Website Production Infrastructure
Wire the website to real data, add analytics, add CI coverage, and create OG images. After Scopes A (visual fidelity) and B (dead links) ship, the site looks right and every link works. This scope makes it operationally real — live version numbers, real commit hashes, traffic visibility, social sharing previews, and CI that catches regressions.
verdict PASSscore 27 / 27findings 8 (1 risk · 3 debt · 4 obs)duration 1h 40mrejection cycles 0shipped May 7, 2026surface website
Pipeline timeline
Intent to proven code in 1h 40m across Think, Plan, Build, and Verify.
Think21m
Plan10m
Build59m
Verify10m
Assertion ledger
27 claims, each independently verified. Showing 8 — show all →
| ID | Says | Matcher | |
|---|---|---|---|
| A001 | The version pill shows the real latest release tag, not a hardcoded string | verified | ok |
| A002 | Version data refreshes every hour via ISR caching | verified | ok |
| A003 | The site still works when GitHub is unreachable | verified | ok |
| A004 | Proof feed rows use the live version instead of a hardcoded string | verified | ok |
| A005 | The latest commit SHA comes from the GitHub commits API | verified | ok |
| A006 | Commit data refreshes every five minutes | verified | ok |
| A007 | The commit pill shows a fallback hash when GitHub is down | verified | ok |
| A008 | GitHub auth token is used when available but not required | verified | ok |
Findings 8 total
debtwebsite/lib/proof-feed.ts→ closed
getLatestCommit() exported but never imported — unused function
debtwebsite/lib/proof-feed.ts→ closed
LatestCommit interface exported but never imported — unused type
debtwebsite/lib/proof-feed.ts→ closed
githubHeaders() extras parameter never used with non-default value — YAGNI
riskwebsite/lib/proof-feed.ts→ closed
No tag name validation — non-semver GitHub tags would display as-is in version pill
obswebsite/lib/analytics.tsx→ closed
PostHog useEffect has no cleanup return — posthog.init() could be called on remount
+3more findings
Integrity seal
scopesha256:737a37986e1f9...
contractsha256:9c2d88ba3bb8d...
plansha256:49ba4a9f308a9...
specsha256:5cf84332f5626...
build-reportsha256:d89c86c0792ef...
build-datasha256:87ddaef14e6fe...
verify-reportsha256:6778ddfe834a0...
verify-datasha256:1cfe0184cc5b8...
audit cmd$ ana proof audit website-production-infra → all hashes match