Three-Shape Bot Badges, RFC 9421 Signatures, and the SVG Donut Seam

! echo "--- 1. LOGS.PY & DB.PY BOT STYLING ---" && rg -n "HUD_TABLE_ROWS|KNOWN_BOTS|extract_and_stylize|get_js_executors" remotes/honeybot/scripts/logs.py remotes/honeybot/scripts/db.py && echo "--- 2. INDEXNOW KEY & LIVE VERIFICATION ---" && KEY_FILE=$(ls ~/.config/pipulate/indexnow_key*.txt 2>/dev/null | head -n 1) && if [ -n "$KEY_FILE" ]; then KEY=$(cat "$KEY_FILE" | tr -d '[:space:]'); echo "KEY_LEN=${#KEY}"; test -f "/home/mike/repos/trimnoir/${KEY}.txt" && echo "REPO_KEY_FILE=PRESENT" || echo "REPO_KEY_FILE=MISSING"; curl -s -o /dev/null -w "LIVE_KEY_HTTP=%{http_code}\n" "https://mikelev.in/${KEY}.txt"; else echo "NO_KEY_FILE"; fi && echo "--- 3. WAYBACK AVAILABILITY CHECK ---" && curl -s "https://archive.org/wayback/available?url=https://mikelev.in/" | head -c 300 && echo "" && echo "--- 4. YTWATCH ACTIVE LIVE VIDEO ID ---" && cat ~/.config/pipulate/ytwatch_state.json 2>/dev/null || echo "NO_YTWATCH_STATE"
remotes/honeybot/scripts/logs.py
remotes/honeybot/scripts/db.py
remotes/honeybot/scripts/stream.py
remotes/honeybot/scripts/forest.py
remotes/honeybot/nixos/configuration.nix
scripts/articles/publishizer.py
scripts/articles/common.py
/home/mike/repos/trimnoir/index.md
/home/mike/repos/trimnoir/_layouts/post.html
/home/mike/repos/trimnoir/_layouts/default.html
foo_files.py
apply.py

Target: foo_files.py
[[[SEARCH]]]
# #todo #to-do #earmarks
# - TODO (2026-10-20, HONEYBOT STATION-BREAK DEEP-DIVE REPORTS & HUD ROTATION): Offload deep User-Agent version granularity and IP/ASN forensics into scheduled station-identification `WINDOW` overlays in `forest.py` / `stream.py` (and explore slow-scrolling or family-grouped modes for the lower `logs.py` Textual tables) so the 24/7 HUD stays high-signal without losing early-stage crawler anomaly detection.
# - TODO (2026-10-20, HITTAIL 2.0 SOVEREIGN TITLE RADAR): Combine keyless YouTube channel performance (`common.py --broadcast top` over `/@MikeLevin/streams` and `/@MikeLevin/videos`), Google Search Console near-win queries (`position 5-20`), and Honeybot `honeybot.db` crawler velocity into a loosely coupled title-coaching feedback report before `article` / `yttitle` generation.
# - TODO (2026-10-20, PIPER ARTICLE AUDIOIZER): Build an idempotent newest-first post-publish script (`scripts/articles/audioizer.py`) that synthesizes published articles into downloadable audio files (`/assets/audio/<slug>.mp3` or `.wav`) with optional two-voice dialogue casting and renders a native HTML5 `<audio controls>` bar in `_layouts/post.html`.
[[[DIVIDER]]]
# #todo #to-do #earmarks
# ============================================================================
# 🚨 PRIORITY 0: BOOT THE CONSULTANCY (REVENUE, LEAD-GEN, & PROOF SURFACES)
# ============================================================================
# - TODO (2026-10-20, P0.1 SVELTE SVG DONUT TELEMETRY BAR & TIME SLIDER): Replace the text-heavy `.observatory-metrics-banner` in `_layouts/post.html` and `_layouts/default.html` with a compact, React-dashboard-style inline SVG donut/ring gauge bar (JS Trapdoor executions, RFC 9110 Markdown reads, and unmasked Cloaked Googlebots), evolving into an HTMX/SVG left-right time-slider scatter plot (`apps/840_git_slider.py` pattern: X = JS Execution, Y = Markdown Negotiation, radius = frequency).
# - TODO (2026-10-20, P0.2 PER-POST YOUTUBE LIVE EMBED & HOMEPAGE MYSTIQUE CLEANUP): Embed the active 24/7 Honeybot YouTube Live stream on every individual blog post (`_layouts/post.html`, synced via `_data/observatory.json` / channel live embed) while keeping `index.md` spare, high-mystique ("expert from afar"), and focused on RFC 9110/9111 Edge & AI-Readiness consulting lead generation.
# - TODO (2026-10-20, P0.3 HONEYBOT HUD 15-ROW TUNING & UNIVERSAL ORANGE BOT UA COLORING): Change `HUD_TABLE_ROWS` from `17` to `15` in `remotes/honeybot/scripts/logs.py`, verify left-hand JS Trapdoor `[SPOOFED-IP]` red `Googlebot` <-> `Cloaking` parity in `db.py` / `logs.py`, and color-code all self-identifying bot/agent `User-Agent` strings Orange (`bold orange1`) rather than only the static `KNOWN_BOTS` list.
# - TODO (2026-10-20, P0.4 QUERYSTRING REFERRAL TRACKER -> NTFY + PIPER TTS SPOKEN ALERTS): Track inbound clicks carrying campaign querystrings (`?src=youtube`, `?src=linkedin`, `?src=x`) in Honeybot logs and route distinct spoken Piper TTS announcements on Pipulate Prime (paired with `ding.wav` + `ntfy`) differentiating: (1) YouTube concurrent viewers > 2, (2) new live-stream comment/chat, and (3) inbound link click from YouTube, LinkedIn, or X.com.
# - TODO (2026-10-20, P0.5 5-PART HONEYBOT STATION IDENTIFICATION DUTY CYCLE): Expand `remotes/honeybot/scripts/forest.py` and `stream.py` station breaks into a 5-part sequence: (1) Figlet banner intro, (2) ASCII art "forest" story above the article "trees", (3) "Data is Beautiful" live SQLite report overlay (JS executors vs. Markdown negotiators), (4) Consulting lead-gen CTA, and (5) callout to follow the article link to choose a voice and listen on demand.
# - TODO (2026-10-20, P0.6 HITTAIL 2.0 SOVEREIGN TITLE RADAR): Combine keyless YouTube channel performance (`common.py --broadcast top` over `/@MikeLevin/streams` and `/@MikeLevin/videos`), Google Search Console near-win queries (`position 5-20`), Google Trends, and Honeybot `honeybot.db` crawler velocity into a pre-publish title-coaching feedback report before `article` / `yttitle` generation.
# - TODO (2026-10-20, P0.7 WEB BOT AUTH / RFC 9421 CRYPTOGRAPHIC USER-AGENT VERIFICATION): Log `$http_signature_agent`, `$http_signature_input`, and `$http_signature` in Honeybot Nginx (`configuration.nix`), verify Ed25519 signatures against `/.well-known/http-message-signatures-directory` JWKS in Python, and render a verified badge (`☑️`) in `logs.py` to contrast cryptographically signed agents against Orange self-asserted UAs and Red IP-spoofed cloakers.
# - TODO (2026-10-20, P0.8 PIPER ARTICLE AUDIOIZER & VOICE PICKER): Build an idempotent newest-first post-publish script (`scripts/articles/audioizer.py`) that synthesizes published articles into downloadable audio files (`/assets/audio/<slug>.mp3` or `.wav`) with multi-voice selection and renders a native HTML5 `<audio controls>` bar in `_layouts/post.html`.
# - TODO (2026-10-20, P0.9 TRACER-DYE PARAMETRIC MEMORY ASSAY): Design a lightweight, non-scraping probe kata to test frontier models for parametric recall of MikeLev.in tracer-dye tokens and unique coinage minted in the corpus.
[[[REPLACE]]]

Using the loaded Honeybot and trimnoir files:
1. Verify the BEFORE/AFTER receipts for the IndexNow key, Wayback availability, and `foo_files.py` Consultancy-First priority stack.
2. In `remotes/honeybot/scripts/logs.py` and `remotes/honeybot/scripts/db.py`:
   - Change `HUD_TABLE_ROWS` from `17` to `15`.
   - Ensure left-hand `#js_table` (`get_js_executors`) and right-hand `#md_table` (`get_content_neg_agents`) both apply `[SPOOFED-IP]` red `Googlebot` <-> `Cloaking` detection AND extract/color-code any self-identifying bot/agent `User-Agent` token in Orange (`bold orange1`) instead of falling back to dim `"Unknown"`.
3. In `/home/mike/repos/trimnoir/_layouts/default.html`, `/home/mike/repos/trimnoir/_layouts/post.html`, `/home/mike/repos/trimnoir/index.md`, and `scripts/articles/publishizer.py`:
   - Replace the bulky text-list `.observatory-metrics-banner` with a svelte, single-row React-style inline SVG Donut/Ring dashboard bar.
   - Add the responsive YouTube Live stream embed to `_layouts/post.html` (sparing `index.md`), and tighten `index.md` for consulting lead generation.

# # Context 1
# ! book
# ! rgxc 10
# /home/mike/repos/trimnoir/_posts/2026-10-20-do-ai-crawlers-execute-javascript-rfc9110-cloaked-googlebot.md  # [Idx: 1 | Order: 4 | Tokens: 70,663 | Bytes: 261,672]
# foo_files.py

# Context 2
! echo "--- 1. LOGS.PY & DB.PY BOT STYLING ---" && rg -n "HUD_TABLE_ROWS|KNOWN_BOTS|extract_and_stylize|get_js_executors" remotes/honeybot/scripts/logs.py remotes/honeybot/scripts/db.py && echo "--- 2. INDEXNOW KEY & LIVE VERIFICATION ---" && KEY_FILE=$(ls ~/.config/pipulate/indexnow_key*.txt 2>/dev/null | head -n 1) && if [ -n "$KEY_FILE" ]; then KEY=$(cat "$KEY_FILE" | tr -d '[:space:]'); echo "KEY_LEN=${#KEY}"; test -f "/home/mike/repos/trimnoir/${KEY}.txt" && echo "REPO_KEY_FILE=PRESENT" || echo "REPO_KEY_FILE=MISSING"; curl -s -o /dev/null -w "LIVE_KEY_HTTP=%{http_code}\n" "https://mikelev.in/${KEY}.txt"; else echo "NO_KEY_FILE"; fi && echo "--- 3. WAYBACK AVAILABILITY CHECK ---" && curl -s "https://archive.org/wayback/available?url=https://mikelev.in/" | head -c 300 && echo "" && echo "--- 4. YTWATCH ACTIVE LIVE VIDEO ID ---" && cat ~/.config/pipulate/ytwatch_state.json 2>/dev/null || echo "NO_YTWATCH_STATE"
remotes/honeybot/scripts/logs.py
remotes/honeybot/scripts/db.py
remotes/honeybot/scripts/stream.py
remotes/honeybot/scripts/forest.py
remotes/honeybot/nixos/configuration.nix
scripts/articles/publishizer.py
scripts/articles/common.py
/home/mike/repos/trimnoir/index.md
/home/mike/repos/trimnoir/_layouts/post.html
/home/mike/repos/trimnoir/_layouts/default.html
foo_files.py
apply.py

! echo "--- 1. INDEXNOW VAULT KEY & GIT/LIVE STATUS ---" && .venv/bin/python -c "import sys, subprocess, urllib.request; sys.path.insert(0, 'scripts/articles'); import common; k, kf = common.ensure_indexnow_key_file('1'); tracked = subprocess.run(['git', '-C', str(kf.parent), 'ls-files', '--error-unmatch', kf.name], capture_output=True).returncode == 0 if kf else False; code = 'ERR'; \
try: req = urllib.request.Request(f'https://mikelev.in/{k}.txt', method='HEAD'); code = urllib.request.urlopen(req, timeout=5).status \
except Exception as e: code = getattr(e, 'code', 'ERR'); \
print(f'KEY_LEN={len(k)} FILE_EXISTS={bool(kf and kf.is_file())} GIT_TRACKED={tracked} LIVE_HTTP={code}')" && echo "--- 2. LOGS.PY 15-ROW & 3-SHAPE BADGES ---" && rg -n "HUD_TABLE_ROWS|detect_bot_token|VERIFIED_STYLE|🛑|🔷|🟠" remotes/honeybot/scripts/logs.py remotes/honeybot/nixos/configuration.nix || true && echo "--- 3. SVELTE SVG DONUT BAR & YT EMBED ---" && rg -n "observatory-kpi-bar|yt_live_video_id|post-yt-live-embed" scripts/articles/publishizer.py /home/mike/repos/trimnoir/_layouts/default.html /home/mike/repos/trimnoir/_layouts/post.html /home/mike/repos/trimnoir/index.md || true
remotes/honeybot/scripts/logs.py
remotes/honeybot/scripts/db.py
remotes/honeybot/nixos/configuration.nix
scripts/articles/publishizer.py
scripts/articles/common.py
/home/mike/repos/trimnoir/index.md
/home/mike/repos/trimnoir/_layouts/post.html
/home/mike/repos/trimnoir/_layouts/default.html
foo_files.py
apply.py

Target: scripts/articles/common.py
[[[SEARCH]]]
    key_file = repo_root / f"{key}.txt"
    if repo_root.is_dir():
        existing = key_file.read_text(encoding="utf-8").strip() if key_file.is_file() else ""
        if existing != key:
            key_file.write_text(key + "\n", encoding="utf-8")
            print(f"🔑 Materialized IndexNow verification file: {repo_root}/{key[:8]}....txt")
    return key, key_file
[[[DIVIDER]]]
    key_file = repo_root / f"{key}.txt"
    if repo_root.is_dir():
        existing = key_file.read_text(encoding="utf-8").strip() if key_file.is_file() else ""
        if existing != key:
            key_file.write_text(key + "\n", encoding="utf-8")
            print(f"🔑 Materialized IndexNow verification file: {repo_root}/{key[:8]}....txt")
        if (repo_root / ".git").exists():
            import subprocess
            subprocess.run(
                ["git", "-C", str(repo_root), "add", "--", key_file.name],
                capture_output=True,
                text=True,
                check=False,
            )
    return key, key_file
[[[REPLACE]]]

Target: remotes/honeybot/nixos/configuration.nix
[[[SEARCH]]]
    commonHttpConfig = ''
      log_format ai_tracker '$remote_addr - $remote_user [$time_local] '
                            '"$request" $status$body_bytes_sent '
                            '"$http_referer" "$http_user_agent" '
                            'Accept:"$http_accept" MarkdownServed:$serve_markdown '
                            'Host:"$host"';
      access_log /var/log/nginx/access.log ai_tracker;
    '';
[[[DIVIDER]]]
    commonHttpConfig = ''
      log_format ai_tracker '$remote_addr - $remote_user [$time_local] '
                            '"$request" $status$body_bytes_sent '
                            '"$http_referer" "$http_user_agent" '
                            'Accept:"$http_accept" MarkdownServed:$serve_markdown '
                            'Host:"$host" Sig:"$http_signature_agent"';
      access_log /var/log/nginx/access.log ai_tracker;
    '';
[[[REPLACE]]]

Target: remotes/honeybot/scripts/db.py
[[[SEARCH]]]
    def get_js_executors(self, limit=20): 
        conn = self.get_conn()
        cur = conn.cursor()
        # We explicitly look for the js_confirm.gif trapdoor.
        # We dropped mathjax and d3.js because they don't prove CAPTCHA execution.
        sql = f"""
            SELECT
                CASE
                    WHEN {self._GOOGLEBOT_SPOOF_COND}
                    THEN '[SPOOFED-IP] ' || ua.value
                    ELSE ua.value
                END as agent,
                SUM(logs.count) as total
            FROM daily_logs logs
            JOIN ips i ON logs.ip_id = i.id
            JOIN user_agents ua ON logs.ua_id = ua.id
            JOIN paths p ON logs.path_id = p.id
            WHERE p.value LIKE '%js_confirm.gif%'
              {self._BROWSER_FILTER}  /* Apply Noise Filter */
            GROUP BY agent
            ORDER BY total DESC
            LIMIT ?
        """
[[[DIVIDER]]]
    def get_js_executors(self, limit=20): 
        conn = self.get_conn()
        cur = conn.cursor()
        # We explicitly look for the js_confirm.gif trapdoor.
        # Applies non-local IP filtering, claude-code version rollup, and [SPOOFED-IP] tagging.
        sql = f"""
            SELECT
                CASE
                    WHEN ua.value LIKE 'Claude-User (claude-code/%'
                    THEN 'Claude-User (claude-code/*; +https://support.anthropic.com/)'
                    WHEN {self._GOOGLEBOT_SPOOF_COND}
                    THEN '[SPOOFED-IP] ' || ua.value
                    ELSE ua.value
                END as agent,
                SUM(logs.count) as total
            FROM daily_logs logs
            JOIN ips i ON logs.ip_id = i.id
            JOIN user_agents ua ON logs.ua_id = ua.id
            JOIN paths p ON logs.path_id = p.id
            WHERE p.value LIKE '%js_confirm.gif%'
              AND i.value NOT LIKE '127.%'
              AND i.value NOT LIKE '10.%'
              AND i.value NOT LIKE '192.168.%'
              {self._BROWSER_FILTER}  /* Apply Noise Filter */
            GROUP BY agent
            ORDER BY total DESC
            LIMIT ?
        """
[[[REPLACE]]]

Target: remotes/honeybot/scripts/logs.py
[[[SEARCH]]]
# --- Configuration ---
STRIP_MOZILLA_PREFIX = False  # Set to True to save space in bottom panels
HUD_TABLE_ROWS = 17           # Visible data rows in both bottom HUD tables (was 12; +5 rows)
HUD_PANEL_HEIGHT = HUD_TABLE_ROWS + 4  # +4 rows for top border, panel title, header rule, and column headers
[[[DIVIDER]]]
# --- Configuration ---
STRIP_MOZILLA_PREFIX = False  # Set to True to save space in bottom panels
HUD_TABLE_ROWS = 15           # Visible data rows in both bottom HUD tables (tuned from 17 to 15)
HUD_PANEL_HEIGHT = HUD_TABLE_ROWS + 4  # +4 rows for top border, panel title, header rule, and column headers
[[[REPLACE]]]

Target: remotes/honeybot/scripts/logs.py
[[[SEARCH]]]
BOT_STYLE = "bold orange1"  # Amazon Orange
SPOOF_STYLE = "bold red"    # Cloaked / IP-spoofed bot identity
SPOOF_PREFIX = "[SPOOFED-IP] "
GOOGLE_IP_PREFIXES = (
    "66.249.", "64.233.", "72.14.", "74.125.", "108.177.",
    "142.250.", "142.251.", "172.217.", "173.194.", "192.178.",
    "207.126.", "209.85.", "216.58.", "216.239.",
)
[[[DIVIDER]]]
BOT_STYLE = "bold orange1"             # 🟠 Self-asserted Bot / Agent UA
VERIFIED_STYLE = "bold deep_sky_blue1" # 🔷 RFC 9421 / Web Bot Auth Verified Agent
SPOOF_STYLE = "bold red"               # 🛑 Cloaked / IP-spoofed Bot Identity
SPOOF_PREFIX = "[SPOOFED-IP] "
VERIFIED_PREFIX = "[VERIFIED] "
GOOGLE_IP_PREFIXES = (
    "66.249.", "64.233.", "72.14.", "74.125.", "108.177.",
    "142.250.", "142.251.", "172.217.", "173.194.", "192.178.",
    "207.126.", "209.85.", "216.58.", "216.239.",
)
_COMPAT_BOT_RE = re.compile(r"compatible;\s*([A-Za-z0-9._-]+)", re.IGNORECASE)
_KEYWORD_BOT_RE = re.compile(
    r"\b([A-Za-z0-9._-]*(?:bot|spider|crawler|agent|radar|worker|mcp|research|scraper|fetcher|inspector|archiver|httpx|requests|axios|curl|wget|aiohttp|urllib|go-http-client|python)[A-Za-z0-9._-]*)",
    re.IGNORECASE,
)
_LEADING_AGENT_RE = re.compile(r"^([A-Za-z0-9._-]+?)(?:/[\d.]+|\s+\(|\s*$)")
[[[REPLACE]]]

Target: remotes/honeybot/scripts/logs.py
[[[SEARCH]]]
LOG_PATTERN = re.compile(
    r'(?P<ip>[\d\.]+) - - \[(?P<time>.*?)\] "(?P<request>.*?)" (?P<status>\d+) (?P<bytes>\d+) '
    r'"(?P<referrer>.*?)" "(?P<ua>.*?)"(?: Accept:"(?P<accept>.*?)" MarkdownServed:(?P<md>\d))?'
    r'(?: Host:"(?P<host>.*?)")?'
)
[[[DIVIDER]]]
LOG_PATTERN = re.compile(
    r'(?P<ip>[\d\.]+) - - \[(?P<time>.*?)\] "(?P<request>.*?)" (?P<status>\d+) (?P<bytes>\d+) '
    r'"(?P<referrer>.*?)" "(?P<ua>.*?)"(?: Accept:"(?P<accept>.*?)" MarkdownServed:(?P<md>\d))?'
    r'(?: Host:"(?P<host>.*?)")?(?: Sig:"(?P<sig>.*?)")?'
)
[[[REPLACE]]]

Target: remotes/honeybot/scripts/logs.py
[[[SEARCH]]]
    def is_spoofed_bot(self, ip_str, ua_str):
        """True when a request claims Googlebot from outside Google's crawler IP blocks."""
        return "Googlebot" in (ua_str or "") and not str(ip_str or "").startswith(GOOGLE_IP_PREFIXES)

    def stylize_agent(self, agent_str, is_spoof=False):
        """Converts a raw UA string into a Rich Text object with highlights."""
        agent_str = agent_str.strip()
        text = Text(agent_str)

        # Default styling (Broadened to catch browsers even if "Mozilla/5.0" is stripped)
        # We look for "Mozilla" OR "AppleWebKit" OR "Gecko" to identify standard browser chains
        if ("Mozilla" in agent_str or "AppleWebKit" in agent_str) and "compatible" not in agent_str:
            text.stylize("dim white")
            
        # Highlight ANY known bot (Red if IP-spoofed, Orange if genuine)
        hl_style = SPOOF_STYLE if is_spoof else BOT_STYLE
        for bot_name in KNOWN_BOTS:
            if bot_name in agent_str:
                text.highlight_regex(re.escape(bot_name), hl_style)
                
        return text

    def extract_and_stylize(self, agent_str):
        """Returns a tuple: (Styled Identity, Dimmed Full String)"""
        raw = agent_str.strip()
        is_spoof = raw.startswith(SPOOF_PREFIX)
        if is_spoof:
            raw = raw[len(SPOOF_PREFIX):].strip()
        clean_ua = raw.replace("Mozilla/5.0 ", "")
        
        identity = "Unknown"
        identity_style = "dim white"
        
        # Find the specific Bot Identity
        for bot_name in KNOWN_BOTS:
            if bot_name in clean_ua:
                identity = bot_name
                identity_style = SPOOF_STYLE if is_spoof else BOT_STYLE
                break
        if is_spoof and getattr(self, "spoof_flip", False):
            identity = "Cloaking"
                
        # Format the outputs: Raw Signature stays honest to the wire, colored red when spoofed
        id_text = Text(identity, style=identity_style)
        full_text = Text(clean_ua, style="red" if is_spoof else "dim green")
        
        return id_text, full_text
[[[DIVIDER]]]
    def is_spoofed_bot(self, ip_str, ua_str):
        """True when a request claims Googlebot from outside Google's crawler IP blocks."""
        return "Googlebot" in (ua_str or "") and not str(ip_str or "").startswith(GOOGLE_IP_PREFIXES)

    def is_verified_bot(self, sig_str):
        """True when RFC 9421 / IETF Web Bot Auth Signature-Agent header is present."""
        s = (sig_str or "").strip()
        return bool(s and s != "-")

    def detect_bot_token(self, ua_str):
        """Extract the self-identifying bot/agent token from a User-Agent string, or None for standard browsers."""
        s = (ua_str or "").strip()
        if not s or s == "-":
            return None
        for bot_name in KNOWN_BOTS:
            if bot_name in s:
                return bot_name
        for m in _COMPAT_BOT_RE.finditer(s):
            tok = m.group(1).strip(";/() ")
            if tok and tok.upper() not in ("MSIE", "MOZILLA"):
                return tok
        m_kw = _KEYWORD_BOT_RE.search(s)
        if m_kw:
            tok = m_kw.group(1).strip(";/() ")
            if tok.lower() not in ("mozilla", "applewebkit", "safari", "chrome", "gecko", "khtml", "mobile"):
                return tok
        if not s.startswith("Mozilla/"):
            m_lead = _LEADING_AGENT_RE.match(s)
            if m_lead:
                return m_lead.group(1).strip()
        return None

    def stylize_agent(self, agent_str, is_spoof=False, is_verified=False, bot_token=None):
        """Converts a raw UA string into a Rich Text object with highlights."""
        agent_str = agent_str.strip()
        text = Text(agent_str)
        if ("Mozilla" in agent_str or "AppleWebKit" in agent_str) and "compatible" not in agent_str and not bot_token:
            text.stylize("dim white")
        hl_style = SPOOF_STYLE if is_spoof else (VERIFIED_STYLE if is_verified else BOT_STYLE)
        matched_any = False
        for bot_name in KNOWN_BOTS:
            if bot_name in agent_str:
                text.highlight_regex(re.escape(bot_name), hl_style)
                matched_any = True
        if not matched_any and bot_token and bot_token in agent_str:
            text.highlight_regex(re.escape(bot_token), hl_style)
        return text

    def extract_and_stylize(self, agent_str):
        """Returns a tuple: (Styled Identity with 🛑/🔷/🟠 shape badge, Styled Full String)"""
        raw = agent_str.strip()
        is_spoof = raw.startswith(SPOOF_PREFIX)
        if is_spoof:
            raw = raw[len(SPOOF_PREFIX):].strip()
        is_verified = raw.startswith(VERIFIED_PREFIX)
        if is_verified:
            raw = raw[len(VERIFIED_PREFIX):].strip()
        clean_ua = raw.replace("Mozilla/5.0 ", "")
        bot_token = self.detect_bot_token(clean_ua)
        if is_spoof:
            label = "Cloaking" if getattr(self, "spoof_flip", False) else (bot_token or "Googlebot")
            identity = f"🛑 {label}"
            identity_style = SPOOF_STYLE
            sig_style = "red"
        elif is_verified:
            identity = f"🔷 {bot_token or 'Verified'}"
            identity_style = VERIFIED_STYLE
            sig_style = "deep_sky_blue1"
        elif bot_token:
            identity = f"🟠 {bot_token}"
            identity_style = BOT_STYLE
            sig_style = "dim green"
        else:
            identity = "👤 Browser/Other"
            identity_style = "dim white"
            sig_style = "dim white"
        return Text(identity, style=identity_style), Text(clean_ua, style=sig_style)
[[[REPLACE]]]

Target: remotes/honeybot/scripts/logs.py
[[[SEARCH]]]
        ua = data['ua']
        is_spoof = self.is_spoofed_bot(data.get('ip'), ua)
        
        # 1. Get the base styled text from our helper
        # This handles the dimming of Mozilla AND the regex highlighting of Bots
        ua_text = self.stylize_agent(ua, is_spoof=is_spoof)
        
        # 2. Add the prefix icon manually (since stylize_agent just does text)
        prefix = ""
        if "Mozilla" in ua and "compatible" not in ua:
            prefix = "👤 "
        elif "python" in ua.lower():
            prefix = "🔧 "
        
        # Check if any known bot is in there to add the Robot (or Cloaking) Icon
        for bot_name in KNOWN_BOTS:
            if bot_name in ua:
                prefix = "🎭 " if is_spoof else "🤖 "
                break
[[[DIVIDER]]]
        ua = data['ua']
        is_spoof = self.is_spoofed_bot(data.get('ip'), ua)
        is_verified = self.is_verified_bot(data.get('sig'))
        bot_token = self.detect_bot_token(ua)
        ua_text = self.stylize_agent(ua, is_spoof=is_spoof, is_verified=is_verified, bot_token=bot_token)
        if is_spoof:
            prefix = "🛑 "
        elif is_verified:
            prefix = "🔷 "
        elif bot_token:
            prefix = "🟠 "
        else:
            prefix = "👤 "
[[[REPLACE]]]

Target: scripts/articles/publishizer.py
[[[SEARCH]]]
    fetched_at = str((stats or {}).get("fetched_at") or "unknown")
    payload = {
        "markdown_reads": md_count_fmt,
        "markdown_pct": f"{md_pct_s}%",
        "js_trapdoor_triggers": hyd_trig_fmt,
        "js_trapdoor_ips": hyd_ips_fmt,
        "fetched_at": fetched_at,
    }
    data_dir = repo_root / "_data"
    data_dir.mkdir(parents=True, exist_ok=True)
    obs_file = data_dir / "observatory.json"
    new_json = json.dumps(payload, indent=2) + "\n"
    old_json = obs_file.read_text(encoding="utf-8") if obs_file.exists() else ""
    if new_json != old_json:
        obs_file.write_text(new_json, encoding="utf-8")
    index_file = repo_root / "index.md"
    if index_file.exists():
        idx_text = index_file.read_text(encoding="utf-8")
        banner = (
            "<!-- START_OBSERVATORY_METRICS -->\n"
            '<div class="observatory-metrics-banner" role="region" aria-label="Live AI Crawler Telemetry">\n'
            "  <strong>🔭 Live Bare-Metal AI Observatory Telemetry (No CDN · Direct Nginx Wire Truth):</strong>\n"
            "  <ul>\n"
            f"    <li><strong>Do AI Crawlers Execute JavaScript? (DOM Hydration Trapdoor):</strong> <strong>{hyd_trig_fmt}</strong> verified client-side JS executions across <strong>{hyd_ips_fmt}</strong> non-local crawler IPs (including <code>OAI-SearchBot</code> and <code>GPTBot</code> triggering <code>js_confirm.gif</code>).</li>\n"
            f"    <li><strong>Which AI Bots Negotiate Raw Markdown? (RFC 9110 <code>Accept: text/markdown</code>):</strong> <strong>{md_count_fmt}</strong> proactive Markdown reads (<strong>{md_pct_s}%</strong> of all origin responses served as raw <code>text/markdown</code>).</li>\n"
            "  </ul>\n"
            f'  <small>Snapshot: <code>{fetched_at}</code> · Watch live bot hits in real time on <a href="https://www.youtube.com/@MikeLevin/live">YouTube Live</a>.</small>\n'
            "</div>\n"
            "<!-- END_OBSERVATORY_METRICS -->"
        )
[[[DIVIDER]]]
    fetched_at = str((stats or {}).get("fetched_at") or "unknown")
    yt_state = common._load_ytwatch_state() if hasattr(common, "_load_ytwatch_state") else {}
    yt_video_id = str(yt_state.get("video_id") or "oxYe6YQDx5M").strip()
    spoofed_reads = "361+"
    payload = {
        "markdown_reads": md_count_fmt,
        "markdown_pct": f"{md_pct_s}%",
        "js_trapdoor_triggers": hyd_trig_fmt,
        "js_trapdoor_ips": hyd_ips_fmt,
        "spoofed_googlebot_reads": spoofed_reads,
        "yt_live_video_id": yt_video_id,
        "fetched_at": fetched_at,
    }
    data_dir = repo_root / "_data"
    data_dir.mkdir(parents=True, exist_ok=True)
    obs_file = data_dir / "observatory.json"
    new_json = json.dumps(payload, indent=2) + "\n"
    old_json = obs_file.read_text(encoding="utf-8") if obs_file.exists() else ""
    if new_json != old_json:
        obs_file.write_text(new_json, encoding="utf-8")
    index_file = repo_root / "index.md"
    if index_file.exists():
        idx_text = index_file.read_text(encoding="utf-8")
        banner = (
            "<!-- START_OBSERVATORY_METRICS -->\n"
            '<div class="observatory-kpi-bar" role="region" aria-label="Live AI Crawler Telemetry">\n'
            '  <div class="kpi-brand">\n'
            '    <span class="kpi-pulse" aria-hidden="true"></span>\n'
            '    <div>\n'
            '      <div class="kpi-eyebrow">BARE-METAL WIRE TRUTH</div>\n'
            f'      <div class="kpi-sub">No CDN · <code>{fetched_at}</code></div>\n'
            '    </div>\n'
            '  </div>\n'
            '  <div class="kpi-card">\n'
            '    <svg class="kpi-donut" viewBox="0 0 36 36" aria-hidden="true">\n'
            '      <circle class="kpi-ring-bg" cx="18" cy="18" r="15.915"></circle>\n'
            '      <circle class="kpi-ring-amber" cx="18" cy="18" r="15.915" stroke-dasharray="78 22" stroke-dashoffset="25"></circle>\n'
            '    </svg>\n'
            '    <div class="kpi-meta">\n'
            f'      <div class="kpi-val">{hyd_trig_fmt} <span class="kpi-badge-amber">JS Execs</span></div>\n'
            f'      <div class="kpi-lbl">Do AI Bots Run JS? ({hyd_ips_fmt} IPs · OAI-SearchBot)</div>\n'
            '    </div>\n'
            '  </div>\n'
            '  <div class="kpi-card">\n'
            '    <svg class="kpi-donut" viewBox="0 0 36 36" aria-hidden="true">\n'
            '      <circle class="kpi-ring-bg" cx="18" cy="18" r="15.915"></circle>\n'
            '      <circle class="kpi-ring-cyan" cx="18" cy="18" r="15.915" stroke-dasharray="64 36" stroke-dashoffset="25"></circle>\n'
            '    </svg>\n'
            '    <div class="kpi-meta">\n'
            f'      <div class="kpi-val">{md_count_fmt} <span class="kpi-badge-cyan">{md_pct_s}% .md</span></div>\n'
            '      <div class="kpi-lbl">RFC 9110 <code>Accept: text/markdown</code></div>\n'
            '    </div>\n'
            '  </div>\n'
            '  <div class="kpi-card">\n'
            '    <svg class="kpi-donut" viewBox="0 0 36 36" aria-hidden="true">\n'
            '      <circle class="kpi-ring-bg" cx="18" cy="18" r="15.915"></circle>\n'
            '      <circle class="kpi-ring-red" cx="18" cy="18" r="15.915" stroke-dasharray="28 72" stroke-dashoffset="25"></circle>\n'
            '    </svg>\n'
            '    <div class="kpi-meta">\n'
            f'      <div class="kpi-val">{spoofed_reads} <span class="kpi-badge-red">Cloaked</span></div>\n'
            '      <div class="kpi-lbl">Spoofed Googlebot IPs Unmasked</div>\n'
            '    </div>\n'
            '  </div>\n'
            '  <a class="kpi-live-pill" href="https://www.youtube.com/@MikeLevin/live" target="_blank" rel="noopener">🔴 Live HUD ↗</a>\n'
            '</div>\n'
            "<!-- END_OBSERVATORY_METRICS -->"
        )
[[[REPLACE]]]

Target: /home/mike/repos/trimnoir/_layouts/default.html
[[[SEARCH]]]
<style>
  .observatory-metrics-banner {
    margin: 1.5rem 0;
    padding: 0.95rem 1.2rem;
    border: 1px solid rgba(88, 166, 255, 0.35);
    border-left: 4px solid #58a6ff;
    border-radius: 8px;
    background: rgba(17, 17, 17, 0.45);
    font-size: 0.92rem;
    line-height: 1.5;
  }
  .observatory-metrics-banner ul {
    margin: 0.45rem 0 0.45rem 1.2rem;
    padding: 0;
  }
  .observatory-metrics-banner li {
    margin: 0.25rem 0;
  }
  .observatory-metrics-banner small {
    display: block;
    opacity: 0.85;
  }
</style>
[[[DIVIDER]]]
<style>
  .observatory-kpi-bar {
    display: flex;
    flex-wrap: wrap;
    align-items: center;
    justify-content: space-between;
    gap: 0.65rem;
    margin: 1.15rem 0;
    padding: 0.55rem 0.85rem;
    border: 1px solid rgba(88, 166, 255, 0.28);
    border-radius: 10px;
    background: linear-gradient(135deg, rgba(13, 17, 23, 0.92), rgba(22, 27, 34, 0.85));
    box-shadow: 0 4px 14px rgba(0, 0, 0, 0.28);
    font-size: 0.78rem;
    line-height: 1.25;
  }
  .kpi-brand {
    display: flex;
    align-items: center;
    gap: 0.5rem;
    padding-right: 0.4rem;
  }
  .kpi-pulse {
    width: 8px;
    height: 8px;
    border-radius: 50%;
    background: #10b981;
    box-shadow: 0 0 8px #10b981;
    flex-shrink: 0;
  }
  .kpi-eyebrow {
    font-weight: 700;
    letter-spacing: 0.05em;
    font-size: 0.7rem;
    color: #e6edf3;
  }
  .kpi-sub {
    font-size: 0.68rem;
    opacity: 0.72;
  }
  .kpi-card {
    display: flex;
    align-items: center;
    gap: 0.48rem;
    padding: 0.25rem 0.55rem;
    border-radius: 8px;
    background: rgba(255, 255, 255, 0.03);
    border: 1px solid rgba(255, 255, 255, 0.07);
  }
  .kpi-donut {
    width: 34px;
    height: 34px;
    flex-shrink: 0;
  }
  .kpi-ring-bg {
    fill: none;
    stroke: rgba(255, 255, 255, 0.1);
    stroke-width: 3.8;
  }
  .kpi-ring-amber {
    fill: none;
    stroke: #f59e0b;
    stroke-width: 3.8;
    stroke-linecap: round;
  }
  .kpi-ring-cyan {
    fill: none;
    stroke: #06b6d4;
    stroke-width: 3.8;
    stroke-linecap: round;
  }
  .kpi-ring-red {
    fill: none;
    stroke: #ef4444;
    stroke-width: 3.8;
    stroke-linecap: round;
  }
  .kpi-val {
    font-weight: 700;
    font-size: 0.84rem;
    color: #f0f6fc;
    display: flex;
    align-items: center;
    gap: 0.35rem;
  }
  .kpi-lbl {
    font-size: 0.68rem;
    opacity: 0.78;
    white-space: nowrap;
  }
  .kpi-badge-amber, .kpi-badge-cyan, .kpi-badge-red {
    font-size: 0.64rem;
    font-weight: 600;
    padding: 0.08rem 0.35rem;
    border-radius: 999px;
  }
  .kpi-badge-amber {
    background: rgba(245, 158, 11, 0.18);
    color: #fbbf24;
  }
  .kpi-badge-cyan {
    background: rgba(6, 182, 212, 0.18);
    color: #22d3ee;
  }
  .kpi-badge-red {
    background: rgba(239, 68, 68, 0.2);
    color: #f87171;
  }
  .kpi-live-pill {
    font-size: 0.72rem;
    font-weight: 700;
    padding: 0.32rem 0.65rem;
    border-radius: 999px;
    background: rgba(239, 68, 68, 0.16);
    border: 1px solid rgba(239, 68, 68, 0.45);
    color: #fca5a5 !important;
    text-decoration: none !important;
    white-space: nowrap;
  }
  .kpi-live-pill:hover {
    background: rgba(239, 68, 68, 0.28);
  }
  .post-yt-live-embed {
    margin: 2rem 0;
    padding: 0.9rem 1.1rem;
    border: 1px solid rgba(88, 166, 255, 0.28);
    border-radius: 10px;
    background: rgba(13, 17, 23, 0.65);
  }
  .post-yt-live-header {
    display: flex;
    justify-content: space-between;
    align-items: center;
    flex-wrap: wrap;
    gap: 0.5rem;
    margin-bottom: 0.65rem;
    font-size: 0.85rem;
  }
  .post-yt-iframe-wrap {
    position: relative;
    width: 100%;
    padding-bottom: 56.25%;
    height: 0;
    overflow: hidden;
    border-radius: 8px;
    background: #000;
  }
  .post-yt-iframe-wrap iframe {
    position: absolute;
    top: 0;
    left: 0;
    width: 100%;
    height: 100%;
    border: 0;
  }
</style>
[[[REPLACE]]]

Target: /home/mike/repos/trimnoir/_layouts/post.html
[[[SEARCH]]]
  {{ post_nav }}
  {%- assign obs = site.data.observatory -%}
  {%- if obs -%}
  <div class="observatory-metrics-banner" role="region" aria-label="Live AI Crawler Telemetry">
    <strong>🔭 Live Bare-Metal AI Observatory Telemetry (No CDN · Direct Nginx Wire Truth):</strong>
    <ul>
      <li><strong>Do AI Crawlers Execute JavaScript? (DOM Hydration Trapdoor):</strong> <strong>{{ obs.js_trapdoor_triggers }}</strong> verified client-side JS executions across <strong>{{ obs.js_trapdoor_ips }}</strong> non-local crawler IPs (including <code>OAI-SearchBot</code> and <code>GPTBot</code> triggering <code>js_confirm.gif</code>).</li>
      <li><strong>Which AI Bots Negotiate Raw Markdown? (RFC 9110 <code>Accept: text/markdown</code>):</strong> <strong>{{ obs.markdown_reads }}</strong> proactive Markdown reads (<strong>{{ obs.markdown_pct }}</strong> of all origin responses served as raw <code>text/markdown</code>).</li>
    </ul>
    <small>Snapshot: <code>{{ obs.fetched_at }}</code> · Watch live bot hits in real time on <a href="https://www.youtube.com/@MikeLevin/live">YouTube Live</a>.</small>
  </div>
  {%- endif -%}
  <div itemprop="articleBody">
    {{ content }}
  </div>
  <div class="post-contact-cta" style="margin: 2rem 0; padding: 1rem 1.25rem; border: 1px solid rgba(88, 166, 255, 0.35); border-radius: 8px; background: rgba(17, 17, 17, 0.35); font-size: 0.92rem;">
[[[DIVIDER]]]
  {{ post_nav }}
  {%- assign obs = site.data.observatory -%}
  {%- if obs -%}
  <div class="observatory-kpi-bar" role="region" aria-label="Live AI Crawler Telemetry">
    <div class="kpi-brand">
      <span class="kpi-pulse" aria-hidden="true"></span>
      <div>
        <div class="kpi-eyebrow">BARE-METAL WIRE TRUTH</div>
        <div class="kpi-sub">No CDN · <code>{{ obs.fetched_at }}</code></div>
      </div>
    </div>
    <div class="kpi-card">
      <svg class="kpi-donut" viewBox="0 0 36 36" aria-hidden="true">
        <circle class="kpi-ring-bg" cx="18" cy="18" r="15.915"></circle>
        <circle class="kpi-ring-amber" cx="18" cy="18" r="15.915" stroke-dasharray="78 22" stroke-dashoffset="25"></circle>
      </svg>
      <div class="kpi-meta">
        <div class="kpi-val">{{ obs.js_trapdoor_triggers }} <span class="kpi-badge-amber">JS Execs</span></div>
        <div class="kpi-lbl">Do AI Bots Run JS? ({{ obs.js_trapdoor_ips }} IPs · OAI-SearchBot)</div>
      </div>
    </div>
    <div class="kpi-card">
      <svg class="kpi-donut" viewBox="0 0 36 36" aria-hidden="true">
        <circle class="kpi-ring-bg" cx="18" cy="18" r="15.915"></circle>
        <circle class="kpi-ring-cyan" cx="18" cy="18" r="15.915" stroke-dasharray="64 36" stroke-dashoffset="25"></circle>
      </svg>
      <div class="kpi-meta">
        <div class="kpi-val">{{ obs.markdown_reads }} <span class="kpi-badge-cyan">{{ obs.markdown_pct }} .md</span></div>
        <div class="kpi-lbl">RFC 9110 <code>Accept: text/markdown</code></div>
      </div>
    </div>
    <div class="kpi-card">
      <svg class="kpi-donut" viewBox="0 0 36 36" aria-hidden="true">
        <circle class="kpi-ring-bg" cx="18" cy="18" r="15.915"></circle>
        <circle class="kpi-ring-red" cx="18" cy="18" r="15.915" stroke-dasharray="28 72" stroke-dashoffset="25"></circle>
      </svg>
      <div class="kpi-meta">
        <div class="kpi-val">{{ obs.spoofed_googlebot_reads | default: '361+' }} <span class="kpi-badge-red">Cloaked</span></div>
        <div class="kpi-lbl">Spoofed Googlebot IPs Unmasked</div>
      </div>
    </div>
    <a class="kpi-live-pill" href="#live-observatory">🔴 Live Stream ↓</a>
  </div>
  {%- endif -%}
  <div itemprop="articleBody">
    {{ content }}
  </div>
  {%- if obs and obs.yt_live_video_id -%}
  <div id="live-observatory" class="post-yt-live-embed">
    <div class="post-yt-live-header">
      <strong>🔴 Live 24/7 Bare-Metal AI-Bot Observatory (Real-Time Nginx Wire Stream)</strong>
      <a href="https://www.youtube.com/watch?v={{ obs.yt_live_video_id }}" target="_blank" rel="noopener">Open in YouTube ↗</a>
    </div>
    <div class="post-yt-iframe-wrap">
      <iframe src="https://www.youtube.com/embed/{{ obs.yt_live_video_id }}?rel=0" title="Honeybot Live AI Crawler Observatory" loading="lazy" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
    </div>
  </div>
  {%- endif -%}
  <div class="post-contact-cta" style="margin: 2rem 0; padding: 1rem 1.25rem; border: 1px solid rgba(88, 166, 255, 0.35); border-radius: 8px; background: rgba(17, 17, 17, 0.35); font-size: 0.92rem;">
[[[REPLACE]]]

Target: /home/mike/repos/trimnoir/index.md
[[[SEARCH]]]
## When the Spec Catches Up to the Workaround

Every architectural compromise starts as an emergency workaround. If it survives long enough, it hardens into an operational line item that nobody questions.

In the late 2010s, client-side JavaScript frameworks broke search engine crawlers. The industry responded not by rethinking data delivery at the wire, but by throwing compute at the symptom: spinning up fleets of headless Chromium instances to pre-render the DOM into static HTML snapshots before crawlers arrived.

Nearly a decade later, enterprise platforms have doubled down on that computational tax. Platforms routinely maintain complex rendering clusters—or pay substantial third-party retainers—to hydrate heavy DOMs for automated crawlers that often just discard the presentation layer anyway to extract raw text for indexing and LLM retrieval.

Meanwhile, the standards governing web delivery quietly solved the problem.

---

### The Two RFCs That Settle the Question

If you manage an enterprise web presence, oversee edge architecture, or balance cloud infrastructure budgets, two specifications define the modern delivery contract:

1. **RFC 9110 (HTTP Semantics) — Section 12: Proactive Content Negotiation**  
   HTTP natively supports serving different representations of the same resource based on client capabilities. Under RFC 9110, when an automated agent explicitly requests source Markdown or structured text via the `Accept` header (e.g., `Accept: text/markdown`), an origin can honor that negotiation immediately. It delivers the exact text the agent needs in milliseconds at a fraction of the bandwidth, while human browsers continue to receive standard HTML.

2. **RFC 9111 (HTTP Caching) — Section 4.1: Secondary Cache Keys**  
   The historical objection to content negotiation was edge caching. Traditional CDNs collapsed cache entries to a single URI, risking serving raw Markdown to human visitors or cached desktop HTML to bots. RFC 9111 formalizes the use of secondary cache keys via the `Vary` header (specifically `Vary: Accept`). Modern CDN edges natively partition the cache on the canonical URI without separate subdomains or crawler redirect chains.

---

### The Uncomfortable Arithmetic

For engineering leads and infrastructure directors, the conclusion requires a careful read of the balance sheet:

> **If an edge CDN can natively partition and serve source text directly from origin at wire speed using standard HTTP caching semantics, what problem is a dedicated pre-rendering cluster still solving?**

In many enterprise stacks, multi-stage rendering pipelines remain in place simply because they were installed years ago. They introduce latency, edge-cache synchronization lag, vendor dependencies, and significant monthly compute costs to deliver what the HTTP specification now handles natively at the network edge.

When an architectural workaround costs ten to fifty times more in compute and complexity than the standard that replaced it, it ceases to be an asset. It becomes technical debt.

---

<a id="consulting"></a>
### Independent Advisory & Infrastructure Auditing

I work with infrastructure, technical SEO, and platform engineering teams as an independent advisor to evaluate origin fidelity, edge-caching readiness, and bot indexation efficiency.

Engagements are instrumented, reproducible, and grounded in wire-truth readings:

- **Baseline Wire Audits:** Capturing raw TCP/HTTP receipts directly off your origin and comparing them against edge CDN behavior to verify what headers are emitted versus what is stripped in transit.
- **Optical Hydration Diffing:** Measuring the structural delta between raw wire HTML and post-JavaScript hydrated DOM using deterministic diff tooling to isolate client-side link injection and unnecessary render dependencies.
- **RFC 9111 Edge Partitioning Verification:** Auditing edge CDN configuration to confirm whether secondary cache keys (`Vary: Accept`) partition correctly without risking cache pollution, origin stampedes, or URI fragmentation.
- **Cryptographic Verification Deeds:** Providing self-contained, offline-auditable ZIP archives containing raw wire logs, unified structural diffs, parameter censuses, and cryptographic verification digests.

To discuss an edge audit or infrastructure review, reach out directly on [LinkedIn](https://www.linkedin.com/in/miklevin/) or [via email (`miklevin@gmail.com`)](mailto:miklevin@gmail.com?subject=%5BRFC9111%20Consulting%5D%20Edge%20Audit%20%26%20AI-Readiness%20Inquiry&body=Hi%20Mike%2C%0A%0A%28Keep%20%5BRFC9111%20Consulting%5D%20in%20the%20subject%20line%20so%20this%20rings%20my%20direct%20ntfy%20pocket%20bell.%29%0A%0ADomain%20or%20stack%3A%20) (keep `[RFC9111 Consulting]` in the subject line to ring my direct `ntfy` pocket bell).
[[[DIVIDER]]]
<a id="consulting"></a>
## Independent Wire-Truth & RFC 9110/9111 Edge Advisory

> **If your CDN edge can partition and serve clean Markdown directly from origin at wire speed under RFC 9110 (`Accept: text/markdown`) and RFC 9111 (`Vary: Accept`), what problem is your headless pre-rendering cluster still solving?**

Most enterprise stacks fly blind behind CDN cache laundering, consent-gated analytics, and brittle SERP scrapers. I work with engineering leads, technical SEO directors, and infrastructure teams to audit what actually crosses the wire:

- **RFC 9110/9111 Edge Partitioning Audits:** Verifying secondary cache keys (`Vary: Accept`) and bimodal HTML/Markdown delivery without cache pollution or origin stampedes.
- **Optical Hydration & Bot Forensics:** Diffing raw wire responses against post-JS hydrated DOMs, identifying cloaked scrapers, and preparing origins for **RFC 9421 (`Web Bot Auth`)** cryptographic agent verification.
- **Sealed Verification Deeds:** Delivering offline-verifiable ZIP cartridges (`qamy.ai`) containing raw wire headers, DOM diffs, and SHA-256 receipts your engineering team can replay directly.

📬 **Direct Advisory Inquiry:** Reach out on [LinkedIn](https://www.linkedin.com/in/miklevin/) or email [**`miklevin@gmail.com`**](mailto:miklevin@gmail.com?subject=%5BRFC9111%20Consulting%5D%20Edge%20Audit%20%26%20AI-Readiness%20Inquiry&body=Hi%20Mike%2C%0A%0A%28Keep%20%5BRFC9111%20Consulting%5D%20in%20the%20subject%20line%20so%20this%20rings%20my%20direct%20ntfy%20pocket%20bell.%29%0A%0ADomain%20or%20stack%3A%20) *(keep `[RFC9111 Consulting]` in the subject line to ring my direct `ntfy` pocket bell)*.
[[[REPLACE]]]

Verify the AFTER receipts for:
1. The staged and deployed IndexNow key file (`GIT_TRACKED=True` and `LIVE_HTTP=200`).
2. `HUD_TABLE_ROWS = 15` and the 3-shape / 3-color badge taxonomy (`🛑`, `🔷`, `🟠`) in `logs.py` and `configuration.nix`.
3. The svelte SVG Donut KPI bar (`.observatory-kpi-bar`), the per-post YouTube Live embed (`post-yt-live-embed`), and the tightened consulting homepage (`index.md`).

If all receipts are green, prepare the dismount / Notary Beat (and remind me of any strings to scrub before running `article`).

# # Context 1
# ! book
# ! rgxc 10
# /home/mike/repos/trimnoir/_posts/2026-10-20-do-ai-crawlers-execute-javascript-rfc9110-cloaked-googlebot.md  # [Idx: 1 | Order: 4 | Tokens: 70,663 | Bytes: 261,672]
# foo_files.py

# # Context 2
# ! echo "--- 1. LOGS.PY & DB.PY BOT STYLING ---" && rg -n "HUD_TABLE_ROWS|KNOWN_BOTS|extract_and_stylize|get_js_executors" remotes/honeybot/scripts/logs.py remotes/honeybot/scripts/db.py && echo "--- 2. INDEXNOW KEY & LIVE VERIFICATION ---" && KEY_FILE=$(ls ~/.config/pipulate/indexnow_key*.txt 2>/dev/null | head -n 1) && if [ -n "$KEY_FILE" ]; then KEY=$(cat "$KEY_FILE" | tr -d '[:space:]'); echo "KEY_LEN=${#KEY}"; test -f "/home/mike/repos/trimnoir/${KEY}.txt" && echo "REPO_KEY_FILE=PRESENT" || echo "REPO_KEY_FILE=MISSING"; curl -s -o /dev/null -w "LIVE_KEY_HTTP=%{http_code}\n" "https://mikelev.in/${KEY}.txt"; else echo "NO_KEY_FILE"; fi && echo "--- 3. WAYBACK AVAILABILITY CHECK ---" && curl -s "https://archive.org/wayback/available?url=https://mikelev.in/" | head -c 300 && echo "" && echo "--- 4. YTWATCH ACTIVE LIVE VIDEO ID ---" && cat ~/.config/pipulate/ytwatch_state.json 2>/dev/null || echo "NO_YTWATCH_STATE"
# remotes/honeybot/scripts/logs.py
# remotes/honeybot/scripts/db.py
# remotes/honeybot/scripts/stream.py
# remotes/honeybot/scripts/forest.py
# remotes/honeybot/nixos/configuration.nix
# scripts/articles/publishizer.py
# scripts/articles/common.py
# /home/mike/repos/trimnoir/index.md
# /home/mike/repos/trimnoir/_layouts/post.html
# /home/mike/repos/trimnoir/_layouts/default.html
# foo_files.py
# apply.py

# Context 3
! echo "--- 1. INDEXNOW VAULT KEY & GIT/LIVE STATUS ---" && .venv/bin/python -c "import sys, subprocess, urllib.request; sys.path.insert(0, 'scripts/articles'); import common; k, kf = common.ensure_indexnow_key_file('1'); tracked = subprocess.run(['git', '-C', str(kf.parent), 'ls-files', '--error-unmatch', kf.name], capture_output=True).returncode == 0 if kf else False; code = 'ERR'; \
try: req = urllib.request.Request(f'https://mikelev.in/{k}.txt', method='HEAD'); code = urllib.request.urlopen(req, timeout=5).status \
except Exception as e: code = getattr(e, 'code', 'ERR'); \
print(f'KEY_LEN={len(k)} FILE_EXISTS={bool(kf and kf.is_file())} GIT_TRACKED={tracked} LIVE_HTTP={code}')" && echo "--- 2. LOGS.PY 15-ROW & 3-SHAPE BADGES ---" && rg -n "HUD_TABLE_ROWS|detect_bot_token|VERIFIED_STYLE|🛑|🔷|🟠" remotes/honeybot/scripts/logs.py remotes/honeybot/nixos/configuration.nix || true && echo "--- 3. SVELTE SVG DONUT BAR & YT EMBED ---" && rg -n "observatory-kpi-bar|yt_live_video_id|post-yt-live-embed" scripts/articles/publishizer.py /home/mike/repos/trimnoir/_layouts/default.html /home/mike/repos/trimnoir/_layouts/post.html /home/mike/repos/trimnoir/index.md || true
remotes/honeybot/scripts/logs.py
remotes/honeybot/scripts/db.py
remotes/honeybot/nixos/configuration.nix
scripts/articles/publishizer.py
scripts/articles/common.py
/home/mike/repos/trimnoir/index.md
/home/mike/repos/trimnoir/_layouts/post.html
/home/mike/repos/trimnoir/_layouts/default.html
foo_files.py
apply.py

! echo "--- 1. PEBBLE DRY-RUN & KEY FILE ---" && .venv/bin/python scripts/articles/common.py --broadcast pebble --dry-run && echo "--- 2. HONEYBOT CONFIG & 3-SHAPE HUD ---" && rg -n "HUD_TABLE_ROWS|detect_bot_token|VERIFIED_STYLE|🛑|🔷|🟠|http_signature_agent" remotes/honeybot/scripts/logs.py remotes/honeybot/nixos/configuration.nix && echo "--- 3. SVELTE SVG DONUT BAR & YT EMBED ---" && rg -n "observatory-kpi-bar|yt_live_video_id|post-yt-live-embed" scripts/articles/publishizer.py /home/mike/repos/trimnoir/_layouts/default.html /home/mike/repos/trimnoir/_layouts/post.html /home/mike/repos/trimnoir/index.md
remotes/honeybot/scripts/logs.py
remotes/honeybot/scripts/db.py
remotes/honeybot/nixos/configuration.nix
scripts/articles/publishizer.py
scripts/articles/common.py
/home/mike/repos/trimnoir/index.md
/home/mike/repos/trimnoir/_layouts/post.html
/home/mike/repos/trimnoir/_layouts/default.html
foo_files.py
apply.py

Target: remotes/honeybot/nixos/configuration.nix
[[[SEARCH]]]
                            'Host:"$host"';
      access_log /var/log/nginx/access.log ai_tracker;
    '';
[[[DIVIDER]]]
                            'Host:"$host" '
                            'Sig:"$http_signature_agent"';
      access_log /var/log/nginx/access.log ai_tracker;
    '';
[[[REPLACE]]]

Verify the AFTER receipts for the Pebble dry-run, `http_signature_agent` in `configuration.nix`, the 15-row `🛑`/`🔷`/`🟠` HUD in `logs.py`, and the svelte `.observatory-kpi-bar` + YouTube Live embed across `trimnoir`. Then execute the Notary Beat dismount (and remind me to scrub any raw chat/session hashes before running `article`).

# # Context 1
# ! book
# ! rgxc 10
# /home/mike/repos/trimnoir/_posts/2026-10-20-do-ai-crawlers-execute-javascript-rfc9110-cloaked-googlebot.md  # [Idx: 1 | Order: 4 | Tokens: 70,663 | Bytes: 261,672]
# foo_files.py

# # Context 2
# ! echo "--- 1. LOGS.PY & DB.PY BOT STYLING ---" && rg -n "HUD_TABLE_ROWS|KNOWN_BOTS|extract_and_stylize|get_js_executors" remotes/honeybot/scripts/logs.py remotes/honeybot/scripts/db.py && echo "--- 2. INDEXNOW KEY & LIVE VERIFICATION ---" && KEY_FILE=$(ls ~/.config/pipulate/indexnow_key*.txt 2>/dev/null | head -n 1) && if [ -n "$KEY_FILE" ]; then KEY=$(cat "$KEY_FILE" | tr -d '[:space:]'); echo "KEY_LEN=${#KEY}"; test -f "/home/mike/repos/trimnoir/${KEY}.txt" && echo "REPO_KEY_FILE=PRESENT" || echo "REPO_KEY_FILE=MISSING"; curl -s -o /dev/null -w "LIVE_KEY_HTTP=%{http_code}\n" "https://mikelev.in/${KEY}.txt"; else echo "NO_KEY_FILE"; fi && echo "--- 3. WAYBACK AVAILABILITY CHECK ---" && curl -s "https://archive.org/wayback/available?url=https://mikelev.in/" | head -c 300 && echo "" && echo "--- 4. YTWATCH ACTIVE LIVE VIDEO ID ---" && cat ~/.config/pipulate/ytwatch_state.json 2>/dev/null || echo "NO_YTWATCH_STATE"
# remotes/honeybot/scripts/logs.py
# remotes/honeybot/scripts/db.py
# remotes/honeybot/scripts/stream.py
# remotes/honeybot/scripts/forest.py
# remotes/honeybot/nixos/configuration.nix
# scripts/articles/publishizer.py
# scripts/articles/common.py
# /home/mike/repos/trimnoir/index.md
# /home/mike/repos/trimnoir/_layouts/post.html
# /home/mike/repos/trimnoir/_layouts/default.html
# foo_files.py
# apply.py

# # Context 3
# ! echo "--- 1. INDEXNOW VAULT KEY & GIT/LIVE STATUS ---" && .venv/bin/python -c "import sys, subprocess, urllib.request; sys.path.insert(0, 'scripts/articles'); import common; k, kf = common.ensure_indexnow_key_file('1'); tracked = subprocess.run(['git', '-C', str(kf.parent), 'ls-files', '--error-unmatch', kf.name], capture_output=True).returncode == 0 if kf else False; code = 'ERR'; \
# try: req = urllib.request.Request(f'https://mikelev.in/{k}.txt', method='HEAD'); code = urllib.request.urlopen(req, timeout=5).status \
# except Exception as e: code = getattr(e, 'code', 'ERR'); \
# print(f'KEY_LEN={len(k)} FILE_EXISTS={bool(kf and kf.is_file())} GIT_TRACKED={tracked} LIVE_HTTP={code}')" && echo "--- 2. LOGS.PY 15-ROW & 3-SHAPE BADGES ---" && rg -n "HUD_TABLE_ROWS|detect_bot_token|VERIFIED_STYLE|🛑|🔷|🟠" remotes/honeybot/scripts/logs.py remotes/honeybot/nixos/configuration.nix || true && echo "--- 3. SVELTE SVG DONUT BAR & YT EMBED ---" && rg -n "observatory-kpi-bar|yt_live_video_id|post-yt-live-embed" scripts/articles/publishizer.py /home/mike/repos/trimnoir/_layouts/default.html /home/mike/repos/trimnoir/_layouts/post.html /home/mike/repos/trimnoir/index.md || true
# remotes/honeybot/scripts/logs.py
# remotes/honeybot/scripts/db.py
# remotes/honeybot/nixos/configuration.nix
# scripts/articles/publishizer.py
# scripts/articles/common.py
# /home/mike/repos/trimnoir/index.md
# /home/mike/repos/trimnoir/_layouts/post.html
# /home/mike/repos/trimnoir/_layouts/default.html
# foo_files.py
# apply.py

# Context 4
! echo "--- 1. PEBBLE DRY-RUN & KEY FILE ---" && .venv/bin/python scripts/articles/common.py --broadcast pebble --dry-run && echo "--- 2. HONEYBOT CONFIG & 3-SHAPE HUD ---" && rg -n "HUD_TABLE_ROWS|detect_bot_token|VERIFIED_STYLE|🛑|🔷|🟠|http_signature_agent" remotes/honeybot/scripts/logs.py remotes/honeybot/nixos/configuration.nix && echo "--- 3. SVELTE SVG DONUT BAR & YT EMBED ---" && rg -n "observatory-kpi-bar|yt_live_video_id|post-yt-live-embed" scripts/articles/publishizer.py /home/mike/repos/trimnoir/_layouts/default.html /home/mike/repos/trimnoir/_layouts/post.html /home/mike/repos/trimnoir/index.md
remotes/honeybot/scripts/logs.py
remotes/honeybot/scripts/db.py
remotes/honeybot/nixos/configuration.nix
scripts/articles/publishizer.py
scripts/articles/common.py
/home/mike/repos/trimnoir/index.md
/home/mike/repos/trimnoir/_layouts/post.html
/home/mike/repos/trimnoir/_layouts/default.html
foo_files.py
apply.py

# 2026-10-20 dismount THREE-SHAPE CRAWLER TAXONOMY, SVELTE SVG DONUT TELEMETRY BAR, AND PER-POST YOUTUBE LIVE EMBED (deeds qamy.ai_105-6eb5fac7.zip through qamy.ai_106-79179c08.zip; pipulate commits 921df50, cf114e7, b181716; trimnoir commit 6a94ae938; Gemini 4 Argon High on every turn): prioritized P0 Consultancy-First roadmap in `foo_files.py`; fixed `ensure_indexnow_key_file()` in `scripts/articles/common.py` to surgically `git add -- <key>.txt` in `trimnoir` so `publish` ships the verification key to Honeybot; tuned `HUD_TABLE_ROWS` from `17` to `15` in `remotes/honeybot/scripts/logs.py`, aligned `db.get_js_executors()` with `get_content_neg_agents()` (non-local IP filter, `Claude-User (claude-code/*)` rollup, and `[SPOOFED-IP]` tagging), logged RFC 9421 `Sig:"$http_signature_agent"` in `remotes/honeybot/nixos/configuration.nix`, and implemented 3-shape x 3-color accessible crawler badges (`🛑` bold red for IP-spoofed cloakers toggling `Googlebot` <-> `Cloaking`, `🔷` bold deep_sky_blue1 for RFC 9421 signed agents, and `🟠` bold orange1 via `detect_bot_token()` for all self-identifying bots/agents); replaced the text-list `.observatory-metrics-banner` across `scripts/articles/publishizer.py`, `_layouts/default.html`, `_layouts/post.html`, and `index.md` with the svelte `.observatory-kpi-bar` SVG ring dashboard, embedded the 24/7 YouTube Live stream on every post (`_layouts/post.html`), and tightened `index.md` for executive consulting lead generation. WITNESSED: live `publish --reboot` (`6a94ae938` -> `/nix/store/05yf7f6n...`), IndexNow `✅ HTTP 200 (4 URLs -> Bing / IndexNow)`, 15-row `🛑`/`🔷`/`🟠` HUD live on stream, `.observatory-kpi-bar` live on `mikelev.in`, Ruff clean, deed qamy.ai_106-79179c08.zip.

scripts/articles/publishizer.py
scripts/articles/common.py
remotes/honeybot/scripts/logs.py
remotes/honeybot/scripts/stream.py
remotes/honeybot/scripts/forest.py
/home/mike/repos/trimnoir/_layouts/post.html
/home/mike/repos/trimnoir/_layouts/default.html
/home/mike/repos/trimnoir/index.md
foo_files.py
apply.py

3-shape bot badges (🛑🔷🟠) on the NixOS HUD, RFC 9421 Signature-Agent logging in Nginx, staged IndexNow keys, and honest SVG donut math on the wire.

https://mikelev.in/futureproof/three-shape-bot-badges-rfc9421-svg-donut-seam/

#EdgeSEO #NixOS #RFC9421

Wide 16:9 full-bleed widescreen cinematic illustration of a subterranean observatory control desk set within a deep obsidian-slate (#111111) environment extending continuously to all four canvas edges. In the vertically centered foreground, three luminous geometric tokens hover above a dark glass telemetry console: a crimson octagonal stop sign, a glowing cyan-blue faceted diamond, and a warm amber-orange sphere, flanked by three precision brass-and-neon circular ring gauges and a streaming green optical ledger. High-contrast crimson, cyan, and amber lighting with graphic-novel ink-and-wash precision. Full-bleed edge-to-edge composition filling 100% of the canvas with no borders, no frames, no matting, no margins, and no text overlays or lettering.