feat(seo): clarify public profile and laboratory identities

ClaudiuSchuster commented

2026-10-14 04:57:06 +00:00

Owner

Reconcile #120 onto current Main while preserving the canonical-route, gateway and response-header changes. Exact public profile home pages gain descriptive titles, a canonical URL and safely encoded ProfilePage metadata for people and organizations. Private/limited profiles, tabs, queries and other pages retain the upstream head; service accounts and bots do not receive a Person entity. The landing page adds structured site identity without changing visible content.

Validation: template renders pass all 22 subcases, including hostile-name escaping and upstream-byte comparisons, under Go 1.26 and the CI-compatible Go 1.22. The pinned upstream template matches the extract from the deployed fork image. The release-VM end-to-end gate passed 39 steps, followed by 20 anonymous profile probes; independent exact-tree review returned ACCEPT. Native CI must pass before merge.

This is a source change. Production template installation, service restart and public HTML validation remain a separate operator step. Original #120 and its handoff are preserved.

Reconcile #120 onto current Main while preserving the canonical-route, gateway and response-header changes. Exact public profile home pages gain descriptive titles, a canonical URL and safely encoded ProfilePage metadata for people and organizations. Private/limited profiles, tabs, queries and other pages retain the upstream head; service accounts and bots do not receive a Person entity. The landing page adds structured site identity without changing visible content. Validation: template renders pass all 22 subcases, including hostile-name escaping and upstream-byte comparisons, under Go 1.26 and the CI-compatible Go 1.22. The pinned upstream template matches the extract from the deployed fork image. The release-VM end-to-end gate passed 39 steps, followed by 20 anonymous profile probes; independent exact-tree review returned ACCEPT. Native CI must pass before merge. This is a source change. Production template installation, service restart and public HTML validation remain a separate operator step. Original #120 and its handoff are preserved.

ClaudiuSchuster added 1 commit

2026-10-14 04:57:06 +00:00

seo: clarify public profile and laboratory identities (PR120)

access-validation-contract / contract (pull_request) Successful in 1m31s

Details Explain this check

ci / ci (pull_request) Successful in 48s

Details Explain this check

9ce0b17082

Advances the original Cloud PR120 head cf86b8cd (public-identity handoff
preserved under docs/handoffs/2026-10-10-public-identity/) onto verified
Main 6d69ef4, reconciled after the accepted PR128 canonical, PR129
gateway and PR130 response-header integrations:

- forgejo-custom/templates/base/head.tmpl: conditional profile override
  only for eligible public native profile homes (PageIsUserProfile,
  ContextUser with positive ID, public visibility, exact CurrentURL ==
  HomeLink) — display-name/username title and description, absolute
  canonical from native HTMLURL, ProfilePage JSON-LD with Person or
  Organization mainEntity only for native individual/organization types
  (no bot entity), the three exact service accounts excluded from
  ProfilePage; Go dict maps passed directly into html/template's JSON
  script context (no hand-built JSON or TrustHTML); every other context
  keeps the stock head bytes.
- tests/seo_templates_test.go + tests/fixtures/forgejo-head-upstream.tmpl:
  the render contract (3 groups / 22 subcases; full-render comparison to
  the pinned fixture, sha256 8e07e038…).
- Deployed-image reconciliation (UPSTREAM-NOTICE.md): the stock head.tmpl
  extracted read-only from the deployed fork image (a1e65a7f96e6…,
  forgejo-oo:pve1-cfba3a9687, source cfba3a9687) on release-1005 is
  byte-identical to the fixture — the override is aligned with the
  deployed runtime, not the stale oo13 pin.
- site/landing/index.html: one WebSite/operator JSON-LD graph (distinct
  https://oss-oo.io/#website and https://oss-singularity.io/#organization
  identities); visible landing content unchanged; PR128 canonical kept.
- .forgejo/workflows/ci.yml: go + the render-test step (PR129 lane
  intact); docs/RUNBOOK.md: the PR120 records.

Validation before commit: Go render tests green in a pinned golang
container (GOTOOLCHAIN=local); full scripts/e2e-local.sh green on
release-1005 against the DEPLOYED image (FORGEJO_IMAGE=forgejo-oo:
pve1-cfba3a9687, project pr120gate, port 31831, 39 steps, override live
via the templates bind) followed by 20/20 anonymous profile probes
(public/org/bot/service-account/private/limited/query-tab/stock/escaping;
two iterations disclosed — first had a missing write:admin token scope);
stack torn down with volumes, VM manifest retained, Runner8 untouched.
Independent pinky review of this exact staged tree: ACCEPT.

ClaudiuSchuster merged commit 4cc434a80a into main

2026-10-14 05:17:42 +00:00

ClaudiuSchuster referenced this pull request from a commit

2026-10-14 05:17:43 +00:00

seo: clarify public profile and laboratory identities (#131)

~~ClaudiuSchuster referenced this pull request 2026-10-14 10:34:20 +00:00~~

fix(access): validate redirect and credential boundaries reproducibly #133

Rows
Columns

feat(seo): clarify public profile and laboratory identities #131