From 5a36774c64fbe89e0da648598f35680f6fd4fb3b Mon Sep 17 00:00:00 2001
From: "@permadeath.com" <did:plc:nlzmjyfv6loqtxyzvdcznwgf>
Date: Tue, 18 Aug 2026 11:03:44 -0400
Subject: [PATCH] feat(web): link the publication from every page
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The site served the well-known key but emitted no
rel="site.standard.publication" tag, so a reader holding the page had to
probe the origin to learn what publication it belongs to. The layout now
renders one on every page, read from publicationUri in sequoia.json — the
same value that fills public/.well-known/site.standard.publication, so the
tag and the endpoint that verifies it cannot drift.

Before sequoia init runs the config carries a placeholder, and the tag is
left off rather than pointing at nothing, which is the rule the document
link already followed.
---
 web/scripts/standard-site.test.mjs | 32 ++++++++++++++++++++++++++++++
 web/src/layouts/Layout.astro       | 19 ++++++++++++++++++
 2 files changed, 51 insertions(+)

diff --git a/web/scripts/standard-site.test.mjs b/web/scripts/standard-site.test.mjs
index 4915b1c..0b746eb 100644
--- a/web/scripts/standard-site.test.mjs
+++ b/web/scripts/standard-site.test.mjs
@@ -9,6 +9,8 @@
  *   beside the stale one instead of correcting it.
  * - A post links its document record only once it has one: an href with
  *   nothing behind it is a claim a verifier follows.
+ * - Every page links the publication, and says what sequoia.json says: the
+ *   tag and the well-known are one value, read from one file.
  * - The well-known publication key, once it exists, must say what
  *   sequoia.json says, or the publication cannot be verified.
  * - The atom feed and the built pages must agree about what was posted.
@@ -246,3 +248,33 @@ test("the publication key, once it exists, says what sequoia.json says", () => {
     "public/.well-known did not survive the build",
   );
 });
+
+test("every page links the publication it belongs to", () => {
+  // The well-known is what verifies a publication; the link tag is what a
+  // reader that already has the page resolves without probing. Both come from
+  // publicationUri in sequoia.json — the test above pins the well-known to it,
+  // this pins the pages — so there is one value to keep right. Every page, not
+  // just posts: a reader can arrive anywhere on the site.
+  const pages = readdirSync(outDir, { recursive: true }).filter((entry) =>
+    entry.endsWith(".html"),
+  );
+  assert.ok(pages.length > 3, "the build should emit more pages than this");
+
+  const placeholder = sequoia.publicationUri.includes("PLACEHOLDER");
+  for (const page of pages) {
+    const html = readFileSync(join(outDir, page), "utf8");
+    const linked = [
+      ...html.matchAll(/<link rel="site\.standard\.publication" href="([^"]*)"/g),
+    ].map((match) => match[1]);
+
+    if (placeholder) {
+      assert.deepEqual(linked, [], `${page} links a publication that does not exist yet`);
+      continue;
+    }
+    assert.deepEqual(
+      linked,
+      [sequoia.publicationUri],
+      `${page} should link the publication exactly once`,
+    );
+  }
+});
diff --git a/web/src/layouts/Layout.astro b/web/src/layouts/Layout.astro
index 988f11a..2fddbe7 100644
--- a/web/src/layouts/Layout.astro
+++ b/web/src/layouts/Layout.astro
@@ -1,6 +1,7 @@
 ---
 import "../styles/global.css";
 import PostHog from "../components/PostHog.astro";
+import sequoia from "../../sequoia.json";
 
 interface Props {
   title: string;
@@ -13,6 +14,17 @@ interface Props {
 
 const { title, description, ogType = "website", atUri } = Astro.props;
 
+// The publication this site is. Read from the config that also fills
+// public/.well-known/site.standard.publication, so the tag and the endpoint a
+// verifier checks it against cannot drift. Before `sequoia init` runs the
+// config carries a placeholder, and a tag resolving to nothing is worse than
+// no tag — the same rule the document link below follows.
+const publication = /^at:\/\/[^/]+\/site\.standard\.publication\/[^/]+$/.test(
+  sequoia.publicationUri,
+)
+  ? sequoia.publicationUri
+  : undefined;
+
 // Unfurl crawlers resolve nothing relative, so these must be absolute.
 const canonical = new URL(Astro.url.pathname, Astro.site);
 const card = new URL("/og.png", Astro.site);
@@ -26,6 +38,13 @@ const card = new URL("/og.png", Astro.site);
     <title>{title}</title>
     <meta name="description" content={description} />
     <link rel="canonical" href={canonical} />
+    {
+      /* Every page says which publication it belongs to, so a reader that
+        already has the page does not have to probe the origin to find out —
+        and a reader that only probes still gets the same answer from the
+        well-known. */
+    }
+    {publication && <link rel="site.standard.publication" href={publication} />}
     {
       /* The canonical link's ATProto counterpart. Only a page with a record
         carries it: a verifier resolves the href, so an empty one is worse
-- 
2.51.2