site: render a library item's PDF from its committed source

.gitattributes

@@ -0,0 +1,5 @@
+# A committed source's bytes are what SHA256SUMS records - line-ending
+# normalization on checkout would make the hash disagree with itself on a
+# clone whose autocrlf setting differs from the one that last touched the
+# working tree. Force LF unconditionally rather than depend on that setting.
+library/**/*.source.html text eol=lf

.github/workflows/library.yml

@@ -0,0 +1,38 @@
+name: Library
+
+# The library's shape and no-gate contract - see library/README.md - is
+# machine-enforced so an item that violates it fails the build rather than
+# reaching a reader. Passes vacuously with zero items present.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'library/**'
+      - 'scripts/check_library.py'
+      - '.github/workflows/library.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'library/**'
+      - 'scripts/check_library.py'
+      - '.github/workflows/library.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  check-library:
+    runs-on: ubuntu-latest
+    name: library/ shape and no-gate contract hold
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Check library/ contract
+        run: python3 scripts/check_library.py

assets/fonts/ibm-plex/OFL.txt

@@ -0,0 +1,93 @@
+Copyright © 2017 IBM Corp. with Reserved Font Name "Plex"
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+
+This license is copied below, and is also available with a FAQ at: http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

library/README.md

@@ -0,0 +1,50 @@
+# Library — contract
+
+This directory holds the transitrix.com library of free reference material. The shape
+below is enforced by `scripts/check_library.py` in CI (`.github/workflows/library.yml`)
+— an item that violates it fails the check rather than reaching a reader.
+
+- **One directory per item:** `library/<slug>/`, served at
+  `https://transitrix.com/library/<slug>/`.
+- **The source lives at `library/<slug>/<slug>.source.html`.** This is the committed,
+  human-authored content — the words are its author's. It is never edited by a
+  rendering step; only read.
+- **The PDF lives at `library/<slug>/<slug>.pdf`, rendered from the source, never
+  hand-authored.** `scripts/render_library_item.py <slug>` renders it via headless
+  Chrome on an agent's own host, offline, and asserts the result's page count and
+  geometry against the source's own `@page` rule before it is committed. CI never
+  renders — see "Checked, not rendered" below. The filename is the slug, so a revision
+  replaces the file in place and never mints a second URL.
+- **The source's `<title>` leads with the item's own printed name** — read from the
+  source's own `<h1>` — with no suffix beyond the site's existing ` | Transitrix`.
+- **Kinds of material are not path segments.** A cheat sheet, a template and a worked
+  example all sit directly under `library/<slug>/`; grouping belongs on the index page,
+  where it can be revised, never in an address that has been printed and handed out.
+- **No gate of any kind.** No form, no email field, no sign-up, no interstitial, no
+  tracking wall, on the source or on any item page.
+- **The typefaces are vendored, not fetched.** A source pulls its fonts from
+  `/assets/fonts/`, declared with local `@font-face`; nothing under `library/` may
+  depend on a third-party font host or any other network fetch at render time.
+- **`SHA256SUMS` carries a pair of entries per item** — `<slug>/<slug>.source.html`
+  and `<slug>/<slug>.pdf` — one `<sha256>  <path>` line each (`sha256sum` output
+  format), updated in the same commit as the files they describe.
+
+## Checked, not rendered
+
+`scripts/check_library.py` verifies the *committed* pair — it never launches a
+browser and never re-renders to check its work. Concretely it checks: the checksum
+pair against the committed files, the PDF's page count and its `MediaBox` against
+the source's own `@page` rule, the no-gate patterns against the source, and the
+source's `<title>` against its own `<h1>`.
+
+**A source edited without re-rendering is caught as an ordinary checksum
+mismatch**, the same way a tampered PDF already was: `SHA256SUMS` is only ever
+updated by the render step, so an edit that skips it leaves the source's committed
+bytes disagreeing with the hash recorded for it.
+
+**Do not add a check that re-renders and diffs the two PDFs to verify a render is
+current.** It cannot work: a browser embeds a creation date in the PDF it writes,
+and rendered output shifts across Chrome milestones, so two renders of the same
+source are not byte-identical even seconds apart — the diff would fail on nothing,
+every time, and teach everyone to ignore it. This has already been tried once; it
+is written here so it is not tried again.

library/SHA256SUMS

@@ -0,0 +1,2 @@
+5cc0ad239a5c959a0a62ed060d16db3ba31314f6da3ced4c3fe3ac0183159c15  archimate-cheat-sheet/archimate-cheat-sheet.source.html
+5c2a78a82d03173d05e9095f784418a83faad4c992d0fb7437b3989d12e9956d  archimate-cheat-sheet/archimate-cheat-sheet.pdf