n-seo 0.4.1 → 0.6.0

package/CHANGELOG.md

@@ -8,6 +8,91 @@ uses [Semantic Versioning](https://semver.org/).
 
 Nothing yet.
 
+## [0.6.0] - 2026-09-15
+
+### Added
+- **Profiles carry principles.** Building the first real profile showed the
+  format was too thin. Measured against ten sites, one practitioner's method
+  was barely distinguishable from the engine's in *thresholds* — rows sort by
+  impressions before the cap, so the striking-distance floor never binds where
+  there is data, and lowering it would only have deleted the one marginal
+  site's two cards — and almost entirely distinguishable in *judgement*.
+  `principles` carries that: a title, a body, and a kind. `hard` is a
+  constraint an agent must not cross; `guide` is judgement it should apply.
+  They render at the top of the action queue and on Settings, and `n-seo init`
+  writes them into the instance's `CLAUDE.md`. A principle the agent never
+  reads is a note to yourself, not an operating rule.
+- **`rules.priorities` — custom rules, declaratively.** A threshold says what
+  counts as a finding; a priority says what you care about. Match on `host`,
+  `pathMatches`, `tag` or `kind`, then `multiply` the impact that orders the
+  queue, or `drop` the card. Several compound in the order written.
+- Two constraints the design will not bend on. **A priority may reorder or
+  hide, never invent** — it cannot create a card, so it cannot manufacture
+  evidence. And **every card it touches says so**, carrying the reason in its
+  spec and a *reweighted* chip; `why` is required and a priority without one
+  is ignored. Ordering you cannot see the reason for is ordering you cannot
+  argue with.
+- A priority with no conditions matches nothing, a bad regular expression
+  matches nothing rather than throwing, and a nonsense multiplier is ignored
+  rather than corrupting the sort.
+
+### Decided
+- **Profiles still may not ship executable code.** The obvious version of
+  custom rules is letting a profile carry a function. Installing someone's
+  method would then mean running their program on the machine holding your
+  Search Console credentials and your service-account key — a large amount of
+  trust for a list of thresholds. Matching and weighting turned out to cover
+  what people actually wanted to express. A genuinely new *kind* of card, one
+  reading data no existing rule reads, remains a fork and remains the open
+  question.
+
+### Fixed
+- `.chip` ellipsizes at 34ch and shrinks as a flex item, which rendered the
+  word "hard" as "h…" on every principle.
+
+## [0.5.0] - 2026-09-14
+
+The operating model was ours, hardcoded. Now it is a file you can install.
+
+### Added
+- **Profiles.** One config key — `"profile"` — swaps every threshold and
+  policy the engine uses for someone else's. Resolves a name shipped with the
+  engine, a path, or an installed package, in that order. Three ship:
+  `default` (the engine's own model, written out so you can read what a
+  profile controls), `patient` and `aggressive`.
+- **Three layers, and the instance always wins**: engine defaults, then the
+  profile, then this instance. That is the part that makes a profile usable
+  for client work — a client running their agency's method can always see,
+  and change, exactly where their setup departs from it. `n-seo profile`
+  prints that list; the Settings page shows it beside the profile's name.
+- **A profile that cannot be resolved fails the load**, naming every location
+  tried, rather than falling back to the defaults. Discovering months later
+  that a client's instance quietly stopped applying your method is worse than
+  an error on the morning you typed the name wrong. `doctor` reports it too.
+- **`rules` in config.** Every number the action engine ranks by — the
+  striking-distance band, the impression floors, the CTR ratio, the
+  engagement thresholds, the drop percentage, the effort weights — was a
+  literal in `src/actions.ts` and `src/data.ts`. Disagreeing with any of them
+  meant editing the engine and then living with the merge on every upgrade.
+- **`operatingRules` in config**: the freeze window, the weekly batch size,
+  the decision window, the history length. One place, so changing the freeze
+  changes it everywhere it is stated rather than in six that drift.
+- `docs/PROFILES.md`, and a section on the site for people who do this for a
+  living.
+
+### Decided
+- A profile is data and may not ship executable code. Installing someone's
+  method should not mean running their code on the machine that holds your
+  Search Console credentials. Custom rules — new kinds of card rather than new
+  numbers for existing ones — remain a fork, and the PRD carries the open
+  question.
+
+### Fixed
+- The TypeScript and Python loaders now resolve profiles identically, asserted
+  by a test that runs both against every shipped profile. A dashboard saying
+  the freeze is 28 days while the daily log says 56 would be worse than either
+  number being wrong.
+
 ## [0.4.1] - 2026-09-13
 
 ### Added
@@ -401,7 +486,9 @@ First public release.
   `n-seo upgrade` gate — without changing the reported test counts, and an
   in-place install ran those assertions against the owner's live data.
 
-[Unreleased]: https://github.com/en-dash-consulting/n-seo/compare/v0.4.1...HEAD
+[Unreleased]: https://github.com/en-dash-consulting/n-seo/compare/v0.6.0...HEAD
+[0.6.0]: https://github.com/en-dash-consulting/n-seo/compare/v0.5.0...v0.6.0
+[0.5.0]: https://github.com/en-dash-consulting/n-seo/compare/v0.4.1...v0.5.0
 [0.4.1]: https://github.com/en-dash-consulting/n-seo/compare/v0.4.0...v0.4.1
 [0.4.0]: https://github.com/en-dash-consulting/n-seo/compare/v0.3.3...v0.4.0
 [0.3.3]: https://github.com/en-dash-consulting/n-seo/compare/v0.3.2...v0.3.3

package/README.md

@@ -8,7 +8,7 @@
 
 An agentic, local-first control plane for growing organic traffic to your own
 sites — classic search (SEO), answer engines (AEO) and AI assistants that cite
-sources (GEO) — without paying an agency to read Search Console for you.
+sources (GEO). Your sites, your data, your call.
 
 It pulls Search Console and GA4 into local JSON, probes your live sites for the
 things that quietly break (robots, sitemap, soft 404s, blocked AI crawlers,

package/bin/n-seo.mjs

@@ -41,6 +41,7 @@ usage: n-seo <command> [--instance <dir>] [args...]
   check           engine self-test: typecheck + unit tests
   upgrade         update the engine in place, whatever way it was installed;
                   --check reports what is available without changing anything
+  profile         the active profile, and every value this instance overrides
   version         engine version, commit, paths, mode
   help            this text
 
@@ -143,6 +144,41 @@ function missingDeps(cmd, what) {
   return 1;
 }
 
+/** A profile's principles, as markdown for the instance CLAUDE.md.
+ *
+ *  The whole point of writing a method down is that the agent follows it too.
+ *  A principle that lives only in the dashboard is a principle the thing
+ *  doing the work never reads. */
+function profilePrinciples(dir) {
+  const cfgPath = path.join(dir, "n-seo.config.json");
+  let spec;
+  try {
+    spec = JSON.parse(fs.readFileSync(cfgPath, "utf8")).profile;
+  } catch { return ""; }
+  if (!spec) return "";
+
+  const candidates = [
+    path.join(ROOT, "profiles", spec),
+    path.isAbsolute(spec) ? spec : path.resolve(dir, spec),
+    path.join(dir, "node_modules", spec),
+    path.join(ROOT, "node_modules", spec),
+  ];
+  const found = candidates.find((c) => fs.existsSync(path.join(c, "n-seo.profile.json")));
+  if (!found) return "";
+
+  let profile;
+  try {
+    profile = JSON.parse(fs.readFileSync(path.join(found, "n-seo.profile.json"), "utf8"));
+  } catch { return ""; }
+  const list = (profile.principles ?? []).filter((p) => p?.title && p?.body);
+  if (!list.length) return "";
+
+  const lines = list.map((p) => `- **${p.title}**${p.kind === "hard" ? " (hard rule)" : ""}\n  ${p.body}`);
+  return `\n## From the ${profile.name} profile\n\n` +
+    `These came with the profile this instance runs. Hard rules are constraints, not advice.\n\n` +
+    lines.join("\n") + "\n";
+}
+
 /* ---------- init ---------- */
 
 /** Files that mean "this directory is an application", not a place to keep
@@ -303,7 +339,7 @@ Skills in \`.claude/skills/\` cover the routine work — start with
   /actions until a human accepts them.
 - **Site changes ship as branches and pull requests** in the site's own repo,
   never committed straight to its main branch.
-`);
+${profilePrinciples(dir)}`);
 
   const envExample = path.join(ROOT, ".env.example");
   put(".env", fs.existsSync(envExample) ? fs.readFileSync(envExample, "utf8") : "");
@@ -548,6 +584,7 @@ switch (cmd) {
   case "init":
     code = init(rest.find((a) => !a.startsWith("-")) ?? flag ?? process.cwd(), rest.includes("--force"));
     break;
+  case "profile":
   case "start":
   case "dev":
   case "mcp": {
@@ -558,7 +595,9 @@ switch (cmd) {
       code = missingDeps(cmd, "the engine's dependencies");
       break;
     }
-    const entry = cmd === "mcp" ? "src/mcp-stdio.ts" : "src/server.tsx";
+    const entry = cmd === "mcp" ? "src/mcp-stdio.ts"
+      : cmd === "profile" ? "src/profile-cli.ts"
+      : "src/server.tsx";
     const args = cmd === "dev" ? ["watch", entry] : [entry];
     code = run(process.execPath, [bin, ...args, ...rest], instance);
     break;

package/docs/PRD.md

@@ -10,16 +10,19 @@ check. Status markers: **[shipped]**, **[planned]**, **[idea]**.
 
 n-seo is a local-first control plane for organic growth across one or more
 websites: classic search (SEO), answer engines (AEO) and generative engines
-that cite sources (GEO). It replaces the monthly agency read-out with a loop
+that cite sources (GEO). It replaces the monthly read-out with a loop
 that runs every morning on the owner's machine: pull Search Console and GA4,
 probe the live sites, turn the data into a ranked queue of concrete actions
 with evidence attached, and measure yesterday's changes.
 
 ## Users
 
-- **A site owner or small team** who wants to hone their own SEO practice
-  without paying an agency: developers, indie makers, consultancies, small
-  businesses with a technical person.
+- **A site owner or small team** who wants to run their own search practice
+  and understand it: developers, indie makers, consultancies, small businesses
+  with a technical person. Note that agencies and consultancies are users
+  here, not the thing being displaced — the copy should never imply otherwise,
+  and the tool is as useful to someone doing this for clients as for
+  themselves.
 - **An operator running several sites** (a portfolio, an agency serving its
   own clients) who needs one queue across all of them.
 - **An AI agent** (Claude Code, Claude Desktop, any MCP client) acting for
@@ -136,14 +139,43 @@ a fresh checkout runs.
 - Acceptance: `config/backlog.json` is merged and hot-reloaded without a
   restart, and a syntax error keeps the last good queue.
 
-## Feature: Rule thresholds in config [planned]
-
-Move the numeric thresholds (min impressions, position band, engagement
-floor, drop percentage, effort weights) into an optional `rules` block of
-the config with the current values as defaults.
-
-- Acceptance: every threshold has a documented default and a config
-  override; tests cover an override changing a rule's output.
+## Feature: Profiles — a method you can install [shipped]
+
+n-seo ships one operating model; a practitioner has their own. A **profile**
+packages thresholds, policy numbers and module defaults so a method can be
+published once and installed many times. Full reference: `docs/PROFILES.md`.
+
+- Acceptance: `"profile": "<built-in | path | package>"` resolves in that
+  order, and every value remains overridable by the instance.
+- Acceptance: a profile that cannot be resolved fails the load with a message
+  naming each location tried, rather than falling back to the defaults.
+- Acceptance: `n-seo profile` prints the active profile and every value this
+  instance overrides; the Settings page shows the same, and `doctor` reports
+  an unresolvable profile before the daily run reaches it.
+- Acceptance: the TypeScript and Python loaders resolve every shipped profile
+  to identical numbers, asserted by a test that runs both.
+- Acceptance: `default`, `patient` and `aggressive` ship with the engine, and
+  `default` restates the engine defaults exactly — asserted, so the two cannot
+  drift.
+- Acceptance: `rules.priorities` reweights or drops queue cards by host,
+  path, tag or kind; a matched card carries the reason in its spec and a
+  *reweighted* chip; a priority with no `why` or no conditions is ignored; a
+  bad regex or a nonsense multiplier is ignored rather than throwing or
+  corrupting the sort.
+- Acceptance: a priority can never create a card. Everything in the queue
+  still came from data.
+- Decided: a profile is data only and may not ship executable code. Installing
+  a method should not mean running its author's code on the machine holding
+  your Search Console credentials. `priorities` covers reordering and hiding
+  declaratively, which is what practitioners actually asked to express. A
+  genuinely new *kind* of card — one reading data no existing rule reads —
+  remains a fork, and is the open question.
+
+## Feature: Rule thresholds in config [shipped]
+
+- Acceptance: every threshold the action engine ranks by lives in `rules`,
+  with the engine defaults documented in `src/config.ts` and mirrored in
+  `ingest/seo_config.py`; tests cover an override changing a rule's output.
 
 # Epic: Dashboard [shipped]
 

package/docs/PROFILES.md

@@ -0,0 +1,220 @@
+# Profiles — a method you can install
+
+n-seo ships with an opinionated model: a 28-day freeze after any metadata
+change, roughly eight of those a week, striking distance meaning positions
+5–15, decisions on the trailing 90 days. Those numbers are a position, not a
+law, and if you do this for a living yours are probably different.
+
+A **profile** is that position, packaged. One config key, and every threshold
+and policy the engine uses comes from your profile instead of ours.
+
+```jsonc
+{
+  "profile": "patient",
+  "sites": [ ... ]
+}
+```
+
+## The three layers
+
+```
+engine defaults          what n-seo believes, in src/config.ts
+   ↓  overridden by
+the profile              what you or your agency believes
+   ↓  overridden by
+this instance            what this one client needs
+```
+
+The instance always wins. That matters more than it sounds: a client running
+their agency's profile can always see, and change, exactly where their setup
+departs from it. `n-seo profile` prints that list, and the Settings page shows
+it beside the profile's name.
+
+```
+$ n-seo profile
+profile   Patient 1.0.0
+spec      patient
+from      /opt/n-seo/profiles/patient
+
+this instance overrides 2 value(s):
+
+  operatingRules.titleFreezeDays  56 → 30
+  rules.strikingDistance.maxRows  6 → 9
+```
+
+## What a profile can set
+
+`n-seo.profile.json`, at the root of a directory or a package:
+
+```jsonc
+{
+  "name": "Acme Search",
+  "description": "How we run search for retail clients.",
+  "version": "1.2.0",
+
+  // The policy a human follows.
+  "operatingRules": {
+    "titleFreezeDays": 28,          // hands off a page's metadata this long
+    "metadataChangesPerWeek": 8,    // batch size across the portfolio
+    "decisionWindowDays": 90,       // decisions ride this window
+    "historyMonths": 16             // the long view, for totals only
+  },
+
+  // The numbers the action engine ranks by.
+  "rules": {
+    "effortWeight":      { "S": 1, "M": 2.5, "L": 5 },
+    "strikingDistance":  { "minPosition": 5, "maxPosition": 15, "minImpressions": 10,
+                           "maxRows": 12, "impactPerImpression": 0.06 },
+    "ctrGap":            { "minImpressions": 30, "belowExpectedRatio": 0.5 },
+    "engagement":        { "minSessions": 30, "maxEngagement": 0.25, "maxCards": 3 },
+    "trafficDrop":       { "minPriorSessions": 50, "dropRatio": 0.75 },
+    "probe":             { "minVisibleTextBytes": 500 },
+    "metadata":          { "maxFindings": 5 }
+  },
+
+  // Module defaults. The instance can still switch any of them.
+  "modules": {
+    "indexNow": { "enabled": true }
+  },
+
+  // The parts of a method that are not a number.
+  "principles": [
+    {
+      "kind": "hard",
+      "title": "Never write to a CMS without per-item approval",
+      "body": "Show the exact before and after, get a yes on each one, then write."
+    },
+    { "title": "Judge by the path to a signup, not by clicks", "body": "..." }
+  ]
+}
+```
+
+### Principles
+
+The most useful thing we learned building the first real profile: a
+practitioner's method is barely distinguishable from ours in *thresholds* and
+almost entirely distinguishable in *judgement*. The striking-distance floor
+turned out never to bind once rows are sorted by impressions. What actually
+differed was what to optimise for, what needs a human's approval, and what to
+never automate.
+
+None of that is a number, so `principles` carries it. Each has a `title`, a
+`body`, and a `kind`:
+
+- **`hard`** — a constraint. An agent must not cross it.
+- **`guide`** — judgement it should apply.
+
+They appear at the top of the action queue, on the Settings page, and — this
+is the part that matters — `n-seo init` writes them into the instance's
+`CLAUDE.md`. A principle the agent never reads is not an operating rule, it is
+a note to yourself.
+
+Set only what you disagree with. Anything absent is inherited, so a profile
+that changes one threshold is three lines long.
+
+## Shipped with the engine
+
+| spec | what it is for |
+|---|---|
+| `default` | The engine's own model, written out so you can read what a profile controls. |
+| `patient` | Low traffic, long sales cycle, or an owner who would rather ship three good changes a month than thirty. Longer freeze, smaller batches, a higher bar before anything is called a problem. |
+| `aggressive` | A large site with traffic to spare, where missing an opportunity costs more than a wasted afternoon. Wider band, lower floors, longer queue. Keeps the 28-day freeze — that one is not a preference. |
+
+`n-seo profile` lists them.
+
+## Writing your own
+
+A profile is a directory with an `n-seo.profile.json` in it. Three ways to
+point at one:
+
+```jsonc
+"profile": "patient"                  // shipped with the engine
+"profile": "./profiles/acme"          // a path, relative to the instance
+"profile": "n-seo-profile-acme"       // an installed package
+```
+
+To publish one, make it a package whose root holds the file:
+
+```
+n-seo-profile-acme/
+├── package.json
+└── n-seo.profile.json
+```
+
+Then `npm i n-seo-profile-acme` in the instance and name it in the config.
+Versioning the package versions the method, which is the point: "we moved you
+to Acme Search 2.0" is a sentence a client can check.
+
+## Priorities — the declarative half of custom rules
+
+A threshold says *what counts as a finding*. A priority says *what you care
+about*. They are different questions, and the second one is where a method
+usually lives.
+
+```jsonc
+"rules": {
+  "priorities": [
+    {
+      "why": "leads somewhere: a signup, a tool, an account",
+      "when": { "pathMatches": "^/(tools|pricing|signup)" },
+      "multiply": 1.5
+    },
+    {
+      "why": "we have decided not to work on these",
+      "when": { "pathMatches": "^/legal/" },
+      "drop": true
+    }
+  ]
+}
+```
+
+`when` matches on `host`, `pathMatches` (a regular expression against the
+page's path), `tag`, and `kind`. A priority with no conditions matches
+nothing — applying to the whole queue is never what anyone means, and is a
+miserable way to learn the shape of the config.
+
+`multiply` scales the impact that orders the queue. `drop` removes the card.
+Several priorities compound, in the order they are written.
+
+### Two rules the design will not bend on
+
+**A priority may reorder or hide, never invent.** It cannot create a card, so
+it cannot manufacture evidence. Everything in the queue still came from data.
+
+**Every card it touches says so.** The impact number decides the order, so a
+card whose number was adjusted carries the reason on its face and a
+*reweighted* chip. `why` is required; a priority without one is ignored.
+Ordering you cannot see the reason for is ordering you cannot argue with, and
+the whole product rests on showing its working.
+
+### Why this is not a plugin API
+
+The obvious version of "custom rules" is letting a profile ship code. We are
+not doing that, and the reason is not squeamishness about JavaScript:
+installing someone's method would mean running their program on the machine
+that holds your Search Console credentials and your service-account key. That
+is a large amount of trust to ask for a list of thresholds.
+
+Matching and weighting turned out to cover what people actually want to
+express. A genuinely new *kind* of card — one that reads data no existing rule
+reads — is still a fork, and `docs/PRD.md` carries that as an open question
+rather than a decided one.
+
+## When a profile cannot be found
+
+The run fails, loudly, naming every location that was tried. It does **not**
+fall back to the engine defaults. Someone running a client's portfolio on
+their agency's method should never discover it quietly stopped applying —
+a wrong answer you can see beats a plausible one you cannot.
+
+`n-seo doctor` reports the same thing before the daily run gets there.
+
+## What a profile cannot do
+
+It cannot ship executable code. A profile is data: thresholds, policy numbers
+and module defaults. Installing someone's method should not mean running
+their code on the machine that holds your Search Console credentials.
+
+Custom *rules* — new kinds of card, not new numbers for existing ones — are a
+real gap, and the honest answer today is to fork the engine. `docs/PRD.md`
+carries the open question.

package/ingest/seo_config.py

@@ -57,6 +57,70 @@ MODULE_DEFAULTS = {
                 "delete": False, "dryRun": False, "env": {}},
 }
 
+PROFILE_FILE = "n-seo.profile.json"
+
+# Mirrors DEFAULT_RULES / DEFAULT_OPERATING_RULES in src/config.ts. The
+# TypeScript side is where the action engine reads them; Python needs them so
+# the daily log, the digests and doctor state the same numbers the dashboard
+# does, rather than a second set that drifts.
+DEFAULT_RULES = {
+    "effortWeight": {"S": 1, "M": 2.5, "L": 5},
+    "strikingDistance": {"minPosition": 5, "maxPosition": 15, "minImpressions": 10,
+                         "maxRows": 12, "impactPerImpression": 0.06},
+    "ctrGap": {"minImpressions": 30, "belowExpectedRatio": 0.5},
+    "engagement": {"minSessions": 30, "maxEngagement": 0.25, "maxCards": 3},
+    "trafficDrop": {"minPriorSessions": 50, "dropRatio": 0.75},
+    "probe": {"minVisibleTextBytes": 500},
+    "metadata": {"maxFindings": 5},
+    # Ordering adjustments. Applied by the TypeScript action engine; mirrored
+    # here so the two loaders resolve identical config, which a test asserts.
+    "priorities": [],
+}
+
+DEFAULT_OPERATING_RULES = {
+    "titleFreezeDays": 28,
+    "metadataChangesPerWeek": 8,
+    "decisionWindowDays": 90,
+    "historyMonths": 16,
+}
+
+
+def profile_dir(spec):
+    """Where a profile spec resolves to, or None. Mirrors resolveProfileDir."""
+    if not spec:
+        return None
+    if "/" not in spec and "\\" not in spec:
+        built = ROOT / "profiles" / spec
+        if (built / PROFILE_FILE).exists():
+            return built
+    as_path = Path(spec) if Path(spec).is_absolute() else (INSTANCE / spec)
+    if (as_path / PROFILE_FILE).exists():
+        return as_path.resolve()
+    # An installed package, without importing node: node_modules beside the
+    # instance, then beside the engine.
+    for base in (INSTANCE, ROOT):
+        cand = base / "node_modules" / spec
+        if (cand / PROFILE_FILE).exists():
+            return cand.resolve()
+    return None
+
+
+def _merge(base, over):
+    """Deep merge; `over` wins, None never overwrites, and lists replace.
+
+    Lists replace rather than concatenate so an instance that sets
+    `priorities` replaces the profile's outright. Appending would make a
+    profile's priority impossible to remove without forking the profile.
+    """
+    out = dict(base)
+    for k, v in (over or {}).items():
+        if v is None:
+            continue
+        cur = out.get(k)
+        out[k] = _merge(cur, v) if isinstance(cur, dict) and isinstance(v, dict) else v
+    return out
+
+
 _cache = None
 
 
@@ -73,9 +137,22 @@ def load(force: bool = False) -> dict:
         return _cache
     path = CONFIG_PATH if CONFIG_PATH.exists() else EXAMPLE_PATH
     raw = json.loads(path.read_text(encoding="utf-8"))
-    modules = {k: {"enabled": False, **MODULE_DEFAULTS.get(k, {})} for k in MODULE_KEYS}
-    for k, v in (raw.get("modules") or {}).items():
-        modules[k] = {"enabled": False, **MODULE_DEFAULTS.get(k, {}), **(v or {})}
+    # engine defaults <- profile <- this instance, for modules and both rule
+    # blocks. The instance always wins.
+    prof = {}
+    pdir = profile_dir(raw.get("profile"))
+    if pdir:
+        try:
+            prof = json.loads((pdir / PROFILE_FILE).read_text(encoding="utf-8"))
+        except (OSError, ValueError):
+            prof = {}
+
+    pmods = prof.get("modules") or {}
+    modules = {k: {"enabled": False, **MODULE_DEFAULTS.get(k, {}), **(pmods.get(k) or {})}
+               for k in MODULE_KEYS}
+    for k, v in {**pmods, **(raw.get("modules") or {})}.items():
+        modules[k] = {"enabled": False, **MODULE_DEFAULTS.get(k, {}),
+                      **(pmods.get(k) or {}), **((raw.get("modules") or {}).get(k) or {})}
     sites = []
     for s in raw.get("sites") or []:
         if not s.get("host"):
@@ -109,6 +186,10 @@ def load(force: bool = False) -> dict:
         "conversions": conv if conv.get("site") else None,
         "participation": raw.get("participation") or {},
         "modules": modules,
+        "profile": raw.get("profile"),
+        "rules": _merge(_merge(DEFAULT_RULES, prof.get("rules")), raw.get("rules")),
+        "operatingRules": _merge(_merge(DEFAULT_OPERATING_RULES, prof.get("operatingRules")),
+                                 raw.get("operatingRules")),
         "gscExtraProperties": str_list(raw.get("gscExtraProperties")),
         "hooks": hooks,
     }

package/n-seo.config.example.json

@@ -1,5 +1,6 @@
 {
   "name": "My sites",
+  "_profile": "Optional. A method to inherit: a name shipped with the engine (default, patient, aggressive), a path, or an installed package. Anything you set below still wins. See docs/PROFILES.md.",
   "port": 4600,
   "google": {
     "auth": "service-account-key",

package/ops/doctor.py

@@ -55,6 +55,30 @@ def check_engine():
         report("OK", "update check has not run yet", "it runs with the daily run")
 
 
+def check_profile(cfg):
+    """A profile that cannot be resolved must be loud.
+
+    Someone running a client's portfolio on their agency's method should never
+    discover it quietly stopped applying and the engine defaults took over.
+    """
+    spec = cfg.get("profile")
+    if not spec:
+        return
+    print("profile")
+    d = seo_config.profile_dir(spec)
+    if not d:
+        report("FAIL", f"profile {spec!r} not found",
+               "install it, fix the path, or remove \"profile\" from the config")
+        return
+    try:
+        meta = json.loads((d / "n-seo.profile.json").read_text(encoding="utf-8"))
+    except (OSError, ValueError) as exc:
+        report("FAIL", f"profile {spec!r} is unreadable", str(exc)[:120])
+        return
+    report("OK", f"{meta.get('name', spec)}" + (f" {meta['version']}" if meta.get("version") else ""))
+    report("OK", f"from {d}")
+
+
 def check_config():
     print("config")
     if seo_config.using_example():
@@ -309,6 +333,8 @@ def check_modules(cfg):
 def main():
     check_engine()
     cfg = check_config()
+    if cfg is not None:
+        check_profile(cfg)
     check_tools()
     if cfg is None:
         return 1