Skip to content

Add a versionless <meta name="generator"> contributor - #2

Merged
DanMat merged 1 commit into
mainfrom
generator-meta
Aug 25, 2026
Merged

DanMat merged 1 commit into
mainfrom
generator-meta

Conversation

@DanMat

@DanMat DanMat commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Every public page now advertises the CMS with a standard <meta name="generator" content="NimbusCMS">. Constant and deliberately version-less: no version string (fingerprinting surface for no benefit) and no PageContext value (which would be an escaping and, for agent-facing metadata, a prompt-injection sink) — nothing dynamic to escape.

Context (both Fable reviews)

This is the shippable sliver of Dan's "agent discoverability" idea. The platform review split the feature and rejected the speculative part:

  • Advertising the MCP/agent surface in the page <head> — via custom link rels, a JSON discovery block, or a schema.org potentialAction — was rejected: no agent consumes any of those today.
  • The real agent-discoverability convention is llms.txt, a root file — which a plugin can't serve, and which is a core fact (like robots.txt advertising sitemap.xml). That moves to a companion core /llms.txt slice.
  • Drop any MCP protocol-version string from public output (it's negotiated at initialize).

Tests

Emitted on every page kind; constant with no digit (version) ever; a hostile title/site name can't affect the static tag.

Gates

Verified against core dev-main: php-cs-fixer clean · PHPStan clean · phpunit 13/13.

🤖 Generated with Claude Code

Every public page now advertises the CMS with a standard
`<meta name="generator" content="NimbusCMS">`. Constant and deliberately
version-less: it carries no version string (fingerprinting surface for no
benefit) and no PageContext value (which would be an escaping and, for
agent-facing metadata, a prompt-injection sink) — there is nothing dynamic to
escape.

Reviewed by both Fable skills before build. The review split the original
"agent discoverability" idea: this real, shippable sliver ships here; advertising
the MCP/agent surface moves to a core-served /llms.txt (a plugin can't serve a
root route, and the endpoint is a core fact) — and all three speculative
head-advertisement forms (custom link rels, a JSON discovery block, a schema.org
potentialAction) were rejected because no agent consumes them today.

Tests: emitted on every page kind; constant + no digit (version) ever; a hostile
title/site name can't affect the static tag.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@DanMat
DanMat merged commit a83b866 into main Aug 25, 2026
2 checks passed
@DanMat
DanMat deleted the generator-meta branch August 25, 2026 11:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant