Manually re-check EU Commission links ignored by link checks #102

Context

PR #101 adds `digital-strategy.ec.europa.eu` to `.lycheeignore`. The EU Commission pages return 403 to scripted requests, which failed the deploy link check. Both pages are cited in `content/claude-synthid-text-watermark-attack-surface.md` (lines 248-249):

• Code of Practice on Transparency of AI-generated Content: https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content
• Guidelines on transparency obligations for providers and deployers of certain AI systems: https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations

Gap

Once ignored, neither the deploy check nor the weekly `link-rot.yml` job checks this host. A removed or moved page won't be caught automatically.

To do

• When the post is next edited, open both links in a browser and confirm they still resolve.
• Check again when the Commission publishes a new version of either document, and update the citation if the URL changes.
• Optional: a separate check for these two URLs that runs from a browser-like client, if the 403 ever stops blocking.

Note

Archived copies exist on the Wayback Machine (2026-10-20 and 2026-10-18), but they freeze the content at that date, so the live links stay as the citations.

Details

Where the links are

• content/claude-synthid-text-watermark-attack-surface.md, lines 248 and 249 (the two references in the sources list). Built to output/claude-synthid-text-watermark-attack-surface.html at lines 372 and 373.
• Inbound links to that post (not affected by the 403, listed so the scope is clear): content/devsecops-guide.md line 49 and content/prompt-injection-supply-chain-evasion.md line 101.

What failed and when

• Deploy run 39709128911 (build-and-deploy, "Check links in built site"): lychee reported [403] for both URLs, exit code 2. Summary: 6199 total, 2 errors, 2 unsupported.
• Re-run on PR Publish: secure-iam-lint v1.2.0: Catching Guardrails That Never Fire #100 (run 39712123382 for the same branch, after merging main): see the PR for the result.
• Direct checks from the gentoo host on 2026-10-21 with a browser-like user agent: both URLs return 403.
• Other Commission pages (library, news, FAQ, opinion) also return 403 to the same client, so swapping to a sibling page on the same host does not help.

Why it's a bot block, not a dead link

• The 403 comes from the host, not from a 404. The same URLs are cited in the sources list of the post and both were published on the Commission site (the Code of Practice page quotes "10 June 2026" for the final text; the guidelines page quotes "6 August 2026").

Fallbacks if the host blocks browsers too

• Wayback snapshots, verified 200 with the correct page titles on 2026-10-21:
  • Code of Practice: https://web.archive.org/web/20261020083634/https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content
  • Guidelines: https://web.archive.org/web/20261018070643/https://digital-strategy.ec.europa.eu/en/policies/guidelines-ai-transparency-obligations
• web.archive.org is already on the ignore list in .lycheeignore, so these would also be unchecked. Snapshots freeze the content at the capture date, so keep the live URLs as citations and use the archive only if the live pages disappear.

Re-check plan

• Next edit to the SynthID post: open both live URLs in a browser and note the result here.
• If a Commission URL moves (404 or redirect), update the post and remove the ignore entry only if the new URL is also bot-blocked.