An engineering-side companion to the 30-minute partnership call. Every claim here traces to a shipped file, a live endpoint, or a peer-reviewed source — nothing invented, nothing coming soon.
One Cloud Run service. Four registered domains. Host-based middleware splits traffic
into the correct subtree. Every domain returns HTTP 200 on /sitemap.xml,
/robots.txt,
and /llms.txt right now.
Source of truth: apps/web/src/middleware.ts · apps/web/src/app/sitemap.ts · apps/web/src/app/robots.ts · apps/web/src/app/llms.txt/route.ts
| Item | Live | Evidence | Why it matters |
|---|---|---|---|
| Per-article <title> + meta description | ● | seo.ts · truncateForMeta() caps at 155 chars |
Basic hygiene — still missed by ~40% of SaaS sites |
| OpenGraph + Twitter Card tags | ● | seo.ts · articleMetadata() per post |
Rich link previews on LinkedIn + Twitter shares |
| Canonical URLs, per-vertical | ● | verticalUrl() resolves via NEXT_PUBLIC_APP_BASE_URL |
Kills duplicate-content penalty across dev + prod hosts |
| JSON-LD Article schema | ● | ArticleBody.tsx · articleLd |
Google Rich Results eligibility |
| JSON-LD BreadcrumbList | ● | ArticleBody.tsx · breadcrumbLd |
Site-hierarchy signal for SERP breadcrumbs |
| JSON-LD Organization | ● | ArticleBody.tsx · organizationLd |
Brand as an entity in the Knowledge Graph |
| JSON-LD FAQPage — per article | ● | ArticleBody.tsx · faqLd, 3 Q&A rows/post |
KDD 2024 GEO paper: answer-first is the #1 AI-citation lever |
| Dynamic sitemap.xml | ● | sitemap.ts pulls PUBLISHED posts from Prisma |
Auto-updates when new posts publish |
| robots.txt — allows AI crawlers | ● | robots.ts — no disallow for GPTBot/PerplexityBot/ClaudeBot/Bingbot/Google-Extended |
Zero-cost gate for AI-answer citation (035_geo.md §6.A) |
| llms.txt | ● | llms.txt/route.ts |
Perplexity/ChatGPT-friendly site index |
| HTTPS on all 4 domains | ● | Cloud Run managed certs, Let's Encrypt DNS-01 | Google ranking signal since 2014 |
| Mobile-responsive | ● | Tailwind + explicit MobileNav component |
Google mobile-first index |
| Sub-1s TTFB | ● | Cloud Run us-central1 + edge cache |
Core Web Vitals |
| Semantic HTML (h1/h2/article/nav) | ● | Every publishing page | Accessibility + crawl signal |
| No script-blocking 3rd-party tags | ● | Zero external JS deps at page load | Speed — nothing sits between crawler and content |
Every row's evidence path is real; open the file, confirm the check. All source paths are relative to apps/web/src/app/site/blog/ unless noted.
The one peer-reviewed causal source in the entire GEO field found three tactics each lift AI citation by ~30–40%: statistics addition, quotation addition, and inline citations — and lower-ranked pages benefit more than #1 (rank-5 +115.1%, rank-1 −30.3%). That's structurally in favor of a new property.
Every published post carries verified stats with named-source attribution. This is the top-ranked Princeton lever (~+41% relative visibility on Perplexity for "Cite Sources").
post.authorName is a first-class BlogPost field, rendered on the index page and inside the article header. Feeds Article JSON-LD author.name.
Three-question block appended to every article — source attribution, "why does this matter", "what should I do next". Emitted as both HTML and FAQPage structured data.
Listicles are the single most-cited format in AI answers (~22% of citations, one 23K-citation study). Editorial mix explicitly seeds "X vs Y" and "N frameworks for…" patterns per vertical.
post.updatedAt.toISOString() feeds Article JSON-LD dateModified and sitemap lastModified. Perplexity reflects re-timestamps in 2–7 days.
Four separate JSON-LD blocks per article page, per Google's guidance to keep entity types in distinct <script type="application/ld+json"> tags.
Ahrefs Q1-2026 study: YouTube brand mentions correlate 0.737 with AI visibility — the top measured factor of all studied. Explainer video production scheduled per vertical.
Named bylines exist today; credentials-link page (AAPC/CPC on the med side, SDR-tenure on the SaaS side) queued to close the YMYL gate.
| Control | Evidence / mechanism | Class |
|---|---|---|
| HTTPS enforced on all 4 domains | Cloud Run 301, DNS-01 Let's Encrypt certs | Transport |
| HttpOnly + SameSite=Lax session cookies | session.ts · buildSessionCookie(), Secure in prod |
Cookie hygiene |
| HMAC-SHA-256 signed session tokens, 7-day TTL | session.ts · signSession() / verifySession(), WebCrypto (Edge-safe) |
AuthN |
| Password hashed at rest | SHA-256 for demo; bcrypt/argon2 queued Upgrade queued | AuthN |
| Nested permission tree — 28 pages + 25 API routes gated | lib/permissions.ts · matchPath() — /foo/**, /foo/*, exact grammar with specificity ranking |
AuthZ |
| Root-admin-only user management | /settings/users gated by isRootAdmin bit |
AuthZ |
| Read-only role enforcement | middleware.ts blocks POST/PUT/PATCH/DELETE on admin write prefixes with 403 { error: "read_only" } |
AuthZ |
| CCPA cookie-consent banner | Rendered on public marketing + microsite surfaces | Privacy |
| No secrets in git | All 7 runtime secrets in GCP Secret Manager, injected as env at Cloud Run boot | Secrets |
| Workload Identity Federation, GitHub → GCP | No long-lived JSON keys; OIDC-issued short-lived tokens | Supply chain |
| Cloud SQL Postgres 16, automatic backups | gcloud sql instances create --database-version=POSTGRES_16, us-central1 |
Data |
| Prisma migrate on every container start | prisma migrate deploy in entrypoint — schema-code drift impossible |
Data |
| Cloud Build → Artifact Registry → Cloud Run pipeline | GitHub Actions on push to main; artifact-per-commit |
Delivery |
| Sub-15-minute deploy cycle | git push → live traffic in <15 min, measured | Delivery |
Reference: apps/web/src/middleware.ts · apps/web/src/lib/session.ts · apps/web/src/lib/permissions.ts · platform/DEPLOY.md
stambalead-web · us-central1
One container image · four custom-domain mappings · managed TLS · IPv4+IPv6
trysdrhq.com/* → /site/trysdrhq/* ·
medoutbound.com/* → /site/medoutbound/* ·
app.stambalead.com/ → /app-entry
One container to build, one to deploy, one to observe. All four domains inherit the same security controls, the same certs, the same middleware. When we ship a fix, all four get it in the same 15-minute deploy cycle.
Each vertical earns its own canonical URL, own sitemap entries, own llms.txt, own SEO/GEO metadata, own brand voice. From Google's, Bing's, and ChatGPT's perspective, trysdrhq.com and medoutbound.com are separate businesses.
Verify live: dig trysdrhq.com A +short, curl -sI https://trysdrhq.com/sitemap.xml — both return in under a second.
Everything above is built. This is the last-mile submission work — mostly 5–15 minutes each, returning first indexing signals within 48h and first paid-organic clicks within 7–14 days if the content is on target.
Add property → Domain (covers apex + www + any subdomain). Verify via TXT record. Submit sitemap.
Success: "Sitemap · Success · N URLs discovered" within 24h. All 18+ SaaS articles indexed within 48h.
Identical flow to step 1. Different DNS zone (medoutbound-zone), same TXT + sitemap dance.
Success: HealthTech article inventory (17+ posts) visible in GSC Coverage within 48h.
The google-site-verification=pAW7L-FtE0yKFOO6pk1JN5qnZiRrpBTHuAVyOEoQf1Y record survives from the prior GoDaddy verification. Verify passes without new DNS work. Then submit the sitemap.
Success: Verification "already confirmed" green tick — one-click sitemap submission.
ChatGPT Search retrieves from Bing's index (Seer Interactive: ~87% of SearchGPT citations match Bing's top results — 035_geo.md §2). Ignoring Bing means giving up the ChatGPT channel.
Success: "AI Performance Report" (public preview Feb 2026) shows Copilot + ChatGPT-Search citation counts per query. Free instrumentation for the AI channel.
Neither engine takes direct submissions. Both crawl. Perplexity favors llms.txt-style indexes; Brave gates Claude Search citations. Confirm each domain answers 200 on /llms.txt.
Success: three 200s. Perplexity indexes within 2–7 days of first crawl.
Cloudflare's free AI Audit at cloudflare.com/ai-audit reports which AI crawlers hit each domain and how often. Zero-cost instrumentation of the AI-referral funnel top.
Success: weekly report showing GPTBot / PerplexityBot / ClaudeBot / OAI-SearchBot request counts per property.
@stambalead Top AI-visibility correlatePer Ahrefs Q1-2026 (75,000 brands): YouTube brand mentions correlate 0.737 with AI visibility — the highest single measured factor, ahead of branded web mentions and well ahead of backlinks (035_geo.md §3 Tier 2).
Success: First AI citation of a YouTube transcript typically visible in AIO/ChatGPT after 4–6 posts.
Local intent queries only. For pure B2B lead-gen the ROI is thin — keep on the backlog, not the critical path.
Nothing here is shared-tenant marketing chrome. Every client that comes through 360Connect gets an isolated production surface with the same eight guarantees the four live domains already have.
Client FK"We built the technical stack the same way we run outreach — verified, native, accountable."