<?xml version="1.0" encoding="UTF-8"?>
<!--
  Obligt (obligt.com) — kept deliberately honest (ADR-0055,
  docs/design/redesign-2026/waves/w12-adr-0055-draft.md).

  The public, indexable marketing surface is four routes: the landing page, /privacy, /terms and
  /support (src/lib/seoRoutes.ts is the registry; src/seo.test.ts fails if this file drifts from it).
  The landing page is ONE route: "/" (frontend/src/routes/LandingPage.tsx), a single-page scroller
  whose in-page sections (#product, #evidence, #pricing, #faq, #vault, #integrations, #calendar)
  are anchors within that one document, not separate crawlable pages — search engines dedupe on the
  path and ignore the fragment, so listing them as distinct <url> entries would not add coverage,
  only padding. /signup is public but noindex and is therefore not listed. Every other route
  (frontend/src/App.tsx) is an authenticated surface excluded via robots.txt: /login, /mfa/*,
  /invite/:token, /app/*, /portal/*, /platform, /auth/action, /integrations/callback/*.

  lastmod is the date the page's content last materially changed, maintained by hand (there is no
  build timestamp to trust): /privacy and /terms must equal the LAST_UPDATED constant of their
  content module (seo.test.ts enforces it); change the others when the page's content changes.
  changefreq and priority are omitted — Google ignores both.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://obligt.com/</loc>
    <lastmod>2026-10-30</lastmod>
  </url>
  <url>
    <loc>https://obligt.com/privacy</loc>
    <lastmod>2026-10-08</lastmod>
  </url>
  <url>
    <loc>https://obligt.com/terms</loc>
    <lastmod>2026-10-08</lastmod>
  </url>
  <url>
    <loc>https://obligt.com/support</loc>
    <lastmod>2026-10-09</lastmod>
  </url>
</urlset>
