feat(marketing): add feedback.md, versioned metadata API, rate-limit headers

[devin-ai-integration]

What Changed

Marketing site only. Notra's agent-readiness scan of akeru-bot.com flagged seven gaps; this closes the ones that are true for a local-first product with a static metadata surface.

• /feedback.md (new public file, Content-Type: text/markdown via vercel.ts). Points agents at the GitHub issue tracker and private security advisories, since there is no feedback inbox or MCP tool. Linked from llms.txt, index.md, agents.md, and .well-known/ard.json.
• Versioned metadata API. New /v1/schema/t3.json route; the old /schema/t3.json stays as an unversioned alias for editor $schema references and is documented as outside the version contract. Both routes share projectFileSchemaResponse().
• Rate-limit headers. Metadata and openapi.json responses carry RateLimit-Policy: "default";q=600;w=60 and RateLimit: "default";r=600;t=60. The 404 /api/* problem response carries them too. Documented on /developers and in llms.txt, including Retry-After on a 429.
• OpenAPI 3.1 document. Typed ProjectFileSchema and Problem schemas, unique operation IDs (getProjectFileSchema, getProjectFileSchemaAlias), descriptions written for function calling, reusable 404/429 responses, and the versioning plus rate-limit policy in info.description.
• Discoverability. /developers headings now name the product ("Akeru Bot public metadata API", "Akeru Bot CLI"), and llms.txt lists the developer guide, OpenAPI document, versioned schema endpoint, and ARD catalog. Root Link header advertises service-desc, api-catalog, and help.
• readiness.test.ts grew from 4 to 6 tests covering the feedback destination, the markdown content type, the rate-limit headers, the versioned path, the typed schema, and the deprecation policy text.

Two backlog items are deliberately not implemented:

• MCP manifest. The site states Akeru Bot does not provide a hosted MCP endpoint. Publishing a manifest for a server that does not exist would be a false claim. Building one is separate work.
• CLI publication. /developers and llms.txt now link the npm package, but publishing akeru-bot needs maintainer credentials and a release action.

The rate-limit headers are published policy, not an enforcing counter. Static Vercel routes cannot keep per-client state, so RateLimit reports the full quota and no route returns a real 429. The documented behavior is what an agent should honor; enforcement needs an edge function.

Why

Agents that read the site had no place to send corrections, no version guarantee on the one public endpoint, no throttling signal, and no typed response schema to generate a function call from. Each fix is metadata or documentation, so none of it touches the app, the server, or user data.

Checklist

• This PR is small and focused
• I explained what changed and why
• I linked the accepted plugin or provider proposal in Why, or this PR does not add one
• I included before/after screenshots for any UI changes
• I included a video for animation/interaction changes

Model: Claude, harness: Devin.

Link to Devin session: https://app.devin.ai/sessions/bc71d0ddfcdd4857a2df79ed1b1fce25
Open in Devin Desktop: https://app.devin.ai/desktop/session/bc71d0ddfcdd4857a2df79ed1b1fce25?variant=devin

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
akeru-bot-landing	Building	Preview	Sep 2, 2026 9:24pm UTC

[greptile-apps]

Greptile Summary

This change expands Akeru Bot’s public discovery surface with feedback guidance, a versioned project-schema endpoint, richer OpenAPI metadata, and readiness coverage.

Confidence Score: 5/5

No blocking failure remains.

No blocking failure remains.

T-Rex Logs

What T-Rex did

• Validated the static route behavior by inspecting the response for request 601, which came back as 200 and showed no per-client throttling or 429 path, and confirmed the route metadata exposes only 'continue', 'headers', and 'src' with no destination or middleware.

_{Ran code and verified through T-Rex}

_{Reviews (2): Last reviewed commit: "Merge branch 'main' into devin/178838348..." | Re-trigger Greptile}

[devin-ai-integration]

The Greptile findings are not from this PR. Both cited files, apps/server/src/orchestration/ActivityPayloadProjection.ts and apps/server/src/ws.ts, are untouched here; the diff is 12 files, all under apps/marketing. Nothing in this change goes near WebSocket payloads or thread subscriptions. Dismissing as out of scope. The two payload concerns may still be real on main and would need their own issue.

Written by Devin