Skip to content

Self-check

This site's own audit

We sell verifiable marketing, so this site is checked the way a customer's assets are checked, and the report is published whatever it says. Every result below names the method that produced it. Where a check was not run, it says so and claims nothing.

Generated
2026-10-24 09:04:15 UTC
Files scanned
170 under site/src and packages/core/src
Checks run
20 pass · 0 fail
Not run
7 of 27

The report is produced by scripts/self-check.mjs, a dependency-free Node script that reads this repository and writes src/data/proof.generated.json. The page you are reading renders that file and nothing else — no result on this page is typed by hand. The timestamp is passed into the script by its caller, so the check logic is a function of the repository contents alone. The generated report is excluded from its own source scan.

Checks that ran

Every check below is deterministic: the same repository produces the same verdict every time, with no model in the loop. Each states what its method can and cannot see, because a method that overstates its reach is how a vendor ends up under a twenty-year order.

What was not run

Not run means not run. It is never a quiet pass.

The checks listed here apply to this site and are not yet wired into the self-check. They need something static inspection of source cannot supply — a rendered page, a computed style, a request made from outside the origin — and they are pending the rule-pack engine that does that work. Until then they carry no verdict. A report that quietly omits what it did not examine is worse than no report, because it reads like coverage.

  • PX-CWV-FIELD

    Not run

    Core Web Vitals, at the percentile the assessment actually uses

    Not run, and it cannot be. web.dev states the target is "the 75th percentile of page loads, segmented across mobile and desktop devices" — a distribution across real users on real devices and networks. Source code contains no such distribution, and this site has no field data yet because it is not publicly reachable. Reporting a number here would be reporting a different metric under the same name.

    Pending field data. Once the site is public and first-party analytics is collecting, this reports LCP, CLS and INP at the 75th percentile with the sample count, and says so when the sample is too small to mean anything. The structural half is covered today by SC-STATIC-RENDER.

  • PX-CWV-LAB

    Not run

    A lab page-experience measurement, labelled as lab

    Not run. A lab measurement needs a browser driving the rendered page, which static inspection of source cannot provide. It is also, by web.dev's own wording, "not a substitute for field measurement" — so it will be published as the lab signal it is and never as the assessed metric.

    Pending the rule-pack engine, which drives a real browser. Will report the run conditions alongside the numbers, because a lab figure without its throttling profile is not reproducible.

  • A11Y-CONTRAST

    Not run

    Text meets minimum contrast against its background

    Not run. Contrast is a property of computed styles against rendered backgrounds. Tailwind utility classes in source do not settle what colour pair a given text node ends up with, so no honest verdict can be read out of the source alone.

    Pending the rule-pack engine, which measures the rendered page and reports the exact ratio and the failing pair.

    The rule in the catalogue

  • A11Y-ALT

    Not run

    Images carry alternative text

    Not run as a rendered check. The self-check confirms that no raw HTML image element exists and that inline SVGs are named or hidden (SC-NO-RAW-IMG, SC-SVG-LABEL), which is adjacent evidence but not the same claim: it does not inspect the alt text of next/image instances or of anything composed at runtime.

    Pending the rule-pack engine, which reads the rendered accessibility tree rather than the source.

    The rule in the catalogue

  • GEO-CRAWLER

    Not run

    Answer-engine crawlers are not blocked at the origin

    Not run against the live origin. The self-check reads robots source only (SC-CRAWLER-ALLOW). A host default, security plug-in, CDN rule, or WAF can return 403 to a named agent while robots says nothing about it, and that is the failure this check exists to catch.

    Pending the rule-pack engine, which issues one request per named user agent from outside the origin and records the response code.

    The rule in the catalogue

  • PROV-AI-MARK

    Not run

    AI-generated content carries machine-readable marking

    Not run. This site publishes no synthetic imagery, so there is nothing here to mark, and a check that has nothing to inspect must not be reported as a pass. If AI-generated media is published on this site later, this check becomes live and applicable.

    Pending the generation pipeline, which applies the marking at production time and the engine which reads it back out of the asset.

    The rule in the catalogue

  • AD-DISCLOSURE-POS

    Not run

    Disclosures are placed where they will actually be read

    Not run. Placement is a rendered-layout property at a given viewport width. Reading it out of JSX would mean guessing at layout, and a guess is not a verdict.

    Pending the rule-pack engine, which evaluates proximity and prominence against the rendered page at several viewport widths.

    The rule in the catalogue

How to reproduce this

Clone the repository and run pnpm self-check. The script takes an optional --generated-at timestamp and writes the same JSON this page renders. Pass --strict to make a failure exit non-zero.

What this page is not: a certificate. It is a dated record of a specific set of checks against a specific commit, at the deterministic tier, with the method for each one written down. That is the same thing we publish for a customer, and it is the most any honest report can be.

The full check catalogue