Public and Private Surface Split
A site can have public SEO pages, noindex client previews, owner dashboards, and scoped guest links. Those surfaces need different rules.
When this matters
This page is for operators who want Rocky to produce usable work without turning the system into a mystery box. Use it when you need a practical path, a clear verification step, and a boundary between suggestion and action.
The operating pattern
- Classify each route. Public indexable, public noindex, private owner, scoped guest, API, or asset.
- Set robots deliberately. Index useful public content; noindex private previews and error pages.
- Test anonymous access. A logged-out user should not see private navigation or data.
- Block direct assets when gated. Downloads behind lead capture should not be accessible by guessing the path.
- Verify live headers. Check status, cache, and X-Robots-Tag on the real domain.
Pre-flight checklist
- Route class is clear
- Sitemap contains only intended pages
- Private routes return 404/noindex anonymously
- Gated assets cannot be bypassed
- Public pages avoid private datastore loads
Common failure modes
- Preview drift: Noindex previews can accidentally become linked from public nav.
- Asset bypass: Direct PDF/image URLs can leak gated material.
- Sitemap mistakes: Search engines follow what you publish, not what you meant.
Verification
A page is not done because it was drafted. Verify the source, run the workflow, inspect the output, and record what changed. If a step touches money, customers, accounts, permissions, or private data, keep it behind an explicit human approval gate.