# Pivot Sans website

Production-ready static files for <https://pivotsans.com>.

The site has no build step, framework, tracker, CDN, cookie, or third-party
runtime dependency. The small playground is plain JavaScript so it remains
easy to inspect and maintain. The site loads Pivot Sans 1.200 from the six
locale-targeted WOFF2 files under `fonts/1.200/subsets/`.

The previous unversioned `fonts/pivot-sans-subsets.css` and `fonts/subsets/`
paths are frozen Pivot Sans 1.100 compatibility assets. They remain available
for existing consumers, but the current site never references them.

`robots.txt` welcomes all crawlers without exclusions or crawl-delay.
`llms.txt` gives search and language-model agents a concise, canonical project
brief with authorship, lineage, license, features, and stable release links.

## Required deployment layout

Serve this directory as the document root. The accepted release files are:

```text
/downloads/pivot-sans-1.200.zip
/downloads/pivot-sans-1.100.zip
/downloads/pivot-sans-corrected.zip   # byte-identical 1.200 alias
/downloads/SHA256SUMS
/downloads/ASSET-SHA256SUMS           # mutable current-release manifest
/downloads/pivot-sans-1.100-assets.sha256
/downloads/pivot-sans-1.200-assets.sha256
```

`pivot-sans-1.200.zip` and
`pivot-sans-corrected.zip` must be byte-identical. The immutable 1.100 archive
must retain its published SHA-256
`6e892056a104b6b70ebf2eb128e6c86e2825447fa8d1aa3a51cb7aa4273f7490`.
`SHA256SUMS` covers release archives and asset manifests;
`ASSET-SHA256SUMS` is the current release's per-font/specimen manifest, while
the two versioned `.sha256` files preserve historical manifests. No direct
pin-font URLs are referenced by the website; all four pin WOFF2 files remain
inside the complete release archive.

All website paths are root-relative because the production canonical is the
domain apex. Preview with an HTTP server rather than by opening `index.html`
as a `file:` URL:

```sh
python3 -m http.server 8080 --directory /home/codexnative/pivotsans-site
```

Then visit <http://127.0.0.1:8080/>.

## Recommended server behavior

- Redirect HTTP to HTTPS.
- Redirect `www.pivotsans.com` to the canonical apex if that hostname is
  configured later.
- Serve `404.html` for missing resources.
- Serve `.woff2` as `font/woff2`, `.svg` as `image/svg+xml`, and
  `.webmanifest` as `application/manifest+json`.
- Cache versioned font assets for one year.
- Cache HTML briefly so a corrected page can propagate quickly.
- Enable Brotli or gzip for HTML, CSS, JavaScript, SVG, XML, and text. WOFF2
  is already compressed.
- Add `X-Content-Type-Options: nosniff`,
  `Referrer-Policy: strict-origin-when-cross-origin`,
  `Permissions-Policy: camera=(), microphone=(), geolocation=()`, and a
  restrictive Content Security Policy. The only inline block is the
  structured-data JSON in `index.html`; its current SHA-256 CSP hash appears
  below.

Working CSP for the frozen site source:

```text
default-src 'self'; base-uri 'none'; object-src 'none'; frame-ancestors 'none';
font-src 'self'; img-src 'self' data:; style-src 'self';
script-src 'self' 'sha256-+I+1ZYyk1XFpS30cFjpWFQ5UKafUIqZQKVUxgYcw3mU=';
script-src-attr 'none'; form-action 'self'; upgrade-insecure-requests
```

Recalculate that hash if the JSON-LD block changes. The interactive playground
updates the preview element through the DOM and has been browser-tested under
this policy without requiring `unsafe-inline`.

## Font asset refresh

The checked-in 1.200 web assets were copied together from the corrected font
release:

```text
pivot-sans/dist/pivot-sans-subsets.css     → fonts/1.200/
pivot-sans/dist/subsets/*.woff2            → fonts/1.200/subsets/
```

For another release, add a new versioned directory and update the page URLs;
do not overwrite either the frozen unversioned 1.100 assets or a previous
versioned directory. Do not rename generated assets without updating the
`@font-face` URLs.

## Smoke checks

After deployment, verify:

```sh
curl -fsS https://pivotsans.com/ >/dev/null
curl -fsS https://pivotsans.com/favicon.svg >/dev/null
curl -fsS 'https://pivotsans.com/fonts/1.200/subsets/PivotSans-latin-core%5Bwght%5D.woff2' >/dev/null
curl -fsS https://pivotsans.com/downloads/pivot-sans-1.200.zip >/dev/null
curl -fsS https://pivotsans.com/downloads/pivot-sans-1.100.zip >/dev/null
curl -fsS https://pivotsans.com/downloads/SHA256SUMS
```

Check browser developer tools while changing the playground between upright
and italic and entering the locale preset. This specimen intentionally
contains several scripts and styles, so it exercises multiple slices; a
minimal English-only page using the same CSS should fetch only the applicable
Latin Core style.

## Credits and license

Pivot Sans is authored and maintained by Beacon Bay Technologies, Inc. It is
a permanent fork of Inclusive Sans 2.004. The original design is by Olivia
King and remains credited to the Inclusive Sans Project Authors.

Pivot Sans is distributed under the SIL Open Font License 1.1.