Colibrity standard what every project has to satisfy

This site, graded against this standard

Including what it does not meet, what nobody has re-checked since the rebuild, and why each is declared rather than omitted.

Every rule below is the same rule the two checklists carry, graded against this page. The point is not the score. The point is that the score exists, including the rules this page does not meet, which are listed first.

37 pass 0 fail 49 unverified 88 n/a 1 waived

A rule marked n/a carries the reason its condition did not apply. Several of them are n/a because they assume the WordPress stack, which is a live illustration of open question 3 rather than an oversight.

Unverified is not a pass, here either. This page used to treat any rule nobody had written about as passing, which put 33 unexamined rules in the passing column. The page was rebuilt on 2026-08-23, so every grade that was not written down had gone stale anyway. They are listed below with what would settle each one.

Not a plain pass

ResultRuleTitleReason
waived seo.robots-txt robots.txt exists and points at the sitemap Half met on purpose. robots.txt exists, returns 200 and allows crawling, but it deliberately carries no Sitemap line, because a sitemap of noindex URLs contradicts itself. The file states that reason in its own comments, so anyone who checks finds the decision rather than an omission.
unverified a11y.axe-clean No automated accessibility violations Settled by an axe run over the checklist, the gate and one explainer. The markup was rebuilt on 2026-08-23 and has not been scanned since.
unverified a11y.icon-semantics Icons are hidden when decorative and named when they act Not checked against this site since the rule was written. Settled by: zero icon-only controls in the sampled templates lack an accessible name, every decorative icon is hidden from the accessibility tree, and no icon announces a leftover title from the export tool.
unverified a11y.keyboard-operable Everything works with a keyboard alone Settled by a keyboard pass over the checklist: tab to a row, space to tick, enter to expand, escape out. The rows and the disclosures are new on 2026-08-23.
unverified a11y.link-text Link text makes sense out of context Settled by reading the link text on one checklist page out of context. The rows added new repeated links (Why this rule exists, Comment on this rule) that this rule is specifically about.
unverified a11y.reduced-motion prefers-reduced-motion is honoured everywhere The only motion is the smooth scroll on a ?rule= arrival, and it already reads the media query. Unverified because that path has not been re-run with reduced motion since the rebuild.
unverified a11y.screen-reader-pass One page and one form are driven with a screen reader Not checked against this site since the rule was written. Settled by: the report names the screen reader and browser used, lists the headings and landmarks in the order they were announced, and confirms the invalid submit was announced. Zero unlabelled controls were met on the two pages.
unverified a11y.skip-link A working skip link is the first focusable element The markup is right - the skip link is the first focusable element and points at the main landmark. What is unchecked is whether it becomes visible on focus, which is a look rather than a grep.
unverified a11y.target-size Tap targets are big enough and far enough apart Not checked against this site since the rule was written, and the quote below was stale from 2026-08-26 to 2026-09-10 because nothing read this file. Settled by: at a 390px viewport, every button, icon control and menu item is 24 by 24 CSS pixels, or a 24 px circle centred on it clears its neighbours' circles - the spec's test, 24 px centre to centre, not 24 px of space. Links in a sentence are exempt.
unverified a11y.zoom-and-reflow The page survives 200 percent zoom and a 320px viewport Settled at 200 percent text zoom and at a 320px viewport, with body text measured at 16 px or more at every width. The row layout is new and is the thing most likely to break at both.
unverified colibrity.filter-indexability Filter combinations do not become a crawl trap The checklist is a filtered listing and its filters write to the URL, so the rule applies. What is undecided is whether a filtered view should be indexable at all on a site that is entirely noindex.
unverified colibrity.tokens-from-the-design-file Design values reach the code as generated tokens, not typed numbers The colours and their measured contrast ratios sit in site/src/css/tokens.css by hand; there is no design file, no generator and no drift test, so the rule is not met and not claimed. Settled by: the repository holds one token source and a generator, the built CSS carries every token in it, a test fails when the two disagree, and a grep of the components finds no colour literal outside the token files.
unverified crawl.breadcrumb-trail Every page below the home page shows one breadcrumb trail Not checked against this site since the rule was written. Settled by: each sampled page below the home page shows exactly one trail, its root item in the page's language, its last item not a link, and its BreadcrumbList lists the same items in the same order under the same names. The Rich Results Test reports 0 BreadcrumbList errors.
unverified crawl.internal-reachability Every indexable page is reachable by a static HTML link Not checked against this site since the rule was written. Settled by: the raw-HTML crawl reaches every URL in the sitemap: 0 orphans. No indexable page sits more than 3 clicks from the home page. A page found only in the sitemap counts as an orphan, not as reachable.
unverified crawl.search-console Search Console is verified and the build team has access Not checked against this site since the rule was written. Settled by: a dated screenshot taken from the build team's own Google account with the Coverage report open on the production property. Requested at kickoff, not at launch. After go-live the same account shows the sitemap submitted, with a read date.
unverified crawl.signals-agree Canonical, robots, sitemap and meta tell one story Not checked against this site since the rule was written. Settled by: on ten sampled URLs, none is both noindex and Disallowed in robots.txt, no noindex URL is listed in a sitemap, and no page canonicalises to a URL that answers noindex, a redirect or a 404.
unverified crawl.slug-change-redirect A renamed slug leaves a redirect from its old URL Not checked against this site since the rule was written. Settled by: every URL in the sitemap snapshot taken before the restructure, plus every old URL rebuilt from _wp_old_slug, returns 200 or exactly one 301 to a 200. 0 of them 404, and 0 chains of two hops or more.
unverified crawl.url-format Slugs are readable, hyphenated and in the page's language Not checked against this site since the rule was written. Settled by: every URL in the crawl is under 115 characters, separates words with hyphens rather than underscores, carries no numeric id or date segment, and is in the same language as the page it serves. 0 exceptions across the sampled templates.
unverified delivery.browser-matrix Every template is opened in all three browser engines Not checked against this site since the rule was written. Settled by: every template on the template list has been opened in Chrome, Firefox and desktop Safari - three engines, none checked in fewer - and each difference found is either fixed or written down.
unverified delivery.monitoring-and-backups Uptime monitoring and a restorable backup are live at launch Not checked against this site since the rule was written. Settled by: the monitor's public status URL shows checks on the home page at five minutes or better, and the handover names the person it alerts and the date they took it on. If nobody will own it, the handover records that and it is not ticked.
unverified delivery.real-content No placeholder content survives to launch Not checked against this site since the rule was written. Settled by: a grep across every URL in the sitemap returns 0 matches for lorem, ipsum, TODO, FIXME and placeholder, and 0 references to a starter-theme demo image. Drafts and private posts are out of scope.
unverified design.not-colour-alone No information is carried by colour alone Not checked against this site since the rule was written. Settled by: view the key frames with a greyscale filter on: links, required markers, statuses, chart series, map keys and the active tab are all still tellable apart, with 0 distinctions left to hue alone. Keep the dated greyscale export as the evidence.
unverified html.bem-naming Class names follow BEM and match their block slug The new item and workbench classes follow block__element--modifier, but no pass has confirmed every root class equals its block slug.
unverified html.buttons-vs-links A link goes somewhere, a button does something Settled by reading the new controls: the workbench buttons act on the page and the nav entries navigate, which is the right split, but nothing has confirmed no div carries a handler.
unverified html.valid-markup Every template produces valid HTML Settled by the W3C validator over a sample covering the checklist, an explainer and the self-check. Every template changed on 2026-08-23.
unverified onpage.core-fields Core CMS fields carry the content, not only the builder Not checked against this site since the rule was written. Settled by: wp post list over each public post type returns 0 published items with an empty post_title, an empty post_excerpt or no featured image, run on the content-complete site and dated. A post type that deliberately uses none of the three is listed with its reason.
unverified onpage.schema-fidelity Structured data says what the page actually says Not checked against this site since the rule was written. Settled by: on three sampled pages every emitted value matches the rendered page: headline equals the visible title, author is a name rather than a language code, dates match, and no rating, price or count is emitted that the page itself does not show.
unverified ops.backup-coverage Backups cover the database and the uploads, on a stated schedule Not checked against this site since the rule was written. Settled by: a dated screenshot of the backup listing shows a database backup under 24 hours old and a file backup under 7 days old. The handover states retention in days and names the copy held outside the hosting account.
unverified ops.recovery-drill The site has been restored and rolled back, once, on purpose Not checked against this site since the rule was written. Settled by: the handover carries dated terminal output from two runs: a restore of a backup no more than 7 days old into a non-production target, ending with that target's home page returning 200, and a rollback to the previous release. A tick with no output does not settle it.
unverified perf.animation-cost Animation is cheap and stops when off screen The only animation is a smooth scroll. Unverified because no trace has been taken of the rebuilt page.
unverified perf.enqueue-hygiene Every asset loads once, has content, and only where used Not checked against this site since the rule was written. Settled by: in each sampled template's network log: zero URLs requested more than once, no stylesheet or script under 100 bytes, no library loaded by a template that does not use it, and four or fewer resource hints in the head.
unverified perf.no-render-blocking Nothing render-blocking that does not have to be One stylesheet and one deferred module, which is what the rule allows. Unverified because the render-blocking audit has not been run against the rebuilt page.
unverified perf.optimiser-output-fresh Optimiser output is regenerated and state classes safelisted Not checked against this site since the rule was written. Settled by: every class toggled from JavaScript is present in the production stylesheet: open the menu, a modal and one filter on the live URL and confirm the styling applies. The critical CSS is no older than the build it shipped with.
unverified perf.ttfb Server response starts inside 800 ms Not checked against this site since the rule was written. Settled by: the server response time audit reports 800 ms or less as the median of three or more mobile runs on the slowest template, with the spread of the runs quoted.
unverified practices.console-clean Production loads with a clean console The checklist page loaded with no console message on 2026-08-23, but the rule asks for a sample of pages plus a navigation between two, and only one page was opened.
unverified practices.handover-notes The project ships with the notes needed to run it The repository README, CLAUDE.md and HOW-THIS-RUNS.md between them cover building, deploying and what was deliberately left out. Unverified because nobody has tried to build and deploy from those pages alone.
unverified practices.mobile-viewport-chrome The layout survives the phone's real viewport Not checked against this site since the rule was written. Settled by: on a real phone at 390x844: no section clipped by the browser toolbar in either orientation, no text or control under the notch or home indicator, and a sticky header at 15 percent of viewport height or less in landscape.
unverified practices.no-secrets No credential ever reaches the repository or the web root The repository has no environment file and the deploy uploads only site/dist. Settled by confirming that nothing under dist is a credential and that the deploy filter has not changed.
unverified practices.one-change-per-deploy Performance and behaviour changes ship one at a time This rebuild is deliberately one large change rather than several small ones, so the rule is not met for this release and the next deploy is where it starts applying again.
unverified practices.output-escaping All dynamic output is escaped at the point of output Every value in the page shell and the row renderer goes through esc(), and the suite checks the output for inline handlers. Unverified because no pass has confirmed every interpolation in the three new page modules is escaped.
unverified practices.real-device-check Anything animated or video-driven is checked on a real device Settled on a real phone. Nothing on this site is animated or video-driven, so it is close to trivially true, but it has not been opened on one since the rebuild.
unverified practices.responsive-breakpoints The layout holds at every width, not just the design widths Settled by dragging from 320 to 2560 on the rebuilt page. The row layout and the workbench are both new and neither has been watched across that range.
unverified security.admin-accounts-at-handover The administrator list is named and owned before handover Not checked against this site since the rule was written. Settled by: wp user list --role=administrator names no account called admin and no build account above editor, and a dated written confirmation from the client - an email reply or a countersigned handover line - claims every remaining administrator.
unverified seo.headings-describe-content The heading outline reads as an outline Settled by reading the headings of the checklist and the background page in order and asking whether they convey the page without the body copy.
unverified seo.internal-links-resolve No internal link is broken The suite proves every link out of an explainer resolves, which is a subset. A crawl of every internal link on every page would settle it.
unverified states.current-page The current page is marked in the navigation Not checked against this site since the rule was written. Settled by: on five pages including one section landing page, the main navigation carries exactly one aria-current="page" and it is the item for the URL loaded. No other navigation on the page carries more than one.
unverified states.error-page-design The 404 and 500 pages are designed, not server defaults Not checked against this site since the rule was written. Settled by: the 404 opens with the site header, footer and type styles and at least one working link back into the site. Forcing a 500 on staging returns a page in the same chrome, not the raw server or PHP default.
unverified states.interactive-set Every interactive element ships all of its states Not checked against this site since the rule was written. Settled by: sample one control of each kind on three templates: hover, active, disabled and open each render a visible change. An element inserted by a filter or a load-more shows the same four states as one present at first load. Nothing a hover reveals is the only route to it on touch.
unverified states.loading-feedback Anything that takes time says so Not checked against this site since the rule was written. Settled by: throttle to Slow 3G, then submit a form and change a filter. Each shows a busy state within 500 ms. Force one to fail and the busy state clears rather than leaving a spinner running forever.
unverified states.sticky-chrome Sticky header and menu scroll behaviour is decided up front Not checked against this site since the rule was written. Settled by: scrolling past the stick point shifts the page by 0 pixels. A link to #section leaves its heading fully below the header. With the menu open the page behind it does not scroll, and closing it returns to the same position.
n/a a11y.alt-text Images carry alt text that earns its place The site renders no img element at all; the only image is the favicon, inlined as an SVG data URI.
n/a a11y.dialog-behaviour Modals trap focus, return it, and close on Escape No modal, drawer or off-canvas menu. The filters are inline at every width.
n/a a11y.form-errors Errors say what is wrong and how to fix it Nothing is submitted. The search box filters as you type and has no error state to report.
n/a a11y.media-alternatives Video and audio carry captions and controls No video or audio anywhere on the site.
n/a a11y.statement The site publishes an accessibility statement Recommended rather than required, and deliberately skipped for an internal review document rather than a public site. Recorded instead of quietly dropped.
n/a admin.capability-boundaries What the client must not do is refused, not hidden No accounts, no roles and no capabilities. Every page here is public and static, so there is nothing a client could reach that they should not, and nothing to deny.
n/a admin.client-mode The client's admin is trimmed, and the trim can always be undone There is no wp-admin, no admin of any kind, and nobody but the two people who deploy it has an account to simplify. The rule asks what the client's admin looks like; this site has no client and no admin.
n/a admin.duplicate-content An editor can duplicate any content item, translations included There is nothing to duplicate and nobody to do it: every page here is rendered from the rule registry by a build, and there is no admin, no editor and no content item.
n/a admin.editor-language The admin reads in the language the editor set Gated on the multilingual trait, which this site does not have. It is published in English only, and there is no admin for a label to be read in.
n/a admin.fields-in-code Field definitions live in the repository, and a field name is the data There are no fields. Every word on this site comes from a YAML rule file or a markdown document in this repository, which is the stronger form of what the rule asks for, but it is not the thing the rule is about.
n/a admin.one-control-per-setting One control writes one setting Nothing on this site is settable from a screen. The one place a value can be changed is a file in the repository, so there is no second control for one to disagree with.
n/a admin.translation-declared Every field and every fixed string says how it translates Gated on the multilingual trait, which this site does not have, and there are no custom fields and no translation plugin for a preference to be declared to.
n/a colibrity.adding-a-block Adding a block shows a picture first and never lands empty There is no block picker and no editor. A rule is added by writing YAML, and it renders from the registry with nothing to pre-fill.
n/a colibrity.block-file-triple A block is three files sharing one slug Stack-specific to WordPress with ACF. This is a static build, so the rule has nothing to apply to. It is a live illustration of open question 3: several rules assume the WordPress stack, and if your projects start elsewhere those rules need a second stack marker.
n/a colibrity.dev-surfaces-hidden Developer surfaces stay, and their exposure is decided in code This site ships no sandbox, styleguide or status page. Every route it publishes is the document itself, and all of them are noindex by policy rather than by being developer surfaces.
n/a colibrity.paged-canonical Paged views are canonical to themselves Same reason. No paged views exist.
n/a colibrity.pagination-crawlable Pagination controls are links, not buttons Same reason. No pagination controls exist.
n/a colibrity.pagination-in-url Every page of a listing has its page number in the URL All 156 rules render on one page. There is no page two, so there is no page number to put anywhere. Satisfying a blocker by not triggering it.
n/a comms.conversion-events The events that count are agreed, fired once, and observable No analytics, no tag container and no cookies of any kind. The only browser storage is a localStorage tick list, which is first-party and functional.
n/a comms.crm-field-map Every form field lands in the right CRM field Nothing is submitted, so nothing reaches a CRM.
n/a comms.delivery-alerting A broken form or CRM connection raises an alert The site sends no email. It is static files on shared hosting.
n/a comms.email-authentication Automated mail arrives with SPF, DKIM and DMARC passing The site sends no email. It is static files on shared hosting.
n/a comms.email-rendering Transactional emails render in the clients people use The site sends no email. It is static files on shared hosting.
n/a comms.sender-identity Automated email carries a correct From, Reply-To and language The site sends no email. It is static files on shared hosting.
n/a comms.submission-delivery A submission is stored before anything is emailed This site has no form of any kind. It collects nothing from a visitor.
n/a crawl.language-parity Every language publishes the same set, or says what it leaves out One language. There is no secondary language to measure against the source.
n/a crawl.language-urls Each language version has its own crawlable URL English only, decided.
n/a delivery.client-handover The client leaves handover able to run the site Not a client deliverable. It is the review instrument itself, and its own README is the handover.
n/a delivery.editor-test The admin has been tested by someone who did not build it There is no admin to sit anyone in front of. The two people who deploy this site edit YAML in a repository, and the handover it describes is a client's, not its own.
n/a design.contrast-in-mockup Contrast is proven in the mockup, not found in the browser There is no design file. This site was built in code from the start, which is exactly the situation this rule's trait excludes.
n/a design.mockup-coverage Every unique section and page has its own mockup There is no design file. This site was built in code from the start, which is exactly the situation this rule's trait excludes.
n/a design.motion-spec Every animated surface has a defined motion spec There is no design file. This site was built in code from the start, which is exactly the situation this rule's trait excludes.
n/a design.naming-convention Layer and component names are agreed with the developer There is no design file. This site was built in code from the start, which is exactly the situation this rule's trait excludes.
n/a design.state-set The design specifies every state of every interactive element There is no design file. This site was built in code from the start, which is exactly the situation this rule's trait excludes.
n/a design.text-over-media Text over imagery carries a scrim the design specifies There is no design file. This site was built in code from the start, which is exactly the situation this rule's trait excludes.
n/a design.ui-kit The UI kit is built and published before the build starts There is no design file. This site was built in code from the start, which is exactly the situation this rule's trait excludes.
n/a env.env-config-not-in-db Environment switches are enforced in code, not in the database No database, and no configuration outside the repository. The whole site is a pure function of standard.site.mjs plus the rule files.
n/a env.no-production-data-off-production Production personal data does not travel to staging or a laptop This site has no form of any kind. It collects nothing from a visitor.
n/a env.staging-parity Staging matches production where the checks depend on it There is one host. This site has no staging environment to keep at parity with production, and adding one to serve a document would be ceremony rather than safety.
n/a env.staging-sends-nothing-live Staging never writes to a production system This site has no form of any kind. It collects nothing from a visitor.
n/a forms.anti-spam Forms carry three layers of spam defence This site has no form of any kind. It collects nothing from a visitor.
n/a forms.cache-safe-submit A form still submits from a cached page Gated on the has-forms trait, which this site does not have. Feedback goes out through a mailto link, so there is no submit, no token and no cache to serve a stale one from.
n/a forms.confirmation A successful submit produces a confirmation nobody can miss This site has no form of any kind. It collects nothing from a visitor.
n/a forms.error-timing An error appears on blur, not while someone is typing This site has no form of any kind. It collects nothing from a visitor.
n/a forms.file-uploads File uploads declare what they accept and why they refuse No form, so no upload.
n/a forms.input-font-size Form inputs are 16 pixels so iOS does not zoom on focus This site has no form of any kind. It collects nothing from a visitor.
n/a forms.input-type-and-autocomplete Every field declares its type and its autocomplete token This site has no form of any kind. It collects nothing from a visitor.
n/a forms.server-side-validation Every validation rule runs again on the server This site has no form of any kind. It collects nothing from a visitor.
n/a forms.submit-lifecycle A submit happens once and loses nothing This site has no form of any kind. It collects nothing from a visitor.
n/a forms.value-formats Email and phone are checked without rejecting valid values This site has no form of any kind. It collects nothing from a visitor.
n/a legal.consent-record Every consent is recorded with what it takes to prove it This site has no form of any kind. It collects nothing from a visitor.
n/a legal.consent-record-context Consent records carry the context of the consent This site has no form of any kind. It collects nothing from a visitor.
n/a legal.consent-retention The consent log is exportable and has a retention period This site has no form of any kind. It collects nothing from a visitor.
n/a legal.cookie-banner Refusing cookies is as easy as accepting them No analytics, no tag container and no cookies of any kind. The only browser storage is a localStorage tick list, which is first-party and functional.
n/a legal.documents-published The privacy policy is a real page, linked where data is taken No personal data is collected, so there is no processing to describe. This is an internal review document on a noindex host, not a service.
n/a legal.newsletter-separate Newsletter consent is its own optional checkbox This site has no form of any kind. It collects nothing from a visitor.
n/a legal.no-pii-in-urls No personal data travels in a URL The site has no personal data to put anywhere. No form, no account, no identifier.
n/a legal.no-tags-before-consent No analytics or marketing tag fires before a choice No analytics, no tag container and no cookies of any kind. The only browser storage is a localStorage tick list, which is first-party and functional.
n/a legal.terms-consent-checkbox The terms box starts unchecked and the server enforces it This site has no form of any kind. It collects nothing from a visitor.
n/a onpage.site-identity The site's identity is set on purpose and the share card is seen A noindex site with no Organization node and nothing anyone shares: no tagline field, no sameAs, and a share card nobody renders. The identity is the brand block in the page shell.
n/a ops.cron-runs Scheduled tasks actually fire on the production host No scheduled task exists. Nothing runs on this host between deploys.
n/a ops.db-write-backup No write to a live database without a fresh dump of what it replaces There is no database.
n/a ops.fatal-alerts A fatal error reaches a mailbox somebody actually reads No application, so no fatal to alert on.
n/a perf.image-formats Images ship in a modern format at the size they display No raster images are used. The page is text, borders and one accent colour.
n/a perf.lazy-and-priority Below-the-fold images lazy load, the LCP image does not Same reason. There are no images to lazy load or prioritise.
n/a perf.split-points-asserted Every deliberate split point is asserted in the build The rule applies where a heavy dependency is held off a critical path by a dynamic import. A grep for `import(` across site/src/js returns 0 matches: this site ships one entry with no code splitting at all, so there is no split point for an assertion to guard.
n/a perf.video-weight Video is deferred and never blocks the first paint No background or hero video. The heaviest thing above the fold is a heading, which is also why the LCP rule is cheap to pass here and expensive on the marketing sites this standard is really aimed at.
n/a practices.no-hardcoded-content Editable content is editable, not baked into templates True by construction rather than by effort: no rule text is typed into any template. Every word of the checklists comes from rules/*.yml. Marked n/a because there is no CMS here for an editor to use.
n/a practices.self-cleaning-modules Scripts clean up after themselves on page transition No client-side page transitions. Every link is a real navigation, so nothing accumulates across pages.
n/a practices.soft-navigation-parity A soft navigation leaves the document as a hard load would Every navigation here is a hard load: no client-side router, no swapped container, so the document is always what the server sent.
n/a security.comments-closed Comments are closed at every layer unless the brief asks for them There is no WordPress and no comment system of any kind. Nothing here can be commented on, so there is nothing to close.
n/a security.no-error-disclosure No response leaks a PHP error, a stack trace or a server path No application layer can produce an error page carrying a path or a trace.
n/a security.public-post-rate-limit Login and every public form endpoint are rate limited This site has no form of any kind. It collects nothing from a visitor.
n/a security.rest-route-authorisation No REST route writes without an authorisation check or a stated bound No application endpoints at all. Every URL is a static file.
n/a security.submission-store-private Stored form submissions are unreachable without logging in This site has no form of any kind. It collects nothing from a visitor.
n/a security.upload-types-and-execution Uploads cannot execute, and no script-capable type is allowed Nothing can be uploaded. The document root is static files written by rsync.
n/a security.versions-current Core, plugins, themes and PHP are current, and updates have an owner No CMS, no plugins and no server-side runtime to keep current.
n/a security.wp-attack-surface WordPress's default attack surface is closed at setup No WordPress, and nothing else with an attack surface of this shape. The site is static files written by rsync: no XML-RPC endpoint, no author archives to enumerate, no plugin or theme editor, and no login of any kind on the host.
n/a seo.canonical Every indexable page declares a self-referencing canonical The rule covers indexable pages. Nothing here is indexable, so there is no page for a canonical to point at.
n/a seo.hreflang Multilingual sites declare reciprocal hreflang English only. Worth raising as an offer, since colibrity.com runs fr and en with correct hreflang and a French version of this document is possible.
n/a seo.no-noindex-leak Production is indexable and staging is not The rule asks that production is indexable and staging is not. This is a review artefact with no production stage - it is noindex on every host, permanently and by design, and the decision is environment-driven rather than a checkbox. There is no production site for the indexable half of the rule to be true of.
n/a seo.open-graph Open Graph and Twitter card tags are complete No page here is indexed or meant to be shared, which is the condition the tags serve. Same decision as the noindex waiver below.
n/a seo.sitemap The sitemap lists every indexable URL and nothing else The site is noindex. A sitemap listing noindex URLs contradicts itself.
n/a seo.structured-data Structured data is present, valid and singular Noindex, so there is no rich result for structured data to produce.
n/a states.error-pages A missing URL returns a real 404 in the right language Static hosting with no application layer: there is no code path that can 500. The 404 is the host's.
n/a states.no-js-fallback Content is visible when JavaScript does not run No scroll-triggered animation anywhere.
n/a states.preloader-budget The preloader has a hard cap and a fallback No preloader. Nothing gates the first paint.
n/a states.scroll-reveal-recovery Scroll reveals fire on deep links and on back navigation No scroll-triggered animation anywhere.

Passing

Where a pass needs evidence rather than an assertion, the evidence is named. An unproved pass is what the gate itself calls unverified.

ResultRuleTitleHow it is proved
pass a11y.focus-visible A visible focus indicator on every focusable element One global :focus-visible rule in the base layer, measured at 3:1 on both grounds
pass a11y.form-labels Every form control has a real label Every input on the checklist resolves to a label element or to an existing aria-labelledby target, checked in the built page on 2026-08-23. The tick boxes are named by the rule title they sit against, and the site suite asserts that for every rule. No field here is required, so the required-marking clause added on 2026-09-10 has nothing to mark.
pass a11y.contrast Text and interface contrast meets AA Measured, not eyeballed, and re-measured on 2026-08-25 when the palette moved off Colibrity's magenta. Body text is 17.07:1 on light and 15.28:1 on dark; the worst text pair in either theme is 4.63:1, against the 4.5:1 the rule asks for. The magenta this replaced could not clear 4.5:1 in either theme. Every pair and its ratio is recorded in site/src/css/tokens.css.
pass colibrity.filter-url-state Filters write their state to the URL The five-step procedure at the bottom of the URL-state explainer, run against this page on 2026-08-11: filtering changed location.search, reloading restored the same 3 rules and the same checked boxes, and clearing the search deleted the parameter rather than blanking it.
pass colibrity.filter-history-noise Filter changes do not litter the back button Verified 2026-08-11: five filter changes grew history.length by 0, and one Back press left the page.
pass colibrity.js-hooks-are-data-attributes JavaScript targets data attributes, never CSS classes No selector in site/src/js targets a styling class. Filtering, ticking and the intake all read data- attributes: data-rule, data-dim, data-sev, data-phase, data-verify, data-role, data-owner, data-source, data-kind, data-traits, data-tick, data-group and data-filter.
pass html.doctype-and-lang Doctype and a correct lang attribute on every page All 22 built pages carry the HTML5 doctype and lang="en", checked over the whole output on 2026-08-23. The site is single-language, so the per-page half does not arise.
pass html.single-h1 One h1 per page, and no skipped heading levels Asserted for every built page in the site suite, so a second h1 fails the build, and since 2026-09-10 the suite also asserts no two built pages share an h1.
pass html.landmarks Page regions use landmark elements Exactly one main per page across all 22, every page inside header/nav/main/footer, and the two navs carry distinct accessible names (Sections, About this standard). Checked over the whole output on 2026-08-23.
pass html.lists-and-tables Lists are lists and tables are tables No layout tables; the nine content tables all carry th with scope after the renderer was fixed on 2026-08-23, when a check found 0 of 25 header cells scoped.
pass html.no-duplicate-ids Ids are unique on the rendered page Checked in the live DOM on 2026-08-23 across 69 rows and 220 ids: no duplicate
pass html.no-inline-handlers No inline event handlers or javascript: URLs No on* attribute in any built page, asserted in the test suite
pass perf.lcp LCP at or under 2.5 seconds on mobile 1.5 s against the 2.5 s this rule sets. PageSpeed Insights, mobile, median of three runs on 2026-08-25 with a ?cb= buster, per the method this standard prescribes. Runs: 1.2, 1.5, 1.5. It was 0.9 s on 2026-08-24, and the 0.6 s is the price of the three self-hosted faces the restyle added - recorded rather than quietly dropped, because a measurement that only ever improves is not a measurement. One face is preloaded and the rest swap, so nothing blocks the paint; the score is unchanged at 100 and the budget has a full second in it.
pass perf.cls CLS at or under 0.1 0. Same three runs, and unchanged by the webfonts.
pass perf.inp-tbt TBT at or under 200ms and INP at or under 200ms Total Blocking Time 0 ms. Same three runs.
pass perf.score-floor Mobile performance score at or above 90 100, median of three mobile runs on 2026-08-25 (100, 100, 100).
pass perf.bundle-budgets JavaScript and CSS stay inside their budgets 2.87 kB JS and 5.11 kB CSS gzipped on 2026-08-25, against a 12 kB budget each
pass perf.fonts Fonts are subset woff2, self-hosted, with a swap policy Four woff2 files, self-hosted, measured on the built output 2026-08-25: newsreader-latin 40.5 kB, instrument-sans-latin 29.5 kB, ibm-plex-mono-400 7.9 kB and ibm-plex-mono-600 8.0 kB, against the 100 kB cap. No ttf or otf is served, every face declares font-display swap, and exactly one file is preloaded. Newsreader arrives from Google at 128.8 kB with every optical size; pinning opsz and clamping the weight range to 400-600 is what brought it under the cap - the rule is the reason that step happened.
pass perf.caching-and-compression Static assets are compressed and cached far-future Content-Encoding: gzip confirmed on the live URL, and hashed assets carry a one-year immutable cache header. Compression was off on first deploy and the deploy script's own verification caught it.
pass perf.third-party Third-party scripts are counted and justified Zero third-party origins. The fonts are self-hosted rather than linked from Google, which is what the enforcing CSP requires and what perf.fonts asks for.
pass perf.page-weight Each template has a transfer and DOM budget Waived five times and settled on 2026-08-26 by changing the rule rather than the page, which is the outcome a fifth waiver was evidence for. The element cap is a proxy for main-thread cost; this standard measures that cost directly in perf.inp-tbt, and where a proxy and the thing it stands for disagree, the proxy gives. So the rule now lets a template whose length is set by how much content it holds pass the element half by measurement instead. This site is the first thing measured under it, and it is measured rather than asserted. The checklist renders 4014 elements over 163 rows against a 1400 cap, and PageSpeed Insights mobile, median of three runs against the deployed page on 2026-08-26, reports a total blocking time of 0 ms against the 200 ms this standard sets - the whole budget unspent - with a performance score of 99, LCP 1.7 s and CLS 0. All three runs read 0 ms. Transfer passes with room: 463 kB of HTML, 62 kB gzipped over the wire, against 2 MB. The other pages: the gate 3921 elements, /checklist-map/ 3172, /print/ 2090, /per-page/ 518, /decisions/ 65. Two notes against self-interest. The page got HEAVIER in the same phase that settled the rule, by 184 elements, because a reason on every row is 163 of them - so this is not a change that was paid for by shrinking anything. And an earlier median on the same page that day read 0, 160 and 0 ms; the rule says median rather than best for that reason, and a single run would have failed it. Had the median come out over 200 ms the checklist would have been paginated and the rule left alone. That was the deal, and the measurement decided it rather than a preference.
pass practices.empty-states Every dynamic component handles empty, long and broken Verified 2026-08-11: filtering to zero matches shows a deliberate empty state and the status line reads "Showing 0 of 69 rules".
pass practices.tests-before-deploy The theme's contracts are tests, and a deploy runs them first site/deploy.mjs:58 runs npm test after the site build and before the upload, and a red suite stops the deploy; the suite reads the built pages under site/dist rather than skipping them.
pass seo.title-description Titles and descriptions are present, unique and the right length Every page has a title and its own description, all unique, checked over the whole output on 2026-08-23, and since 2026-09-10 the suite asserts exactly one title, one description and one robots meta per page. Until 2026-08-23 every page shipped the site-wide description, which failed this rule on its uniqueness half.
pass seo.https-and-mixed-content HTTPS is enforced and nothing loads over http No http:// asset URL anywhere in the 22 built pages. The single-hop redirect is checked against the live host by the deploy script after every publish.
pass seo.redirects-on-launch Replaced URLs redirect to their new home This was n/a until 2026-08-23 on the grounds that the site replaced nothing. The restructure that day retired four routes - /front-end/build/, /front-end/gate/ and the two SEO twins - so the rule started applying to this site the moment it published a page that replaced one. Each old route is mapped to its replacement with a single 301 in site/public/.htaccess, and the deploy script asserts each lands on a 200 in exactly one hop rather than a chain.
pass crawl.sibling-hosts Only the production host serves an indexable copy of the site Enumerated 2026-08-23. Two hosts serve this project and neither serves a second indexable copy: standard.tastysites.pl returns 200 with X-Robots-Tag noindex, nofollow, and frontend-standard.tastysites.pl returns a single 301 to it rather than a duplicate. Checked with curl -sI against both, which is the acceptance test the rule names.
pass crawl.content-in-server-html The content that must rank is in the server HTML Every one of the 156 rules is in the HTML before any script runs. site/build.mjs renders the whole checklist at build time and the JavaScript only toggles hidden attributes, so with scripting off the page is complete and what is lost is ticking, not reading.
pass crawl.indexability-decided Every URL-minting template has a recorded index decision One decision, applied twice and agreeing with itself: every page carries meta robots noindex,nofollow and the host sends X-Robots-Tag noindex, nofollow, which also covers the non-HTML routes, the two markdown deliverables, since the header is the host's and not the page's. robots.txt says Allow: / on purpose, because Disallow blocks the fetch rather than the indexing and would stop a crawler ever seeing the noindex.
pass crawl.published-urls-resolve Every published URL answers at its own address Measured 2026-08-25 against the live site, not against the template list. Every one of the 27 built routes was requested and returned 200, with 0 non-200, and so did all 6 absolute internal links found in the built HTML. The site's remaining links are `?rule=` deep links into a page already counted.
pass migration.url-inventory The old site's indexed URLs are counted before anything is built The old routes were enumerated before they were removed, from the build's own page list rather than from memory: four section routes plus fourteen explainers under two section prefixes.
pass migration.redirect-map Every inventoried URL reaches its replacement in one hop Every enumerated route above has a rule in site/public/.htaccess, and the old domain's own .htaccess was retargeted at the same time so it points at the current routes rather than at the ones that existed for twelve hours after the rename. Two redirects in sequence is the thing this rule forbids.
pass onpage.favicon The site ships a favicon Google can crawl An inline SVG data URI in the page shell, so there is no request to 404 - which is the failure this rule exists for, and the one that broke practices.console-clean on this site in August. A vector has no pixel width, so the 48 px floor is met at any size, and a data URI has no path for robots.txt to block.
pass env.deploy-provenance What production is running is a commit you can name site/deploy.mjs refuses to publish from a dirty working tree, then stamps dist/build.json with the commit sha and the rule count. Live at /build.json, currently commit 2f90621 at 156 rules. Thirteen curl checks run against the live URL after the rsync, so a deploy that half-worked fails loudly rather than quietly.
pass ops.deploy-target-pinned A destructive deploy refuses to run against the wrong target The rule was written on 2026-08-25 and this site failed it the same hour: site/deploy.mjs ran rsync -avz --delete at an SSH alias it never resolved, so everything it checked was intent and nothing was destination. It now resolves the alias with `ssh -G` and refuses unless the hostname, the user and the domain all match a pin in the file, on a dry run as well as a live one. Verified by pointing DEPLOY_SSH_HOST at a different alias and watching it exit non-zero before any transfer.
pass security.csp-enforced-baseline A Content-Security-Policy is enforced, not only reported Enforcing, not Report-Only, and stricter than the rule asks. The live response carries default-src, script-src, style-src, img-src, font-src and connect-src all at 'self', plus object-src 'none', base-uri 'self', form-action 'self' and frame-ancestors 'self'. This site can afford the whole policy where a theme cannot: one module script, zero inline script, zero inline style and zero external origins.
pass security.response-headers Every HTML response carries the baseline security headers Measured live on 2026-08-25, after adding them: the response carries X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN, Referrer-Policy strict-origin-when-cross-origin, a Permissions-Policy denying geolocation, camera and microphone, and Strict-Transport-Security at max-age=15552000 - 180 days, with no includeSubDomains because tastysites.pl has siblings this site does not control. HSTS is correctly absent over plain http. The site sent none of these until the rule was written, which is the honest reason this entry is dated today rather than at launch.