feat(seo-hermit): new SEO/site-health domain plugin (PROP-014)

[gtapps]

Summary

New domain plugin seo-hermit (PROP-014): a weekly-cadence watcher over Google Search Console, broken links, and Core Web Vitals, whose defensible slice is the judgment layer — correlating a regression with a specific site-repo commit and drafting the mechanical fix. Read-only toward Google; write-only toward the operator's own repo, behind an approval gate.

This overrides the domain-hermit freeze at explicit operator request (recorded in the proposal and commit). Scoped to the smallest honest version so the downside of the override is bounded.

Changes

• Scaffold — manifest triad (plugin.json / hermit-meta.json / root marketplace.json), CLAUDE.md, README.md, docs/knowledge-schema.md, settings.json, CLAUDE-APPEND.md, MIT LICENSE, .gitignore, and .github/workflows/test-seo.yml (Bun-only CI, cloned from test-fitness.yml). Requires core claude-code-hermit ≥1.2.14.
• scripts/site-api.ts — zero-dependency Bun client (stdlib + node:crypto only). Service-account JWT-bearer auth; subcommands check / search-analytics / sitemap / link-check / psi / inspect / ledger. Credentials are read from .env, never argv, never printed.
• skills/hatch — 9-step idempotent setup: live GSC verification round-trip, .env collected via the Read tool only (never the service-account JSON — it holds a private key), CLAUDE-APPEND inject, weekly-routine registration.
• skills/site-health-check — weekly routine: pull Search Console deltas, link-check the sitemap, sample CWV, inspect a rotating budget of URLs, diff against state/site-health-ledger.json, report only what changed. A quiet week is one line.
• skills/site-regression-triage (read-only commit correlation) and skills/site-draft-fix (approval-gated, closed fix list, never pushes, never touches a protected branch).
• Tests — 37 unit tests (site-api + ledger) and 28 skill-structure checks.

Deliberate corrections vs the proposal

• The Search Console API has no bulk Index Coverage endpoint — replaced with budgeted per-URL urlInspection (rotated via a ledger cursor, ~2,000/day/property quota).
• The rolling ledger lives in state/ (not compiled/, which auto-archives).
• The weekly routine invokes the skill directly (core weekly-review pattern), not a drop-once prompt_file.

Test plan

• cd plugins/seo-hermit && bash tests/run-all.sh → 37 unit + 28 structure checks pass.
• bunx tsc from repo root → clean (strict).
• plugin-validator → 12/12; native claude plugin validate . passes.
• Ledger diff engine verified end-to-end through the real CLI: baseline run → −20% search-regression detection on the next run → broken-link lifecycle → inspect-cursor advance.

Notes

• Single-domain per install by design (one SEO_HERMIT_SITE_URL / sitemap / ledger), matching the one-hermit-per-product model. A "several sites you own" variant (a sites array keyed ledgers) is a possible follow-up; multi-tenant is explicitly out of scope.
• Deferred (not a blocker): the ledger's index map never prunes URLs that drop out of the sitemap — a minor leak on high-churn sites that needs a behavior change (plumbing the sitemap set into diffLedger), so it was left out of the cleanup pass.
• Version stays 0.0.1; this does not ship to operators until /release seo-hermit.