Agent-readiness playground

Five checks an Is Agentic audit scored below full credit. Each panel shows the response an agent actually received before the change and what it receives now. The prober runs the same checks live against any origin, so you can point it at a preview deployment and watch the verdicts flip.

Production is still pre-fix, so probing it should fail most checks. That is the point: a probe that cannot go red is not a gate.

1. Agent-friendly 404s

idle A 404 must say where to look next

The status was already correct. What was missing was recovery: a bare problem object names the failure but not the next hop. Worse, an unknown .md path matched the "has a file extension" branch and fell through to the HTML not-found page, so an agent following this site's own documented "append .md" convention received markup.

before
$ curl -sI /developers.md
HTTP/2 404
content-type: text/html; charset=utf-8

<!DOCTYPE html><html>... 404 page ...
after
$ curl -s -H 'Accept: text/markdown' /nope
HTTP/2 404
content-type: text/markdown; charset=utf-8

# 404: Not found
## Where to look next
- [llms.txt](/llms.txt): ...
- [Sitemap](/sitemap.xml): ...

    2. Developer resource discoverability

    idle Named resources need a machine-readable twin

    The pages were served and in the sitemap; the audit still found nothing for "yonyon developer resources". The gap was that /developers.md did not exist. Twins now render from the same data as the HTML pages, so the two views cannot drift.

      3. Rate-limit headers

      idle Every API response should carry a quota

      Only four self-limiting routes emitted them. The surfaces a scanner probes first are revalidate = false handlers that run at build time, so no header computed inside them can be per-request. Middleware meters them instead. A second, quieter half: CORS was open but the headers were not in Access-Control-Expose-Headers, so a browser-based agent read null from every one of them while curl saw them fine. If this panel goes green in your browser, that half works too.

        4. Versioning and deprecation policy

        idle The policy must be findable and typed

        The policy existed at /api-policy.md, but Markdown-only is invisible to a crawler walking HTML and the sitemap, and Sunset appeared as prose in info.description rather than as a declared response header.

          5. CLI tool

          idle Published, or it does not count

          packages/cli builds a real orchestkit binary with 25 tests, but it is unpublished, so this check stays red on purpose. The site deliberately does not mention it yet: a published-looking install command that 404s is worse than none. 

          $ orchestkit doctor
  ok    node 26.7.0 (>= 20 required)
  ok    API reachable at https://orchestkit.yonyon.ai (ok)
  ok    rate limit 118/120, resets in 60s