Cortazar Labs · @july/web · Phase 2 baseline

Next.js scaffold + strict nonce-CSP, ready for Phase 3 ports.

This route is a Server Component rendered without any client-side JavaScript beyond Next.js' hydration runtime. The production app lives at cortazar.orguntil Phase 5 cutover.

• · nonce-based CSP on every response (no unsafe-eval)
• · OWASP header set via next.config.ts
• · Tailwind v4 + shadcn/ui shared from @july/ui
• · Cache Components + RSC default