Cortazar Labs · @july/web · Phase 2 baseline
Next.js scaffold + strict nonce-CSP, ready for Phase 3 ports.
This route is a Server Component rendered without any client-side JavaScript beyond Next.js' hydration runtime. The production app lives at cortazar.orguntil Phase 5 cutover.
- · nonce-based CSP on every response (no
unsafe-eval) - · OWASP header set via
next.config.ts - · Tailwind v4 + shadcn/ui shared from
@july/ui - · Cache Components + RSC default