Akamotodocs

Security headers, verification, and sovereign research

HTTP security headers in akamoto/next.config.ts, crawler rules in app/robots.ts, fail-closed waitlist capture, and Node test verification.

LiveChecked against frankxai/akamoto/next.config.ts, frankxai/akamoto/app/robots.ts, frankxai/akamoto/package.json, frankxai/akamoto/README.md
MCP endpoint/api/mcp

The frankxai/akamoto repository (https://akamoto.io) runs on Next.js 16.4.2 and React 19.2.8 (pnpm@11.5.0). It publishes the three canonical Prophecies (content/prophecies.ts), enforces strict response headers across all routes (next.config.ts), isolates API endpoints from search crawlers (app/robots.ts), and runs zero-dependency Node test suites (package.json).

HTTP security headers (next.config.ts)

akamoto/next.config.ts enables reactStrictMode: true and attaches four defensive HTTP response headers to every route matching source: '/(.*)':

HeaderConfigured valueSecurity posture
X-Content-Type-OptionsnosniffPrevents MIME-sniffing of response payloads outside declared Content-Type
X-Frame-OptionsDENYBlocks clickjacking and third-party <iframe> embedding across all origins
Referrer-Policystrict-origin-when-cross-originSends full referrer on same-origin navigation and origin-only across HTTPS boundaries
Permissions-Policycamera=(), microphone=(), geolocation=()Explicitly disables browser camera, microphone, and geolocation APIs

Crawler and sitemap rules (app/robots.ts)

akamoto/app/robots.ts generates /robots.txt dynamically from process.env.NEXT_PUBLIC_SITE_URL (defaulting to https://akamoto.io):

  • Allowed paths: userAgent: '*', allow: '/' for all public pages and prophecy routes (/prophecies/[slug]).
  • Disallowed paths: disallow: ['/api/'] to keep /api/waitlist out of search indexes.
  • Sitemap binding: Emits sitemap: '${SITE}/sitemap.xml', verified for both the default https://akamoto.io/sitemap.xml origin and custom NEXT_PUBLIC_SITE_URL overrides in app/robots.test.ts.

Sovereign prophecies and fail-closed demand capture

  1. Verified prophecy corpus (content/prophecies.ts): Serves three numbered prophecies at /prophecies/[slug], verified in content/prophecies.test.ts:
    • of-the-sealing (Of the Sealing, Numeral I)
    • of-the-lamp-carried-backwards (Of the Lamp Carried Backwards, Numeral II)
    • of-what-the-dark-keeps (Of What the Dark Keeps, Numeral III)
  2. Fail-closed waitlist register (lib/demand-capture): The waitlist endpoint (app/api/waitlist/route.ts, product ID akamoto-prophecies) requires KV_REST_API_URL, KV_REST_API_TOKEN, RESEND_API_KEY, and RESEND_AUDIENCE_ID (or product override RESEND_AUDIENCE_ID__AKAMOTO_PROPHECIES). When those environment variables are absent, the Register component renders cleanly and reports that registration is not currently taking names rather than failing silently.

Verification commands (package.json)

akamoto/package.json uses Node's built-in test runner with native TypeScript type-stripping (node --experimental-strip-types --test) so unit tests execute directly against .ts sources without a separate test bundler:

# Install dependencies with pnpm 11.5.0
pnpm install

# Run strict TypeScript verification (tsc --noEmit)
pnpm type-check

# Run Node native TypeScript unit tests (robots.test.ts, prophecies.test.ts, questions.test.ts)
pnpm test

# Build the production Next.js 16.4.2 bundle
pnpm build

Fleet routing & loop contracts

How work is routed across model tiers and how recurring autonomous loops are governed.

On this page

HTTP security headers (next.config.ts)Crawler and sitemap rules (app/robots.ts)Sovereign prophecies and fail-closed demand captureVerification commands (package.json)