fce89d46ebf7bac2a9f8fb245d80b76e54573c83
7
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Pouya LajevardiandClaude Opus 5
|
210bc25a26 |
feat: build steps 7a-10 — the site is complete and reviewable at 22 pages
Steps 7a through 10 as one authorised run. Nothing deployed (D11).
7a Lighthouse returns as `lighthouse@13.4.1` + `chrome-launcher`, NOT
`@lhci/cli`. AGENTS.md §7's advisory attribution was wrong: the carriers
were @lhci/cli's own `tmp` and @puppeteer/browsers' `extract-zip`, not
Lighthouse, which audits clean. A deliberate deviation from R11's literal
trigger, recorded with what it costs. Local gate; CI has no Chrome.
7b OG card generator (satori + sharp) discharges R15 — 20 typed cards plus
per-article cards; the portrait stays on / and /about/ by Q40. Insights
plumbing: ArticleCard, Prose, the index, the article route, articleGraph,
and /'s section 7. Card copy is constrained structurally because text in a
JPEG cannot be grepped by check:claims: every headline IS its page's <h1>,
enforced by `npm run og:proof`.
7c Five drafted launch articles, draft: true / reviewedByPouya: false. An
independent compliance audit returned 76 findings and 57 unsourced
assertions; all blocking and should-fix applied.
8 /contact/, the intake form, and backend/intake/ (undeployed). Plain HTML
POST to a same-origin /api/intake with a 303 redirect, so the form works
with zero JavaScript. docs/05 records three deliberate deviations.
9 /fees/ on Q59's ruling — overtime runs from the session cap, and the
reservation point ships adjacent to the rate. One-page PDF bio discharges
R16; /bio/ is its source, so the circulated artefact stays inside the
review apparatus.
10 /legal/privacy/ and /legal/terms/, written to the backend as built. Three
of the policy's statements are derived and cannot drift.
Also: /about/'s inverse credentials band (approved at step 6); Q59 closed;
R15 and R16 discharged; and a fix to shipped copy — /practice/energy/ asserted
the absence of a regulation the source extract says must not be asserted.
Review: adversarial-reviewer, two rounds (D20/D19). Round 1 returned 16
findings including two blocking — an invisible ghost button on /fees/ at
1.00:1 that Lighthouse scored 100, and a privacy policy that named one data
processor when there are two. All 16 acted on.
Lighthouse, 22 pages, mobile: performance 99-100, accessibility 100,
best practices 100, SEO 100 on every indexable page, CLS 0.000.
AGENTS.md entry (ah) has the detail, including four of my own verification
commands that were wrong and what each of them nearly caused.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5
|
||
|
Pouya LajevardiandClaude Opus 5
|
2ea4c0f8ac |
feat: D20 moves the claims pass to cutover; rule Q56 unscoped; close Q55; freeze check:claims
Four rulings from Pouya, 2026-08-30, and their sweep. D20 — the review protocol. Per build step the review is `adversarial-reviewer` alone. `claims-auditor` no longer runs per step; it runs ONCE, at cutover, over the whole finished site, as a blocking item near the top of docs/06's checklist. `check:claims` is unchanged and still runs on every build and both deploy paths. The reasoning is recorded in full in AGENTS.md D20, as a calibration and not an erosion: nothing has shipped, so every claims finding so far has been about a page no visitor can reach, and one pass over twenty finished pages catches more than nine passes over drafts because it sees the site as a reader does. The /med-arb/ ADRIC gloss is the proof — no individual claim was false, the defect was adjacency, and adjacency does not exist until the pages sit next to each other. The code reviewer stays per step because what it catches compounds. What this costs is recorded honestly beside it, not summarised away. D17 and D19 amended to match. D19's two-round cap governs the per-step code review only; the single cutover claims pass runs until its findings are resolved, because there is no second pass behind it. Q56 — mediation is NOT scoped commercial. Thirteen shipped strings corrected across five files: page titles, meta descriptions, hero ledes, section ledes, the `Service` node's name and description, and `ProfessionalService`'s. §4's mediation row stays unscoped, and the reason now sits beside both rows so the asymmetry reads as designed: arbitration is scoped commercial because of a LEGAL GATE (Q39 — family arbitration in Ontario requires prescribed training); mediation has no such gate. `adversarial-reviewer` then found three surfaces the sweep had missed, the worst on /practice/ — "These describe the process the parties are choosing between, in commercial matters" scoped mediation with the two words never appearing in the same element, so no proximity grep reached it. Q55 — CLOSED WITHOUT BEING RESOLVED, and the difference is the ruling. The Q.Arb stamp is split: `[verified]` on the status, `[Pouya's stated basis]` on the date. The 2026-08-26 record is marked UNRECONCILED, permanently and on purpose. The date is not published and nothing depends on it. check:claims — FROZEN. Round 2 found five defects in round 1's own fixes to that script, two of which made it worse than before the pattern existed. A pattern is added only after a real breach reaches dist/, never speculatively, and each addition ships with a probe plus a negative fixture. No refactors, no coverage improvements. It is a tripwire, not a program. Two conventions into CLAUDE.md: sweep the VOCABULARY, not only the subject (`git grep 'Q.Arb'` is line-anchored and could not find ten lines entirely about Q.Arb that never name it); and agent definitions load at session start, so an edit to .claude/agents/*.md does not reach the session that made it. Verified: check 0 errors, lint 0, build 0 (12 pages), check:claims 0. Lighthouse not run — tool unavailable until build step 7. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5 |
||
|
Pouya LajevardiandClaude Opus 5
|
79b19a7bd0 |
feat: build step 5 — /practice/ and six area pages; check:claims gates §4 in dist
Build and deploy / build-and-deploy (push) Failing after 5s
Step 5 ships /practice/ and the six practice-area pages (construction,
technology, energy, insurance, shareholder, cross-border) from one route, and
adds the mechanical §4 gate Pouya ruled for.
check:claims — §4 Forbidden becomes a build error
scripts/check-claims.mjs greps dist/**/*.html for 10 patterns, each carrying
the incident that put it there. It strips <style> and non-JSON-LD <script>
first (a bare sweep for "leading" returned 26 hits, 25 of them
var(--leading-body)), self-tests every pattern against fixtures before
sweeping, and refuses a missing, empty or stale dist/. Wired into /build
Phase 5 and both deploy paths.
Q54 — six conduct undertakings publish, and §4 gains a third class
Conduct undertakings sit apart from credentials and offerings: the gate is
that Pouya said it in terms. The strings live in CONDUCT_UNDERTAKINGS so a
softening is one visible diff. (e) and (f) replace the third-person sentences
already on /arbitration/ rather than joining them.
Q49, Q50 recorded as rulings. §7 records the SES us-east-1 stray identity's
deletion. R11 holds typescript at its current major, with the peer-range
reason recorded.
Three facts corrected, two of them already shipped
- The LAT gloss said mediation "before filing and continuing after filing";
the Tribunal names mediation for "Before you apply" only and its second
sentence is about negotiation. An ellipsis in docs/01 had deleted it.
- "Connection allocation" is not an Ontario term.
- "The 2026 privacy statute" does not exist — Bill C-27 died without royal
assent. Struck from docs/03 rather than corrected in place.
ADR Chambers struck from /arbitration/ and from docs/01 item 3 (Pouya,
2026-08-30): the source establishes what the firm publishes, not that an
outside neutral can be appointed under its rules.
claims-auditor gains a second lens — for every quoted source, whether the
sentence beneath stays inside what the quotation establishes. Four shipped
defects had that shape and none of them is greppable.
CLAUDE.md gains a convention: never truncate the output of a check you intend
to believe. `npm run check | tail -3` returns warnings, hints and a blank line
and drops the errors line; it was reported as passing four times while
astro check was exiting 1 with 10 type errors.
Gates, exit status read directly, not through a pipe:
npm run check exit=0
npm run lint exit=0
npm run build exit=0
npm run check:claims exit=0
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Md3GndFqWPzK78xAoebsg5
|
||
|
Pouya LajevardiandClaude Opus 5
|
fd5f610982 |
feat: D19 bounds the review loop; apply nine rulings; close Q46(a) and Q48–Q53
D19 into §3 and swept to all six destinations Pouya named: both agent briefs
(scope + severity filter), /build Phases 2–4 (non-gating questions, scope, stop
signal, two-round cap), /wrap, and CLAUDE.md (comments record decisions, not
history). Sweep verified by command, not recalled.
Rulings applied:
Q46(a) PUBLISHABLE — three §4 Offerings rows flipped; gate 1 records
[Pouya's stated basis], never [verified]. Step 5 unblocked.
Q48 closed, not site-relevant.
Q49 one §4 row, "Mediator"; read as declining Q49(b), so worksFor stays out.
Q50 DEVIATES — ships as name + slogan, not the concatenation. Flagged.
Q51 OBA sections stay; the regulator/voluntary distinction recorded.
Q52 docs/reference/deploy-credential-verification.md — 18 read-only AWS
calls, re-run rather than transcribed, access key ID redacted.
Q53 memberOf emitted on /about/'s Person node.
Two review rounds. The headline finding was this session's own: the Q53 sweep
was asserted and never run, leaving six in-scope records saying memberOf was
withheld — including §12 R10, which is read aloud every session. Round 2 then
found that round 1's simplification had put memberOf on / as well; the per-page
opt-in is restored, because Pouya's ruling turns on /about/'s visible HTML.
Also fixed: MEMBERSHIP_ORGS had orphaned BOUTIQUE's D16 JSDoc; /'s title now
derives from the constants; §7's deploy row stated and retracted three facts.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0148NztQskLKKApP5SzAA78e
|
||
|
Pouya LajevardiandClaude Opus 5
|
8f1df2c27c |
chore: correct the review agents' briefs and add a Phase 5 minifier check
Separated from the step 1 feature commit on adversarial-reviewer's own recommendation: instructions that narrow a reviewer's scope should not travel in the same commit as the work that reviewer is checking. claims-auditor.md — REMOVE the enumerated membership list. It read "ADRIC, ADRIO, OBA sections only" while AGENTS.md §4 had gained the Canadian Tax Foundation that morning, so the auditor's own brief contradicted the register: it would have flagged a verified membership as unverified and would not have noticed CTF being dropped. This file has now hosted a stale claim twice. Replaced with an instruction to read the §4 row at audit time — a copy of a fact goes stale where nobody re-reads it. adversarial-reviewer.md — state that Lighthouse cannot be run until step 7 and that its absence is not a finding (AGENTS.md §7, R11). Repair a sentence left truncated mid-list. Caveat the "~1 MB of logo PNGs" figure against Q34, which is open on it. build.md — Phase 4 now carries the measurement that justifies the re-review requirement: on the Astro 5→7 upgrade four of six second-round findings were defects in the first round's own fixes. Phase 5 gains a grep asserting no `animation` shorthand beside `animation-timeline` survives into dist — Lightning CSS folds them into an invalid declaration that works in dev and is dead in the build. That happened twice in one session, the second time inside the fix for the first. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012XquaEq4BgWMCwUqLEyNkF |
||
|
Pouya LajevardiandClaude Opus 5
|
6bf1167624 |
fix: sweep D3 amendment through the specs; correct inverted DKIM table
The re-audit of the deploy-guard change surfaced defects well outside the diff, including one that would have broken production mail. docs/05-backend-spec.md had the two SES DKIM sets exactly inverted, labelling the three records that resolve as "orphans" and the three NXDOMAIN records as "Live. Never delete". Entry (j) corrected this in AGENTS.md §7 and the correction never reached docs/05. Since SES has no custom MAIL FROM, DKIM is the only thing satisfying DMARC, so acting on that table would have silently broken intake mail authentication. Also in this change: - .gitea/workflows/deploy.yml gains a guard as steps[0] that fails the run, naming the variable, if AWS_REGION, S3_BUCKET or CLOUDFRONT_DISTRIBUTION_ID is empty — how a Gitea too old for the vars context manifests. Verified fail-closed under bash -e, sh -e and bash -euo pipefail. - AGENTS.md Current Truth: SPF and DMARC recorded as present (Q20), the matching §10 High risk row retired, three duplicate Q rows removed. - docs/reference/AWS-Hosting-Guide.md tracked and given a do-not-execute banner; it was an executable procedure for the architecture D1/D3 replace. - Copy decks: "a working litigator" and "an active litigation practice" replaced with the register's own wording; LegalService JSON-LD replaced with ProfessionalService; tribunal-secretary offers removed per D14; nine stale question blockers swept. - astro.config.mjs: prefetchAll disabled — it injected JS into every page against the zero-JS convention with no decision recorded. - src/data/site.ts: unregistered response-time commitment nulled (Q27); OBA section names downgraded to [assumed] (Q28). - s3:AbortMultipartUpload reasoning corrected to measure ./dist, not the repo. Opens Q27, Q28, Q29. AGENTS.md entry (q) records the full resolution, including the findings declined and why. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012XquaEq4BgWMCwUqLEyNkF |
||
|
Pouya Lajevardi
|
e6abdf42e8 |
feat: execution protocol, review agents, DNS and SES findings
Build and deploy / build-and-deploy (push) Failing after 6s
|