone leaves one hole: a generated file can go stale. If the build outputs change and the checked-in artifacts are not regenerated, the repository carries stale claims while the source has moved on. The drift check closes that hole — CI regenerates the files and fails if the committed artifacts differ from what the generator produces.

The check converts a norm into a gate. "Keep the files in sync" is a request a busy week can override. "The build fails when they diverge" is a property of the system. The distinction matters because claims about a site reach machines without a human reading along: a crawler or an answer engine consumes llms.txt literally, and a stale file is a wrong claim published with full confidence.

Checking What Ships, Not What Is Written

Source-level checks have a known limit: they verify the inputs, not the output. A statically generated site served through a worker wrapper can be correct in source and still ship a header missing on a redirect, or an artifact a template produced wrong. So verification extends to the built output:

• Static-HTML scans run against the generated pages before deploy, checking the emitted markup for prompt-injection patterns, hidden content, and unapproved external scripts.
• Header verification runs against the actual serving path — production, checked after deploy per the runbook — because headers are stamped by the wrapper layer and can only be proven there.
• Generated artifacts are treated as build outputs under test, not documents under editorial review.

Each layer exists because a failure once reached production that the layer above it could not see. That is the honest shape of verification: not a wall built in advance, but a set of gates placed exactly where reality previously got through.

What This Buys

The payoff is a public surface whose claims are provably bounded by its source. A reader checking a claim can trace it to the field it was generated from; a machine reading llms.txt gets the same facts the pages state. The cost is real — every generated file is an artifact that must be built, checked, and diffed, and owned surfaces mean owned verification. For a site whose public posture is that claims should carry evidence, that trade is the point. The checkable claim is the credible one.