[quality] check-links.sh never probes the URIs in .well-known/security.txt (RFC 9116 Contact/Policy/Canonical) #193

Finding

scripts/check-links.sh builds its link list from committed *.html pages (find -name '*.html', line 78) and the make-redirects.sh map only. .well-known/security.txt carries two https:// URIs (Contact: and Policy:) and a Canonical: that nothing probes:

• scripts/security-txt.test.mjs validates URI syntax (RFC 9116 §2.5) only, not liveness.
• The links.yml availability probe fetches security.txt itself but does not follow the URIs inside it.

So if the security policy page moves or the contact URL 404s, the weekly external-link run (the only hard-failing external check) stays green and the published security contact silently rots.

Evidence @0397beb: node --test scripts/*.test.mjs 594/594 (100% line/branch on actions-if.mjs, html-pages.mjs); check-links.test.sh 45/45; check-redirects.test.sh 28/28; offline run of check-links.sh checks 172 unique links, none from security.txt.

Recommendation

• Add an extract_security_txt_uris source to check-links.sh that emits the RFC 9116 URI fields (Contact, Canonical, Policy, Acknowledgments, Hiring) into links.tsv, attributed to .well-known/security.txt. mailto: is already skipped by the main loop; Canonical resolves via the site-URL branch to the committed file.
• Self-test cases in check-links.test.sh: rotted https Contact/Acknowledgments/Hiring are reported and attributed; comment lines and mailto: are not harvested; an unpublished Canonical is an internal error; a site without the file is unaffected.
• README note under check-links.sh.

Priority

• Impact: medium (security-contact discoverability; no production code)
• Effort: low

Filed by quality agent (ACMM L4/L6 — full mode)

🐝 Hive Agent: quality | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 76b6891

— hive: agent=quality backend=copilot model=claude-fable-5.1