The Quality Net

Jump by type: every check that can stop a site · every whisper · post-launch probes · gaps & questions for your pen. Everything below was read from the code as it runs today — each block carries a “go deeper” with exact coordinates, so any claim here can be checked by anyone.

The journey — one practice site through the net

1. The build gate — before a copy exists. While the copy is being made, the machine enumerates every interactive element on every source page (buttons, links, menus, sliders, anything clickable — a wide net of selectors, found both in the raw HTML and the live page) and must account for each one: probed, deliberately excluded, or failed — the counts must balance exactly, no sampling, no budgets. The security policy each copy ships with is derived from what the site actually loaded and touched when a real browser drove it — including, as of today’s merge, the hosts its widgets only reach for after you interact with them (the class that starved milford’s booking widget is closed).
   ↘ go deeper — coordinates

   Interaction completeness: scripts/cf-derisk-verify-core.ts:1821–1931 — the equation discovered == probed + excluded + failed, per page and per discovery round. Candidate universe: labs/cf-derisk-worker/src/index.js:1830–1849 (incl. slider layers/bullets added after a live miss). CSP derivation from capture + interaction-observed hosts: scripts/lib/csp-capture-derivation.ts + scripts/lib/interaction-observed-requests.ts (PR #163, merged 2026-08-28).
2. The walk — the checks that can stop a site. A real browser walks every page of the copy (the seven-page sample died the day a job board escaped it) and each check below holds the site if it fails. In plain words, the walker proves:
   1. It’s really our copy. The copy address answers, is not secretly the practice’s live site, and serves a real page. hold

   2. The receipts exist. Every page has its capture ledger — the walker refuses to grade a world it can’t prove is ours. hold

   3. Sliders actually run. A slideshow that’s present must have started: rendered height and a loaded image, real text, or a painted background. hold

   4. Visible buttons do something. A clickable popup/menu trigger that swallows its click is a dead control. hold

   5. Leaving the copy is deliberate. Any click that navigates off the copy must match a witnessed, code-cited register entry — or it’s red. hold

   6. Documents open. Every PDF/doc link re-fetches successfully with a document’s content type. hold

   7. Widgets aren’t starved. Zero security-policy kills of iframes/embeds — the milford class. hold

   8. No leak back home. Zero requests from the copy to the practice’s live site — the copy stands alone. hold

   9. Nothing fails unwitnessed. Every failed network request must match a witnessed “deliberate” register row (analytics noise excepted by allowlist). hold

   10. Errors have a ceiling. One–three distinct JavaScript errors on a page: recorded as whispers. More than three across the site: red. A registered fatal pattern: red on sight. hold + whisper
   ↘ go deeper — coordinates & verdict classes

   Judge: scripts/sunlight-walk/orchestrate.ts::classifyProbe. Rows: copy-base 272–335; ledger 240–260; slider-started probes.ts:153–242 + orchestrate.ts:413–420; dead trigger 435–449; off-copy nav witness probes.ts:276–448 + 422–434; documents probes.ts:244–274 + 455–462; CSP kills runner.ts:203–231 + 464–471; leakback 472–476; failed-request witness 505–524; JS errors 477–502 + site-wide 571–578. The disposition register is one witnessed file (register.json, 4 rows today; its FATAL lane is live code with zero rows registered — see gap 3). Exhaustive-walk law: PR #166. Verdict classes: NO_LEDGER, copy-base-unresolved, renderer-capability-missing, external-integration-dropped, unknown-runtime-instruction.
3. The cheap eyes — seven flash scouts per site. After the walk, seven inexpensive AI readers each take one page and its harvested evidence (the page bundle, the DOM, the probe receipts, the request log, the screenshot) and are told to over-report anything that looks wrong — and forbidden to name defects, touch anything, or claim something is fine. Their standing rubric, verbatim from the dispatch:
   • missing or empty content compared with the source/capture receipt
   • dead interactions or controls that do not produce an observable state change
   • visitor-visible error text, exception text, or broken-resource language
   • layout wreckage — overlap, clipping, extreme overflow, or empty first screens
   • suspicious requests — leak-back to the practice, security blocks, non-analytics failures
   • forms: name every form; it renders complete, its button responds without submitting, no error state shows
   Their reports are whispers by construction: written law in the dispatch says their observations may not change or block the deterministic walk verdict — they exist to catch what deterministic probes can’t see, and to feed the analyst.
   ↘ go deeper — coordinates

   Rubric + prompt: scripts/sunlight-walk/scout-dispatch.ts:16–25, 176–218; per-form checklist derived from the captured DOM (131–144); answers are identity-bound JSON (task id, site, repo revision, artifact digests, verified byte-for-byte on ingestion); one-way valve stated at 381 and 459–464. Engine: GLM 5.3 Flash, pennies per site. Scouts ride the walk’s selected page set (home, contact, top-interaction pages, a document page) — see gap 4 on coverage tiering.
4. The analyst — one frontier mind, one direction. A top-tier model reads every scout whisper against the register, the probe receipts, and the raw evidence, and rules on each: RED (real — the site goes back for review), or “explained”/“noise” — which are advisory only. The valve is enforced twice: the analyst cannot invent a disposition (an “it’s fine” without a witnessed register row is a hard parse failure), and even a well-formed “it’s fine” is recorded as a plain annotation with zero effect on the verdict. Structurally, the analyst can only make a site’s status worse, never better. Ruled 2026-08-28: the analyst gains graduated powers — look (re-fetch the copy read-only), verify (request one targeted deterministic probe; the machine runs it, the receipt lands in the packet), and draft (a proposed register row with evidence, ratified once by a human, dispositioned by the machine forever after). The valve is untouched. Build chartered as issue #168, wiring receipt required.
   ↘ go deeper — coordinates

   Prompt + verdict contract: scripts/sunlight-walk/analyst-dispatch.ts:129–195 (“RED is the only escalation…”); parse-time register check 283–296; consumption-time downgrade in the walker: orchestrate.ts:629–646 (analyst RED → RED_PENDING_REVIEW; analyst disposed/noise → annotation only). Engine: Opus-class verdict seat, dispatched per dossier only after scouts complete or time out.
5. The sheet — where the team reads truth. As of today: the machine may write “Ready” only when the exhaustive walk proved the copy clean — the same code path that pings the team; anything held writes its reason in plain words; and a human’s edit always wins the cell (the machine compare-and-swaps against its own last write, never yours). What that changes: “is the sheet up to date” stops being a trust question. What I propose to add so it stops being a freshness question too: one machine-written summary line — “as of 4:02pm · 13 ready · 22 held (reasons named) · 5 in flight” — fed by the loop’s heartbeat, plus each Ready cell linking to the walk receipt that proved it. Zero hand-maintenance is the bar: today’s one-time correction (11 stale stamps flipped, 14 human cells untouched) should be the last manual edit of machine history.
   ↘ go deeper — today’s receipt

   Walk-truth law merged as fast-lane PR #165 (2026-08-28). Correction run box-side (the key lives with the door), read-back-verified per row: 11 flipped to “2 · Running” + hold note; 14 CAS-skipped as human-authored. Of the skips, 10 read “READY FOR CUTOVER” on machine-held sites — surfaced same-hour as a cutover-hold; tonight’s re-walk decides each honestly. Proposed freshness line = the conductor heartbeat’s exit equation projected into the sheet header.
6. After launch — what watches a live practice. What runs today, all machine, all typed:
   Forms deliver — proven, not assumed. A three-leg probe on the site’s own address: the lead route answers and is armed → a marked synthetic lead is really submitted → the intake’s own record confirms it arrived and would deliver. Silence is a fail; no real practice can ever receive a test lead — the harness refuses rather than risk it. hold

   Embeds come alive. Booking/payment widgets (JotForm, Calendly, Stripe) must actually mount with zero errors — and a pass measured on a staging address is held until re-proven on the real domain. hold

   Every 404 is remembered. The serving plane records each miss by page and hour (WordPress-probe paths flagged critical); an hourly reader turns them into digests and alarms. watch

   Google can index — and only when it should. Staging addresses are never indexable; the moment a real domain is attached (and only after its certificate is live), the no-index guard is stripped at the wire. hold at the wire

   What I propose the first two weeks add (draft for your pen):

   Hour zero (cutover): old site’s top paths answer on the new domain (no 404s on money pages) · forms receipt on the real domain · embeds-alive on the real domain · www + apex + TLS all answer · from the outside, as a crawler sees it: indexable, sitemap and robots reachable · analytics still fire (Alie, 2026-08-28): if the source carried GA4, the live domain must emit a real collect request during a browser load · CallRail swaps (Alie): if installed on the source, the swap script loads and the rendered number actually changes after settle.

   Daily × 14: the 404 digest per launched site (critical paths alarm loudly) · uptime + certificate probe · form-quiet detection — a practice whose form submissions go silent vs. baseline is a break nobody reports · Search Console coverage delta (needs access — question 3).

   Weekly × 2: a full walk of the live domain (same walker, pointed at production) · search traffic sanity vs. pre-migration baseline — the “did Google notice anything” check.
   Launch watching ends by a written handoff, never by fade-out.
   ↘ go deeper — coordinates & today’s state

   Forms: scripts/forms-delivers-receipt.ts + scripts/lib/forms-delivers.ts (road intake-road.ts:29–103; isolation gate 258–292; silence-is-not-a-verdict 210–221). Embeds: scripts/provider-embed-comes-alive-probe.ts (STAGING_ONLY_UNINSTRUMENTED exits nonzero). Misses: packages/serving-plane/src/router/miss-ledger.ts + scripts/miss-alarm-read.ts — reader went live today (first honest digests on disk); the recorder in the deployed router activates on the next serving-plane redeploy (found today: live store had zero rows while a walked site logged 32 misses — the deployed router predates the recorder). Indexability: staging-hosts.ts + il-deploy-headers.ts + attach-hostname.ts (SSL-active before registry write). The proposed additions are not built; they are this section’s ask.
7. The gaps — where your pen matters most. Found by comparing what we catch by hand against what the code actually checks. Starred items are the ones I most want your ruling on.