docs: add assistant guide header policy

Author: snapsynapse

README.md

@@ -40,6 +40,8 @@ This repo includes a GuideCheck Human-Verifiable Assistant Guide for bounded AI-
 
 The guide is written for GuideCheck profile `0.3.0` and targets the highest guide-file conformance level, Level 4. Level 5 is not claimed here because GuideCheck reserves Level 5 for a guide plus a conformant assistant runtime.
 
+The Pages source includes `docs/_headers` so hosts that support static header rules can serve the guide with `X-Content-Type-Options: nosniff` and `Strict-Transport-Security`. GitHub Pages does not honor `_headers`; if `https://substack2md.space/` remains on GitHub Pages directly, GuideCheck will continue to warn about those response headers while still reporting Level 3.
+
 Use it this way:
 
 1. Open `.well-known/assistant-guide.txt` or the byte-identical root `assistant-guide.txt` copy and read it in full.

docs/_headers

@@ -0,0 +1,13 @@
+/.well-known/assistant-guide.txt
+  Content-Type: text/plain; charset=utf-8
+  X-Content-Type-Options: nosniff
+  Strict-Transport-Security: max-age=31536000; includeSubDomains
+
+/.well-known/assistant-guide-manifest.txt
+  Content-Type: text/plain; charset=utf-8
+  X-Content-Type-Options: nosniff
+  Strict-Transport-Security: max-age=31536000; includeSubDomains
+
+/*
+  X-Content-Type-Options: nosniff
+  Strict-Transport-Security: max-age=31536000; includeSubDomains

tests/test_assistant_guide.py

@@ -7,6 +7,7 @@
 PAGES_GUIDE = ROOT / "docs" / ".well-known" / "assistant-guide.txt"
 MANIFEST = ROOT / "assistant-guide-manifest.txt"
 PAGES_MANIFEST = ROOT / "docs" / ".well-known" / "assistant-guide-manifest.txt"
+PAGES_HEADERS = ROOT / "docs" / "_headers"
 
 
 def _metadata(text: str) -> dict[str, str]:
@@ -100,6 +101,16 @@ def test_assistant_guide_manifest_matches_bytes():
     assert manifest["immutable-release-url"].startswith("https://")
 
 
+def test_assistant_guide_static_header_policy():
+    headers = PAGES_HEADERS.read_text(encoding="ascii")
+
+    assert "/.well-known/assistant-guide.txt" in headers
+    assert "/.well-known/assistant-guide-manifest.txt" in headers
+    assert "Content-Type: text/plain; charset=utf-8" in headers
+    assert "X-Content-Type-Options: nosniff" in headers
+    assert "Strict-Transport-Security: max-age=31536000; includeSubDomains" in headers
+
+
 def test_assistant_guide_actions_have_required_approval_gates():
     text = GUIDE.read_text(encoding="ascii")
     actions = _action_blocks(text)