Four groups · mechanically checked · attached to every manifest
The rules this site holds itself to, and ships with your build.
A missing item is a build failure rather than a to-do. Anything that can be checked by a machine is checked by one, and everything that cannot is named as such at the bottom.
A
Craft
The things a visitor feels. A 404 in the site's own voice, a call to action above the fold, no orphan pages, breadcrumbs that emit their own schema, three case studies each carrying a real number, five questions answered plainly, a stated reply time, a dismissible mobile prompt, and an interactive scrolling experience built around this site's own subject rather than a generic parallax.
The patch panel on the homepage is this site's version of that last one — it wires itself as you scroll, because what is and is not connected is the entire subject.
B
Discoverability
A unique title and a 50-160 character description for every route, an Open Graph image with real alt text, a generated robots.txt, a sitemap derived from the route config so new pages appear automatically, alt text on every image, and structured data that matches what the thing actually is.
All of it comes out of one file. Titles, descriptions, the sitemap, robots.txt and the canonical tags read from src/lib/site.ts, and the auditor reads the same file to check them — so a duplicate description fails the build rather than being noticed a year later.
C
Security
No secret in the client bundle. Environment files git-ignored from the first commit. Publishable database keys only. Authorisation decided on the server. Row-level security with actual policies. Server-side re-validation of every field. HttpOnly, Secure, strictly-scoped session cookies. Argon2id password hashing. A per-IP rate limit checked before the credential. Parameterised queries, always. Bounded input, escaped output, allowlisted uploads stored outside the web root. Trimmed API responses, a full set of security headers, HSTS with preload, and a dependency scan that passes at high severity.
Roughly half of these have nothing to defend on this site yet, and that is stated below rather than counted as a pass.
D
Design
A real privacy policy in plain sentences. Colours named by role rather than by hue, in one file. A header capped at six destinations. One easing curve site-wide. At least two things moving when the page is idle. A display face at genuine scale with hand-tuned tracking, a distinct body face, and a mono for data. prefers-reduced-motion honoured across the whole site. A visible focus ring that is never removed. A skip link as the first tabbable element.
No token in the colour file is named after the colour it happens to be. They are accent, connected, dormant, ink, surface, edge and value — and that last one appears on money and warnings and nowhere else, which is exactly what makes both of them read instantly.
And seven patterns that are refused outright
Three hits fails the build. Inter, Space Grotesk or Plus Jakarta Sans as the display face. Two-tone gradients running violet into azure. A centred hero with a subheading and two buttons. Three-column feature cards with line icons at the top. Frosted glass as the only idea. Stock 3D blobs and floating shapes with no relationship to the subject. And copy written in the register of supercharged workflows and futures that arrive today.
Those are described rather than quoted, because the auditor scans for the exact strings it bans and cannot tell a rule from a breach of it. A page listing the banned phrases verbatim would fail its own check — which is a fair trade for a check that costs nothing to run.
Rules stated as bans and thresholds, never as adjectives. “Be original” cannot be enforced. “These seven patterns are refused” can.
Not done yet
Five things this site does not do.
Listed here rather than in a file nobody opens. A checklist that claims total coverage is worth less than one that names its own edges.
- 01
The content security policy ships report-only
It reports violations rather than blocking them, and it allows inline script because Next inlines a bootstrap script that would otherwise need a nonce threaded through middleware. It widens from real reports, then flips to enforcing. Widening a policy from guesswork is how a policy ends up permitting everything.
- 02
There is no sign-in, so six security items have nothing to guard
Argon2id hashing, login rate limiting, row-level security, encrypted columns, field-tampering checks and session cookie flags are all specified in what this site hands your assistant, and none of them is implemented here, because there is no account system to implement them in. They arrive together with accounts or not at all.
- 03
There is no upload path at all
Nothing on this site accepts a file. The upload rules are in the catalogue and in every manifest that needs them; they are not exercised here, and claiming that item as met would be claiming credit for a road not built.
- 04
Analytics are not switched on
The measurement code is written and renders nothing until a measurement ID is set. Right now there is no ID, so there is no third-party script, no tracker, and no consent banner for a tracker that is not running.
- 05
The assistant bridge is designed, not built
Copy and paste is the only route to an assistant today. What that would take, and the trade it demands from the content security policy, is set out in full on the assistant page.
What no auditor can check for you
Whether the writing is any good. Whether the one strong idea is actually strong. Whether a case study’s numbers are true. Whether the design is beautiful. Those stay human judgements — and being mechanical about the mechanical part is what buys the attention to spend on them.