Harden Worker, site shell, gate suite, and Loopy skill

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/workflows/ci.yml

@@ -40,7 +40,7 @@ jobs:
           python3 -m json.tool loop-library/site/.herenow/data.json >/dev/null
           python3 -m json.tool loop-library/site/.herenow/proxy.json >/dev/null
           python3 -m json.tool loop-library/scripts/seo-geo-query-benchmark.json >/dev/null
-          git diff --check
+          git diff --check $(git hash-object -t tree /dev/null) HEAD
 
       - name: Test form Worker
         run: npm --prefix loop-library/worker run check

AGENTS.md

@@ -35,7 +35,9 @@ this repository layout.
 - Every loop must have a stable slug, unique number, search title and
   description, contributor attribution, published and modified dates,
   practical context, verification criteria, category, keywords, and valid
-  related-loop slugs.
+  related-loop slugs. `categoryLabel` must match the label that
+  `loop-library/worker/src/loop-schema.js` maps for the record's `category`,
+  because the page chip uses the mapping while structured data uses the field.
 - Do not hand-edit the homepage, detail pages, catalogs, feed, sitemap, or
   Loopy skill content when publishing a database record. The Worker renders
   those public surfaces from the same record. New loops use the shared social card unless a
@@ -55,12 +57,14 @@ this repository layout.
   python3 -m json.tool loop-library/site/.herenow/data.json >/dev/null
   python3 -m json.tool loop-library/site/.herenow/proxy.json >/dev/null
   python3 -m json.tool loop-library/scripts/seo-geo-query-benchmark.json >/dev/null
-  git diff --check
+  git diff --check $(git hash-object -t tree /dev/null) HEAD
   ```
 
 - Do not publish a loop unless its public homepage row, detail page,
   `catalog.json`, `catalog.md`, `catalog.txt`, `llms.txt`, sitemap, and feed
   all read back from production with the expected slug and modified date.
+  Read back with a cache-busting query string; without it a cached copy can be
+  served for up to a minute and one stale copy for up to ten.
 
 ## Protected forms
 
@@ -71,7 +75,8 @@ this repository layout.
   credentials or allow direct public inserts.
 - Keep Turnstile validation for the expected action, hostname, and origin, plus
   the existing schema checks, rate limits, duplicate suppression, honeypot,
-  minimum completion time, and idempotency handling.
+  minimum completion time (1200 ms for loop suggestions, 800 ms for weekly
+  signups, enforced in the Worker), and idempotency handling.
 - Keep loop suggestions limited to 3/hour and 10/day per IP, and weekly signups
   limited to 5/hour and 10/day per IP. Matching content or email submitted
   within 24 hours should succeed without creating a second record.
@@ -124,6 +129,8 @@ npm run deploy
   provider ID, username, and voter key exclusively from that verified token.
   Reject explicit untrusted Origins; missing Origins are expected through the
   here.now proxy and remain protected by the required bearer token.
+- Vote writes are rate limited per signed-in account through the shared
+  `TURNSTILE_RATE_LIMITER` binding (30 per minute, per `wrangler.jsonc`).
 - Do not expose OAuth client secrets or `SESSION_SECRET` in Worker variables,
   browser code, logs, or committed development files. Configure them with:
 

CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog
 
+## 2026-09-02
+
+### Added
+
+- Enforced the minimum form completion time in the Worker: submissions
+  without a plausible `form_elapsed_ms` receive the silent 202 instead of a
+  record.
+- Rate limited vote writes per signed-in account through the shared
+  `TURNSTILE_RATE_LIMITER` binding, returning the same 429 shape as the forms.
+- Tested the `LoopCatalog` and `VoteStore` Durable Objects against real
+  SQLite instead of stubs.
+- Self-hosted Inter and IBM Plex Mono with `font-display: swap`, preloads,
+  and OFL licenses alongside.
+
+### Changed
+
+- Rendered public pages, catalogs, feed, and sitemap now carry a public
+  `max-age=60, stale-while-revalidate=600` cache header; 404s, shell errors,
+  admin, session, and vote routes stay `no-store`.
+- Atom feed `<published>` and `<updated>` timestamps are emitted in UTC.
+- Hardened the gate suite: `check.mjs` is CRLF-safe with LF pinned in
+  `.gitattributes`, mirrors every `skills/loopy/references` file into the
+  `skills/loop-library` alias, and `git diff --check` runs repo-wide.
+- Repaired the Loopy skill's terminal-state vocabulary, added the `Not
+  ready` Loop Doctor verdict, and routed the default prompt to Find a
+  published loop before crafting one.
+
+## 2026-07-07
+
+### Added
+
+- Added a dedicated "Most popular" sort option to the Loop Library homepage
+  sort dropdown, ordering loops by vote count.
+- Served a branded fallback homepage from the Worker's own catalog when the
+  here.now shell fetch fails or returns a 5xx. The page keeps the site chrome,
+  lists every published loop, points agents at `catalog.json` and `llms.txt`,
+  preserves the upstream failure status, and is marked `noindex`.
+- Documented the redirect-only Vercel project in
+  `infra/signals-forwardfuture-ai-redirect/` that permanently redirects the
+  legacy `https://signals.forwardfuture.ai/*` host to
+  `https://signals.forwardfuture.com/*`.
+
+### Changed
+
+- Hardened the harness checks: `check.mjs` now asserts that README.md,
+  AGENTS.md, and the CI workflow all list the same validation commands, the
+  publish read-back checklist includes `catalog.txt` and `llms.txt`, and the
+  vote route returns an unavailable response when `VOTE_STORE` is not bound.
+
 ## 2026-07-03
 
 ### Added

README.md

@@ -4,7 +4,7 @@ Loop Library has two separate but related parts in this repository:
 
 | Part | What it is | Where it lives |
 | --- | --- | --- |
-| **Loop Library website** | The public catalog where people and agents can browse published loops, read them, and copy their prompts. No installation is required. | [Live website](https://signals.forwardfuture.com/loop-library/) · all website code under [`loop-library/`](loop-library/) (shell in [`loop-library/site/`](loop-library/site/), database and rendering in [`loop-library/worker/`](loop-library/worker/)) |
+| **Loop Library website** | The public catalog where people and agents can browse published loops, read them, and copy their prompts. No installation is required. | [Live website](https://signals.forwardfuture.com/loop-library/) · all website code under [`loop-library/`](loop-library/) (shell in [`loop-library/site/`](loop-library/site/), database and rendering in [`loop-library/worker/`](loop-library/worker/), gate script in [`loop-library/scripts/`](loop-library/scripts/), audits in [`loop-library/audits/`](loop-library/audits/)) |
 | **Loopy skill** | An optional installable guide that helps an AI agent discover, find, audit, repair, craft, run, debrief, save, or prepare loops for publication. It uses the website's live catalog when recommending or publishing loops. | source in [`skills/loopy/`](skills/loopy/) |
 
 The website is the library; Loopy is a companion way to work with it. You
@@ -297,9 +297,9 @@ LOOP_PUBLISH_TOKEN=... \
 ```
 
 The command validates the record and publishes the homepage row, detail page,
-JSON/Markdown/plain-text catalogs, feed, and sitemap from the same database
-write. Use `--draft` to save a non-public record or `--archive` to remove a
-record from public responses without deleting its revision history.
+JSON/Markdown/plain-text catalogs, `llms.txt`, feed, and sitemap from the same
+database write. Use `--draft` to save a non-public record or `--archive` to
+remove a record from public responses without deleting its revision history.
 
 The first database-backed release needs one import from the private migration
 bundle. Loop records and bootstrap data are intentionally not committed to
@@ -357,7 +357,7 @@ npm --prefix loop-library/worker run check
 python3 -m json.tool loop-library/site/.herenow/data.json >/dev/null
 python3 -m json.tool loop-library/site/.herenow/proxy.json >/dev/null
 python3 -m json.tool loop-library/scripts/seo-geo-query-benchmark.json >/dev/null
-git diff --check
+git diff --check $(git hash-object -t tree /dev/null) HEAD
 ```
 
 ### Configure voting

loop-library/audits/seo-geo-2026-06-19.md

@@ -76,7 +76,10 @@ query.
    crawlers and the sitemap is live and linked from every page. Add the sitemap
    at the root-domain owner when that configuration is next changed.
 
-## Current stop state
+## Stop state as of 2026-06-19
+
+The catalog had 30 canonical pages when this snapshot was captured; later
+loops are not covered by these numbers.
 
 The local crawl has no critical, high, or medium technical/content findings,
 and all 33 priority intents map to an answer-ready page. The external benchmark