Add Atlas canonical metadata

CHANGELOG.md

@@ -114,6 +114,9 @@ All notable changes to this project will be documented in this file.
 - Showed four Field Notes on the homepage (one featured plus three) so a new post no longer pushes an entry off the page.
 
 ### Fixed
+- Added the missing canonical and Open Graph URLs to the Real World Reasoning
+  Agent page so production metadata verification recognizes
+  `https://ryanbaumann.dev/real-world-reasoning-agent/` as its sole owner.
 - Restored the Strava 3D Explorer, which stopped loading rides after the Content-Security-Policy shipped. Only the OAuth exchange and the photo proxy are same-origin `/api/strava/*` calls; the demo reads activities, activity detail, streams, and photo metadata straight from `https://www.strava.com/api/v3` in the browser, and the Maps allowlist has no Strava origin in `connect-src`, so every read was blocked and the app showed "Failed to fetch activities". The demo now gets its own policy, `"csp": "maps-strava"` in apps.json: the Maps policy plus the Strava API origin in `connect-src` and the two image hosts it loads without the proxy (the athlete avatar, and the placeholder photos in the signed-out demo tour) in `img-src`. The other Maps demos and the portfolio are unchanged and carry no Strava origin. Policies are now composed from directive maps instead of copy-pasted strings, so a per-app relaxation can only widen a directive the base policy already declares.
 
 ### Removed

LEARNINGS.md

@@ -418,6 +418,22 @@ Evidence: Social cards were regenerated with `ryanbaumann.dev`; Lab metadata now
 Use next time: Treat a domain move as a dependency inventory, not a string replacement. Check generated text in images, absolute asset URLs, deployment health targets, OAuth origins, email senders, analytics, API referrers, and search ownership before changing DNS.
 
 
+## 2026-07-27 - Production smoke must reach metadata gates after config gates
+
+Context: Two deploys built and routed healthy Cloud Run revisions but stopped
+at the runtime-variable check because `GEMINI_API_KEY` was not attached. Once
+the existing secret was attached, the next production smoke exposed a missing
+canonical URL on the newly imported Real World Reasoning page.
+Learning: Runtime configuration and rendered metadata are separate deployment
+boundaries. Clear configuration blockers before calling a release verified,
+then run the complete production smoke against the service URL so later gates
+are not hidden behind an earlier failure.
+Evidence: Cloud Run revision `fieldwork-00099-c2z` serves with
+`GEMINI_API_KEY` attached, and `demos/real-world-reasoning-agent/index.html`
+now owns one canonical and matching Open Graph URL.
+Use next time: For a new hosted demo, verify required runtime variable names
+before the paid build and verify its canonical URL in built HTML before merge.
+
 ## 2026-07-27 - Compile the deployable graph once per CI event
 
 Context: Pull-request CI built each app in its package job, rebuilt every app

demos/real-world-reasoning-agent/index.html

@@ -8,8 +8,10 @@
       name="description"
       content="Watch an agent perceive the real world, reason over live signals, and act — planning days, dispatching fleets, scoring sites, filming cities, shipping campaigns. Built on Gemini + Google Maps Platform. Fork it."
     />
+    <link rel="canonical" href="https://ryanbaumann.dev/real-world-reasoning-agent/" />
     <link rel="icon" href="data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'%3E%3Ccircle cx='16' cy='16' r='14' fill='%230b1220'/%3E%3Ccircle cx='16' cy='13' r='5' fill='none' stroke='%234da3ff' stroke-width='2.5'/%3E%3Cpath d='M16 18v8' stroke='%234da3ff' stroke-width='2.5' stroke-linecap='round'/%3E%3C/svg%3E" />
     <meta property="og:type" content="website" />
+    <meta property="og:url" content="https://ryanbaumann.dev/real-world-reasoning-agent/" />
     <meta property="og:title" content="Atlas — A Real-World Reasoning Agent on Google Maps" />
     <meta
       property="og:description"