How this was built

The stack

Read out of package.json at build time, so this list cannot drift from what the repository installs. The versions are the declared ranges. Two of them carry no range at all: the browser driver and the accessibility engine are pinned exactly, because both decide gate results and neither decides them for a design reason. The browser pin is the load-bearing one: it fixes the Chromium revision the visual baselines were photographed against.

The gates, and what each one guarantees

Read from the registry both runners import, so this page cannot advertise a gate the build does not run. A gate exits passed, failed, or could not run, and the third is the one that matters: a gate that measured nothing is never counted as one that passed.

1. Gate 1, a11y

   Pass, on an earlier build

   accessibility: axe-core, every route, both themes, two viewports

   axe-core runs against every route in the built tree, in both themes, at 375 and at 1280, under WCAG 2.0 and 2.1 at levels A and AA. Zero violations, or the build does not ship. It drives a real browser because contrast and focus order are computed values that markup cannot show, and it writes its own report into the site it just checked.

   308 checks across 77 routes, two themes and two viewports. 0 violations. The full report ships at /accessibility-report.txt.

2. Gate 2, truth

   Pass, on an earlier build

   truth: every rendered number traces to the data or to a sourced fact

   Every stat tile equals the count in the data. Every fit score equals the sum of its own components. Every rendered timestamp equals the sweep instant. Every apply link answers below a 400 status. Every sentence with a number in it inside an education strip matches the canonical fact list character for character, and a paraphrase fails on purpose.

   77 built pages read, 67 jobs, 0 kills and 7 facts checked. Every rendered number traced back to the data or to a sourced fact. 67 apply URLs probed over the network. This gate had one finding at the start of this run: a closed posting's age, 56d, collided with another posting's fit total of 56, so a duration was read as a score. The age now carries the data-truth=machine marker the index row already used, and the fit scan reads only text no other rule has claimed.

3. Gate 3, copy

   Pass, on an earlier build

   copy lint: banned characters and banned vocabulary

   Em dashes, en dashes and curly quotes fail anywhere in the repository, whether they are written as characters or as HTML entities. The banned vocabulary fails in anything a reader can read, including component props and the human-readable attributes. A banned word inside a code comment warns instead, because the ban is on copy.

   0 failures, 29 warnings, 345 files scanned. 174 of them republish an employer's own writing and are exempt from the character and vocabulary rules, per Ryan's ruling of 2026-08-19. Every character this site authors is checked in src/, with no exemption at all.

4. Gate 4, perf

   Pass, on an earlier build

   performance: Lighthouse scores and the 150 KiB transfer budget

   Lighthouse on an emulated phone: performance at least 95, accessibility 100. Then a static budget, computed from the built files rather than from one browser run, capping each route at 150 KiB of non-image transfer including every font face its stylesheets declare. A third check fails if the browser ever transfers more than that model predicted, because a budget the measurement can escape is not a budget.

   77 routes, all under the 150 KiB transfer budget with every font face counted, worst case 129.1 KiB on the index. Lighthouse 99 for performance on the index and 100 everywhere else, 100 for accessibility on every route, against floors of 95 and 100.

5. Gate 5, visual

   Retired, on an earlier build

   visual: screenshots match committed baselines

   One screenshot per route, per theme, per viewport, compared against baselines committed in this repository. Zero differing pixels. Nothing is masked, including the timestamps and the stat tiles, because a mask over the numbers would point the only pixel-level gate away from the pixels carrying the claim. A baseline may only change in the same commit as the change that caused it.

   No result recorded for this gate in the run below, so this page makes no claim about it.

6. Gate 6, motion

   Pass, on an earlier build

   motion: runs once, under 400ms, absent under reduced motion

   The one signature moment runs once, finishes under 400ms, and does not run at all when the reader has asked for reduced motion. Asserted from both ends: statically over the shipped CSS with token references resolved, and at runtime by recording every animation the document starts from its first frame, because a page-load animation is over before a single read could see it.

   77 routes, both halves asserted: every animation runs once and under 400ms, and every one is absent under prefers-reduced-motion.

7. Gate 8, provenance

   Pass, on an earlier build

   provenance: renders never alter the immutable core, every core field traces to the schema

   The immutable core of a Profile Record entry, employer, title, and both dates, is read live off record.ts and checked against the ProfileEntry interface and against the columns declared on record_entry, so the three cannot silently disagree about what the core is. Source under src/ fails if a core field name is ever directly followed by a string transforming call: no trim, case fold, normalisation, replace, slice, or split reaches a value on its way to a reader. A fixture entry carrying a leading and trailing space, a smart quote, an em dash and other adversarial characters is then run through every exported function that can return an entry without opening a database connection, and every core field coming back has to match byte for byte. A second fixture proves the record accepts, rather than refuses, a core field carrying whitespace or a hidden character: nothing scans, strips, or warns about what a person put in their own record. A third, adversarial record and target are rendered through the real renderResume() and renderCover(), and every rendered core is checked two ways, byte-identical to a literal ledger and separately traceable to coreOf() of its own source entry, while nothing the target alone carries ever reaches a section, a bullet, or a gap. The fourth clause, that every generated bullet resolves the PRF ids it cites, runs against those same two renders.

   The 4 immutable core fields of a Profile Record entry, read live off record.ts rather than remembered, checked against the ProfileEntry interface and against the columns record_entry declares, so the three cannot silently disagree about what the core is. Source under src/ fails if a core field name is ever followed by a string transforming call. An adversarial fixture entry carrying a leading and trailing space, a smart quote and other hostile characters survives every exported function byte for byte, and a second fixture proves the record accepts such an entry rather than refusing it: nothing here scans, strips or warns about what a person put in their own record. 6 generated bullets across 2 renders resolve every PRF id they cite.

8. Gate 9, fabrication

   Pass, on an earlier build

   fabrication: 20+ adversarial scenarios, every channel, fail closed

   32 adversarial scenarios, each one an invented record, a target, and sometimes a writing-voice sample, run through the real renderResume() and renderCover(), one attack per scenario through one of four channels: the posting, the voice sample, the record itself, or the export path. Every render is held to the same four checks: no fact appears that is absent from the record, the immutable core stays byte-identical, every bullet resolves the PRF ids it cites, and every hidden or invisible character in the output traces to something already present in the record, the target, or a voice sample, so a character the generator introduced on its own fails while a character the person or an employer already wrote passes through untouched. This tool does not scan, strip, or refuse a person's own content; it only refuses to generate hidden text of its own.

   29 adversarial scenarios run across four channels, the posting, the voice sample, the record itself and the export path, plus 5 provider pipeline checks driving the real generative code path with no network. 0 findings. Every render is held to four checks: no fact appears that the record does not hold, the immutable core stays byte identical, every bullet resolves the ids it cites, and every hidden character in the output traces to something a person or an employer already wrote. A character this generator introduced on its own fails; one the person wrote passes through untouched.

9. Gate 10, population

   Pass, on an earlier build

   population: every count on a page reconciles to one stated population

   Every count on a page reconciles to one stated population. Four registered populations, each with a value recomputed here from the published files rather than trusted from the page, and each with a phrase a reader has to be able to see beside the number: postings observed on the boards, postings that reached a verdict, published rows, and boards swept. A number whose surrounding block does not carry its population's phrase fails even when the number itself is correct, because a figure a reader cannot attribute is not yet a fact to them. Where a page states two counts that sound like answers to one question, exactly one element has to tie them together: none is the silent version of the mistake this gate is named after, and more than one is two statements that will drift. A distinctive value printed with no declaration at all fails; a two-digit one warns, because this repository already learned from the truth gate that hard-failing on short common numbers finds coincidences rather than defects.

   Four registered populations, each recomputed here from the published files rather than trusted from the page: postings observed on the boards, postings that reached a verdict, published rows, and boards swept. Every declared count matched, every one carried the phrase that names it, and where a page states two counts that sound like one question, exactly one element ties them together. Two warnings, both a two digit value printed with no marker, which this gate reports rather than fails because the truth gate already learned that hard failing on short common numbers finds coincidences instead of defects.

10. Gate 11, pii

    Pass, on an earlier build

    pii: no person-table value or shape reaches a static file

    No account holder reaches a file. Every built file is read for an email address, and an address only passes if it was derived from somewhere it legitimately comes from: a recruiter address republished inside an employer posting, or this site saying how to reach its own operator. Both sets are read out of their source files, so neither is a list anyone can quietly extend. The column names of every person table fail as rendered text or as an attribute value, the tables themselves read out of the auth library rather than remembered, and so does anything shaped like a cookie or a bearer token. Then the other direction: a page that reads a signed-in reader, the auth layer, or the database has to be rendered per request, because a prerendered page that read a reader read one reader, once, at build time, and served that answer to everyone.

    226 built files read for an address, a cookie or a token shape, 77 built pages read for a person-table column name, and 26 source pages checked for whether a page that can read an account holder is rendered per request. 0 findings. 4 addresses are permitted and both sources are derived rather than listed: 3 come from employer postings in src/data/jobs.json and 1 is this site's own operator contact in src/data/site.ts.

11. Gate 12, parse-proof

    Not recorded

    parse-proof: the resume PDF re-extracts byte-intact, hides no text, states truthful metadata

    A fixture record is rendered through the real tailor, drawn to a PDF by the site's own vanilla writer, and re-extracted with the same resume-extract.ts a person's upload passes through. Three things have to hold. Every field survives byte-intact: each name, official title, employer, and date range comes back out of the PDF as one unbroken run, and every bullet as the same words in the same order. No text is hidden: every glyph is black, at a readable size, positioned inside the page, so there is no white text, no off-page text, and no size a reader could not see. The metadata is only the four truthful facts, the person as author, this site's renderer as producer, the real date, and nothing else, no tool claiming authorship it does not have. The gate proves it can catch each of these failing on every run by planting the exact defect, a dropped role, an invisible-text plant, a metadata lie, and asserting the detector fires, because a gate that has never failed is decoration.

    No result recorded for this gate in the run below, so this page makes no claim about it.

The conformance run

No current run. The last recorded run read 9 of 10 gates green on a tree this build is not

The command is below and it is the whole thing: anyone with the repository runs it and compares. The run carries the sweep stamp rather than a time of its own, because a build is an artifact of a sweep and this site has one clock. Before the gates run, a census asserts that the tree they are about to read contains every route this repository declares, so a green summary cannot be green partly because a page was missing.

npm run conform

  PASS        gate 3 (copy)           1.3s
  PASS        gate 2 (truth)          3.2s
  PASS        gate 11 (pii)           2.0s
  PASS        gate 1 (a11y)          46.6s
  PASS        gate 6 (motion)       263.4s
  PASS        gate 4 (perf)         520.2s

  7 of 7 gates passed in 950.2s

The gates are also run against deliberately broken copies of the site, one per gate, and every one has to fail. That run happens first in continuous integration, before the real build is judged, because a green result is only worth something if the instruments can still go red. A gate that has never failed is decoration.

The decision log

Every call made without a human is written down with the date, the reasoning, and what would reverse it. The full record lives in the repository. What follows is a map of it, and then the part that matters more.

1. Colour was resolved by measurement, not by preference

   One quiet grey in the palette failed AA everywhere it carried text, on both themes. Walking the ramp one step at a time showed that the tone it described does not exist on this paper: the nearest passing value is also the lightest passing value. The token was retired rather than redefined into a duplicate of its neighbour, and every place it had been carrying hierarchy was given a second channel, one instance at a time.

2. No gate was ever loosened to make a build pass

   Two gates ran red for most of a day, on contrast and on the transfer budget, and both were left red until the design was fixed. No threshold was edited, no rule excluded, no selector skipped. Both went green afterwards with no change to any gate file, which is the outcome the refusal was betting on. The copy gate is the current test of the same rule, and it is a harder one: it forbids em dashes, en dashes and curly quotes, employers write all three, and this site republishes an employer's posting without editing a character of it. Two absolute rules disagree, the gate is red, and it stays red until the owner rules on which one governs quoted material. A red gate over a real collision is worth more than a green one over an edited quotation.