Is superace44.club AI agent ready? D · 42/100

You are helping me raise my AIScan.site agent-readiness score.

Site: https://superace44.club/
Platform: lovable (30% confidence)
AIScan score: 42/100 — Level 2 (Readable)
Rubric: v2026.08.2

Please implement the fixes below. Where a file already exists (e.g. `public/robots.txt`, `public/llms.txt`), edit it; otherwise create it. After each change, briefly explain what you did so I can verify in the next scan.

### Failing checks
- **[D1] robots.txt present & sane** — PARTIAL
  - Evidence: 200 OK, 160 bytes
  - Fix: Serve a non-blocking /robots.txt that references your Sitemap.
- **[C2] /llms.txt** — PARTIAL
  - Evidence: 200 OK, 4523 bytes
  - Fix: Publish /llms.txt per llmstxt.org with an H1, summary, and ## sections of markdown links.
- **[B2] Explicit AI bot rules** — FAIL
  - Evidence: 0 known AI agent(s) addressed in robots.txt
  - Fix: Add explicit allow/deny rules for GPTBot, ClaudeBot, PerplexityBot, Google-Extended, etc.
- **[P2] MCP Server Card** — PARTIAL
  - Evidence: HTTP 200
  - Fix: Optional: publish /.well-known/mcp/server-card.json if you expose an MCP server.
- **[D2] XML sitemap** — FAIL
  - Evidence: no /sitemap.xml or /sitemap_index.xml resolved
  - Fix: Publish /sitemap.xml and reference it in robots.txt.
- **[C3] Structured HTML (title, meta, JSON-LD, single H1)** — PARTIAL
  - Evidence: h1: 0, title: true, meta description: true, JSON-LD: false
  - Fix: Ensure a single <h1>, <title>, meta description, and schema.org JSON-LD.
- **[P4] OAuth discovery metadata** — FAIL
  - Evidence: auth-server: 200, protected-resource: 200
  - Fix: Publish RFC 8414 / RFC 9728 metadata at the /.well-known/oauth-* endpoints.
- **[E1] Correct 404 handling** — FAIL
  - Evidence: GET /aiscan-404-probe-zzvo1b → HTTP 200 (soft 404 — returns 200 for a missing page), 4523 bytes, text/html
  - Fix: Return a real HTTP 404 (not 200) for missing pages, with a body that names the site and links to your homepage, sitemap, and search so an agent can recover.
- **[E3] Heading hierarchy & server-rendered text** — FAIL
  - Evidence: 1 words of server-rendered text, 0 <h2>, 0 <h3>
  - Fix: Server-render your main copy and break it into a real heading outline (one h1, then descriptive h2/h3 sections). Agents that don't execute JavaScript only see the HTML you ship.
- **[E4] HTTPS & canonical host** — PARTIAL
  - Evidence: final origin https://superace44.club · http:// upgrades to https · www.superace44.club serves its own copy (duplicate origin) · no HSTS header
  - Fix: Serve the site over HTTPS, 301-redirect http:// to https://, and redirect the www/apex variant to a single canonical host so agents don't index two copies of every URL.
- **[D3] Link header for discovery** — FAIL
  - Evidence: no Link header or <link> tag
  - Fix: Add a Link response header or HTML <link rel="api-catalog"|"describedby"> tag.
- **[B3] Web Bot Auth key directory** — PARTIAL
  - Evidence: HTTP 200
  - Fix: Optional: serve a JWKS-style key directory at /.well-known/http-message-signatures-directory.
- **[E2] Machine-readable API description** — FAIL
  - Evidence: no /openapi.json, /api/openapi.json or swagger document found
  - Fix: Publish an OpenAPI 3.1 document at /openapi.json and reference it from /.well-known/api-catalog as a service-desc link.

### Constraints
- Do not change visible UI or copy.
- Keep changes additive and reversible.
- Prefer static files in `public/` over server routes when possible.
- For `llms.txt`, generate a real index of the site's most important pages.