Self-Hosted by Default: Fonts to Discovery Files

This site self-hosts every byte it serves — vendored woff2 fonts, discovery files generated from source — and admits third-party calls only under a written exception rule. The discipline buys determinism and privacy at the price of owning every asset and its verification.

The Default

Every byte this site serves comes from infrastructure the studio controls. Fonts are vendored woff2 files inside the repository, declared with local font-face rules and preloaded. The discovery files — llms.txt, llms-full.txt, ai.txt — are generated from source content at build time. The content security policy allows no third-party script hosts: the one admitted third-party destination is an analytics endpoint, and its client is bundled in-repo rather than loaded from someone else's CDN.

This is a design posture, not an accident of small size. Self-hosting is the default; a third-party dependency has to argue its way in.

The common alternative rents this surface piece by piece: fonts from a public CDN, analytics from a hosted script, the entity's self-description maintained by hand on a third-party service. Each rental is small. The aggregate is a site whose critical bytes and public claims live on other people's infrastructure, under other people's change control.

What Owned Bytes Buy

Three properties follow from owning the serving path:

• Determinism. A build pins every asset the site serves. The page a crawler fetches today is structurally the page it fetches tomorrow, and a diff between builds describes what changed. Nothing upstream can mutate — no CDN-side font swap, no third-party script revision changing behavior under a fixed URL.
• Privacy. A third-party request is a data transfer: the reader's IP, their timing, the page they loaded, delivered to someone else's logs. A font fetched from a public CDN is a small leak; an embedded tracker is a large one. This site admits exactly one such transfer — product analytics — and scopes it in code: no autocapture, no session recording, memory-only persistence, and a scrub layer that strips sensitive event properties before send. Everything else the page requests stays on the same origin.
• Critical-path control. Third-party connections cost DNS resolution, TLS setup, and a queue position behind someone else's availability. Self-hosted assets ride the same connection as the document — for fonts, preloaded before first paint. The mechanism is mundane: fewer connections, fewer parties in the path, fewer things that can stall a render.

None of these are exotic. They compound because they are defaults rather than per-page decisions.

The Discovery Layer Is Also Owned

The same discipline covers the files machines read. The AI discovery files are generated in-repo from the same source content as the pages — the site describes itself in files it controls, checked by the same drift gate that guards the rest of the artifact set. The sitemap is generated from the articles array rather than maintained by hand. Even the theme is a local contract: a small inline script resolves the stored preference before first paint, with no external call and no dependency on a hosted stylesheet.

The pattern generalizes into one rule: if a machine will read it, the site should own it. Handing the description of the entity to a hosted service would put the most retrieval-sensitive surface on someone else's uptime and someone else's editorial controls.

The Honest Cost

Ownership transfers the maintenance. Vendored fonts do not update themselves; a foundry fix means vendoring new files and re-verifying the build. There is no managed service absorbing edge cases — every asset is owned, and every asset must be verified at the built-output level, because source-level checks cannot see what the pipeline actually emits. The verification suite exists precisely because each layer of it was added after a failure that source checks missed.

The trade is explicit: operational effort moves from runtime to build time. That is the correct direction for a content surface — builds are attended, runtimes are not — but it is effort, and pretending otherwise would be the same kind of overstatement this discipline exists to prevent.

The Rule That Scales

The decision rule is short. Self-host by default anything in the critical render path, and anything whose request leaks reader data to a third party. Admit a third-party dependency only when it carries a capability the site genuinely cannot provide itself — and then scope it, pin it, and write down why it earned an exception. The posture also simplifies reasoning about the supply chain: an asset that lives in the repository can be diffed, pinned, and rolled back with the rest of the build. A default is only a default if exceptions have to argue.

The analytics client is the rule working, not an exception hidden from it. Understanding which pages are read is a capability the site cannot provide itself; the client is therefore bundled rather than CDN-loaded, its event surface is narrowed to pageview and page-leave, and its property scrub is a code contract a reviewer can read. If it ever asks for more than that, the rule says the answer is no.