Internal audit: six inconsistencies corrected in our public signals

Internal audit results

• 6 contradictions detected
• 6 contradictions corrected
• 7 URLs in the sitemap, generated from the route registry (versus 5, FR only, before)
• 0 fictitious agentic capability declared in the current public files
• 1 coherent generation pipeline, fed by two source contracts: the route registry for URLs, the YAML contract for identity

The last-modified dates of the generated resources checked in this audit are derived from their Git history; they are not entered manually.

Verification method

The verification compared four levels of the system:

1. the source contracts present in the repository;
2. the files produced by the generator;
3. the artefacts selected for deployment;
4. the HTTP responses actually served in production.

For each resource, the checks covered the HTTP status code, MIME type, content, last-modified date and consistency with the capabilities actually available. The production check was run from the local environment against the public URLs with check-discovery.ps1 -Live, supplemented by an inspection of the artefact deployed on the server.

Standards and experimental conventions

Not all resources cited in this audit have the same status. This page distinguishes them instead of presenting them as equivalent.

The ai.txt / ait.txt duplicate is deliberately flagged here rather than hidden: its clarification (merger or distinct roles) remains to be decided, following the same principle that led to removing manifest.webmanifest, a duplicate of manifest.json.

Six findings and their technical traceability

1. The public sitemap covered only French

   Finding

   The sitemap contained only five French URLs (/, /consultant-ia/, /mentions-legales, /confidentialite, /accessibilite), without the English and Italian pages even though they were published and returned HTTP 200.

   Fix

   URLs are now generated from the route registry (contracts/url-policy/routes.csv), the common source of truth for the site and sitemap.

   State after fix

   Seven canonical URLs (fr, en, it, legal pages), regenerated automatically whenever the route registry changes.

   Commit

   350f817

2. Inherited files announced capabilities that were absent

   Finding

   In production, agents.json, ai.txt and llms-sitemap.xml returned 200 with content inherited from an earlier site version, describing interfaces (API, A2A) that did not actually exist (observation documented on 25 July 2026).

   Fix

   Replaced with honest declarations: an empty agent catalogue, an A2A card with zero skills and an OpenAPI contract with no routes.

   State after fix

   agents.json explicitly declares an empty agent list; openapi.json declares "paths": {}; both state this instead of implying otherwise.

   Commit

   350f817, eabf1c0

3. llms.txt contradicted itself

   Finding

   The file stated “No public REST or A2A API is currently exposed on alchimiste-ia.com”, immediately after publishing an A2A card for transparency — the card existed, even empty, so the statement had become false.

   Fix

   The text was rewritten to describe what is actually published rather than deny it.

   State after fix

   “An A2A card (...) and an OpenAPI contract (...) are published for transparency: they explicitly declare zero skills and zero routes, confirming that no active interface is exposed.”

   Commit

   ff8c404

4. The identity profile was no longer synchronized

   Finding

   The identity YAML contract had been enriched (adding “AI-First Architecture”) without regenerating the derived public files (humans.txt, the person Schema.org record) — a three-day gap between source and public projection.

   Fix

   Regenerated from the YAML contract, the single source of truth, using the existing synchronization tool.

   State after fix

   humans.txt and the Schema.org record now contain exactly the same skills as the YAML contract, without duplicate entry.

   Commit

   24f5501

5. The deployment pipeline ignored the new public files

   Finding

   The required deployment paths did not list the new public files (llms-full.txt, llms-sitemap.xml, agents.json, agent-card.json, openapi.json, ai.txt, ait.txt).

   Fix

   The required paths list was updated to explicitly include each of these files.

   State after fix

   Each newly created public file now appears in the deployment checklist.

   Commit

   9465fd6

6. A displayed date did not match a real commit.

   Finding

   The llms.txt footer displayed “20 July 2026”, while the latest commit that modified the file was dated 21 July — a one-day gap between the displayed date and reality.

   Fix

   The generator now derives each date from the actual Git history of the relevant file, and displays no date when no commit exists yet.

   State after fix

   The displayed date exactly matches the latest commit date for the file, verifiable by anyone with access to the history.

   Commit

   85bedee, 364e0c9

What each inconsistency changed for an external reader

Limits of this verification

• A public file presence does not guarantee use by a search engine or agent.
• Manifest compliance does not guarantee site citation.
• These observations describe the domain state on the indicated date; rerun them after each deployment.
• This page points to commit hashes in repository history; it does not yet provide a public evidence register with direct links, requiring a separate decision about repository accessibility.
• Explicitly allowing a crawler (OAI-SearchBot, GPTBot...) in robots.txt permits crawling when the system chooses to access the page; it guarantees neither indexing, display nor citation.