@piercebarney/whs-eleventy 2026.9.1 → 2026.9.3

package/lib/_project.js

@@ -22,6 +22,20 @@ function tryProjectRequire(rel, fallback = null) {
   }
 }
 
+// The content-arm -> build-arm escalation drawer (core.md#content-model): one
+// `YYYY-MM-DD-<slug>.md` per blocked structural request, triaged and deleted by
+// the build arm. Returns the open notes' filenames (README.md excluded), sorted.
+function openRequests(root = ROOT) {
+  try {
+    return fs
+      .readdirSync(path.join(root, "requests"))
+      .filter((f) => f.endsWith(".md") && f.toLowerCase() !== "readme.md")
+      .sort();
+  } catch {
+    return [];
+  }
+}
+
 // Locate the standard's text (core.md, CHANGELOG.md) for the drift check:
 //   1. WHS_STANDARD env var (the authoring repo points this at itself)
 //   2. the copy bundled into this package at publish time (standard/)
@@ -39,4 +53,4 @@ function resolveStandard() {
   return null;
 }
 
-module.exports = { ROOT, projectRequire, tryProjectRequire, resolveStandard };
+module.exports = { ROOT, projectRequire, tryProjectRequire, openRequests, resolveStandard };

package/lib/a11y.js

@@ -46,11 +46,19 @@ const getJSON = (url) =>
 function sitemapPaths() {
   const xml = fs.readFileSync(path.join(SITE, "sitemap.xml"), "utf8");
   const paths = [...xml.matchAll(/<loc>([^<]+)<\/loc>/g)].map((m) => new URL(m[1]).pathname);
+  // The audit page and the 404 page are both deliberately excluded from the
+  // sitemap (core.md#sitemap-robots) but are still real pages a visitor
+  // lands on — the a11y Contract says "every page", not "every sitemap
+  // entry", so scan them explicitly.
   paths.push("/audit/");
+  if (fs.existsSync(path.join(SITE, "404.html"))) paths.push("/404.html");
   return [...new Set(paths)];
 }
 
 function connect(wsUrl) {
+  // The global `WebSocket` is stable only from Node 22 — package.json's
+  // `engines.node` reflects that (it does not exist, even unflagged, on
+  // Node 20, which this file used to silently assume it did).
   const ws = new WebSocket(wsUrl);
   let id = 0;
   const pending = {};

package/lib/check-links.js

@@ -125,7 +125,7 @@ function outputHas(urlPath) {
   return fs.existsSync(asFile + "/index.html") || fs.existsSync(asFile + ".html");
 }
 
-function checkRef(file, pageUrl, raw, { external = true } = {}) {
+function checkRef(file, pageUrl, raw, { external = true, isHyperlink = false } = {}) {
   if (!raw) return;
   const v = raw.trim();
   if (v === "" || v.startsWith("data:") || v.startsWith("mailto:") || v.startsWith("tel:")) return;
@@ -140,7 +140,14 @@ function checkRef(file, pageUrl, raw, { external = true } = {}) {
     }
     if (origin === site.url) {
       if (!outputHas(new URL(v).pathname)) err(file, `absolute link to a missing page: ${v}`);
-    } else if (!allowedOrigins.has(origin) && !POLICY_LINK_ORIGINS.has(origin)) {
+    } else if (
+      !allowedOrigins.has(origin) &&
+      // POLICY_LINK_ORIGINS are informational <a> targets that never load a
+      // resource or receive visitor data (see its definition above) — that
+      // exemption applies only to plain hyperlinks, never to a resource
+      // reference (script/link/img/og:image), which does load from the origin.
+      !(isHyperlink && POLICY_LINK_ORIGINS.has(origin))
+    ) {
       err(file, `external origin not in thirdparties.js: ${origin}`);
     }
     return;
@@ -198,7 +205,7 @@ for (const f of htmlFiles) {
 
   root.querySelectorAll("a[href]").forEach((a) => {
     const href = a.getAttribute("href");
-    checkRef(f, pageUrl, href);
+    checkRef(f, pageUrl, href, { isHyperlink: true });
     if (/^https?:\/\//i.test(href || "")) {
       let origin;
       try {
@@ -242,6 +249,31 @@ for (const f of htmlFiles) {
   });
 }
 
+// ---- JS-level origin scan (core.md#third-parties) --------------------------
+// The HTML walk above only ever sees origins referenced in markup — a runtime
+// browser `fetch()`/`new URL()` call baked into a shipped .js file is
+// invisible to it. This is a best-effort literal-string scan (it cannot see a
+// dynamically-built URL), but it catches the common case: a hardcoded
+// external origin in client JS that was never added to the manifest.
+(function checkJsOrigins() {
+  const jsFiles = allFiles.filter((f) => f.endsWith(".js") && !f.endsWith("links-report.json"));
+  const ORIGIN_LITERAL = /(?:fetch|new\s+URL)\s*\(\s*[`'"](https?:\/\/[^`'"\s]+)[`'"]/g;
+  for (const f of jsFiles) {
+    const text = fs.readFileSync(f, "utf8");
+    for (const m of text.matchAll(ORIGIN_LITERAL)) {
+      let origin;
+      try {
+        origin = new URL(m[1]).origin;
+      } catch {
+        continue;
+      }
+      if (origin !== site.url && !allowedOrigins.has(origin)) {
+        err(f, `fetch()/URL() targets an origin not in thirdparties.js: ${origin}`);
+      }
+    }
+  }
+})();
+
 // ---- ads: production-only, ads.txt present (core.md#ads) -------------------
 (function checkAds() {
   const ads = tryProjectRequire("src/_data/ads.js", {});

package/lib/compliance.js

@@ -16,6 +16,7 @@
 const fs = require("node:fs");
 const path = require("node:path");
 const { execSync } = require("node:child_process");
+const { parse: parseHtml } = require("node-html-parser");
 const { runRepoChecks } = require("./doctor.js");
 const { ROOT, resolveStandard } = require("./_project.js");
 
@@ -86,13 +87,23 @@ const loadDoctor = () => {
   doc = {};
   for (const c of runRepoChecks({ preflight: false })) doc[c.id] = c;
 };
-const fromDoctor = (id, extra = "") => {
+// `strict: true` is for chapters whose Contract has no "advisory" reading —
+// doctor's own "warn" severity is right for its own informational printing,
+// but a compliance chapter reporting MANUAL for "no CSP at all" or "wrong
+// Node" hides a real, mechanically-known violation from `--strict`. Only the
+// compliance view remaps warn -> FAIL; doctor.js's own severity is untouched.
+const fromDoctor = (id, extra = "", { strict = false, missingIsFail = false } = {}) => {
   const c = doc[id];
-  if (!c) return { status: MANUAL, note: `doctor check ${id} not found` };
-  return {
-    status: c.severity === "ok" ? PASS : c.severity === "blocker" ? FAIL : MANUAL,
-    note: [c.detail, extra].filter(Boolean).join(" · "),
-  };
+  if (!c) {
+    return missingIsFail
+      ? {
+          status: FAIL,
+          note: [`doctor check ${id} could not run`, extra].filter(Boolean).join(" · "),
+        }
+      : { status: MANUAL, note: `doctor check ${id} not found` };
+  }
+  const status = c.severity === "ok" ? PASS : c.severity === "blocker" || strict ? FAIL : MANUAL;
+  return { status, note: [c.detail, extra].filter(Boolean).join(" · ") };
 };
 
 // ---- per-chapter checks ------------------------------------------------
@@ -115,6 +126,11 @@ const CHECKS = {
   "runtime-pin": () => {
     if (/NODE_VERSION/.test(read("netlify.toml") || ""))
       return { status: FAIL, note: "NODE_VERSION in netlify.toml — use .nvmrc" };
+    if (!has(".nvmrc"))
+      return { status: FAIL, note: ".nvmrc missing — no single pinned runtime version" };
+    // A running-Node/.nvmrc major mismatch is a MANUAL judgment (the developer's
+    // local shell may just not have `nvm use`'d yet) — everything else about the
+    // pin (single source, present) is mechanically FAIL-able.
     return fromDoctor("nvmrc-node");
   },
 
@@ -136,7 +152,9 @@ const CHECKS = {
     }
     const protocol =
       has("CONTENT.md") && /"content-check"/.test(read("package.json") || "")
-        ? "agent content-ops protocol present"
+        ? has("requests")
+          ? "agent content-ops protocol present (CONTENT.md, content-check, requests/)"
+          : "CONTENT.md + content-check present, but no requests/ escalation drawer"
         : "no CONTENT.md / content-check — add it if content is agent-edited";
     return {
       status: MANUAL,
@@ -146,7 +164,22 @@ const CHECKS = {
 
   rendering: () => {
     if (!has("src/404.njk")) return { status: FAIL, note: "no src/404.njk" };
-    return { status: PASS, note: "server-rendered HTML; 404 page present" };
+    // A page whose <main> is empty/near-empty in the built output is the
+    // classic "content only appears after client JS runs" regression the
+    // Contract forbids — a crude but real content-presence check, distinct
+    // from merely confirming a 404 template exists.
+    const thin = siteHtml().filter((f) => {
+      const root = parseHtml(fs.readFileSync(f, "utf8"));
+      const main = root.querySelector("main");
+      const text = (main ? main.text : root.text || "").replace(/\s+/g, " ").trim();
+      return text.length < 40;
+    });
+    if (thin.length)
+      return {
+        status: FAIL,
+        note: `${thin.length} page(s) with near-empty <main> — content may be client-rendered only`,
+      };
+    return { status: PASS, note: "server-rendered HTML with real content; 404 page present" };
   },
 
   assets: () => {
@@ -223,20 +256,44 @@ const CHECKS = {
   },
 
   "og-image": () => {
-    let bad = 0;
+    // PNG IHDR: an 8-byte signature, then a 4-byte length + "IHDR" + a
+    // 4-byte width + 4-byte height, big-endian, at fixed offsets — no decoder
+    // dependency needed to read just the dimensions.
+    const pngSize = (rel) => {
+      let buf;
+      try {
+        buf = fs.readFileSync(path.join(ROOT, rel));
+      } catch {
+        return null;
+      }
+      if (buf.length < 24 || buf.toString("ascii", 12, 16) !== "IHDR") return null;
+      return { width: buf.readUInt32BE(16), height: buf.readUInt32BE(20) };
+    };
+    const bad = [];
     for (const f of siteHtml()) {
+      const rel = path.relative(ROOT, f);
       const m = fs
         .readFileSync(f, "utf8")
         .match(/property="og:image" content="[^"]*?\/og\/([^"]+?)\.png"/);
       if (!m) {
-        bad++;
+        bad.push(`${rel} (no og:image)`);
         continue;
       }
-      if (!has(`_site/og/${m[1]}.png`)) bad++;
+      const cardRel = `_site/og/${m[1]}.png`;
+      if (!has(cardRel)) {
+        bad.push(`${rel} (${cardRel} missing)`);
+        continue;
+      }
+      const dims = pngSize(cardRel);
+      if (!dims || dims.width !== 1200 || dims.height !== 630) {
+        bad.push(
+          `${rel} (${cardRel} is ${dims ? `${dims.width}x${dims.height}` : "not a PNG"}, not 1200x630)`,
+        );
+      }
     }
-    return bad
-      ? { status: FAIL, note: `${bad} page(s) with a missing/!1200x630 og:image` }
-      : { status: PASS, note: "every og:image resolves" };
+    return bad.length
+      ? { status: FAIL, note: `${bad.length} page(s): ${bad.slice(0, 5).join("; ")}` }
+      : { status: PASS, note: "every og:image resolves at 1200x630" };
   },
 
   "structured-data": () => {
@@ -258,11 +315,31 @@ const CHECKS = {
     };
   },
 
-  noindex: () =>
-    fromDoctor(
-      "prod-indexable",
-      "DEPLOY_TARGET unset => noindex present (verified in check-links)",
-    ),
+  noindex: () => {
+    // doctor's `prod-indexable` repo-tier check only *describes* the built
+    // output's current noindex state — it does not judge it (that's what
+    // `--deploy-preflight` is for). Judging the actual Contract — "a
+    // non-production build always carries noindex" — needs its own check
+    // here: verify the SOURCE gate exists (independent of whichever build
+    // happens to be sitting in _site/), and additionally check the built
+    // output when we can tell which target it was built for.
+    const layout = read("src/_includes/layout.njk") || "";
+    const robots = read("src/robots.njk") || "";
+    if (!/build\.isProduction/.test(layout) || !/noindex/i.test(layout))
+      return { status: FAIL, note: "layout.njk has no build.isProduction-gated noindex meta" };
+    if (!/build\.isProduction/.test(robots))
+      return { status: FAIL, note: "robots.njk Disallow is not keyed on build.isProduction" };
+    const home = read("_site/index.html");
+    if (home !== null && process.env.DEPLOY_TARGET !== "production") {
+      const indexable = !/<meta[^>]+name=["']robots["'][^>]+noindex/i.test(home);
+      if (indexable)
+        return {
+          status: FAIL,
+          note: "_site/index.html is indexable but DEPLOY_TARGET is not production",
+        };
+    }
+    return { status: PASS, note: "layout.njk + robots.njk gate on build.isProduction" };
+  },
 
   "brand-source": () => {
     // Per the standard: grep src/, static/style.css, scripts/og-card.js|icons.js.
@@ -302,8 +379,19 @@ const CHECKS = {
     return { status: PASS, note: "noindex; show-all toggle; all tabs present" };
   },
 
-  "security-headers": () =>
-    fromDoctor("security-headers", doc["csp-thirdparties"] ? doc["csp-thirdparties"].detail : ""),
+  "security-headers": () => {
+    if (!has("netlify.toml"))
+      return { status: FAIL, note: "no netlify.toml — no security headers declared" };
+    // A missing/incomplete header set, or a CSP that grants an origin outside
+    // the declared manifest, are mechanically-known Contract violations, not
+    // judgment calls — FAIL them rather than leaving them an invisible-to
+    // ---strict MANUAL.
+    const headers = fromDoctor("security-headers", "", { strict: true, missingIsFail: true });
+    const csp = fromDoctor("csp-thirdparties", "", { strict: true, missingIsFail: true });
+    if (headers.status === FAIL) return headers;
+    if (csp.status === FAIL) return csp;
+    return { status: PASS, note: [headers.note, csp.note].filter(Boolean).join(" · ") };
+  },
 
   caching: () => {
     const toml = read("netlify.toml") || "";
@@ -326,14 +414,22 @@ const CHECKS = {
   },
 
   privacy: () => {
-    const p = read("src/privacy.njk") || "";
-    if (!has("src/privacy.njk")) return { status: FAIL, note: "no privacy page" };
-    if (!/for\s+t\s+in\s+thirdparties/.test(p))
+    // The privacy page may be a standalone src/privacy.njk or a pages.json
+    // entry rendered by a src/pages/ shell — check the built output, with a
+    // source fallback for when _site isn't built yet.
+    const built = has("_site/privacy/index.html");
+    const source =
+      has("src/privacy.njk") ||
+      /["']slug["']\s*:\s*["']privacy["']/.test(read("src/content/pages.json") || "");
+    if (!built && !source) return { status: FAIL, note: "no privacy page" };
+    // The third-party disclosure must be generated from _data/thirdparties.js,
+    // never hand-maintained — the loop lives in the privacy shell or an include.
+    if (grepSrc(/for\s+t\s+in\s+thirdparties/).length === 0)
       return {
         status: FAIL,
         note: "privacy third-party list not rendered from _data/thirdparties.js",
       };
-    return { status: PASS, note: "third-party list rendered from the manifest" };
+    return { status: PASS, note: "privacy page present; third-party list from the manifest" };
   },
 
   ads: () => {
@@ -353,7 +449,11 @@ const CHECKS = {
       };
     // Real ad CODE (not a bare origin string the audit page shows as data).
     const AD_CODE = /adsbygoogle\.js|<ins[^>]+adsbygoogle|google-adsense-account/;
-    const prod = doc["prod-indexable"] && /indexable/.test(doc["prod-indexable"].detail || "");
+    // Read the built output directly rather than regex-matching another
+    // check's human-readable detail string — the same source check-links.js
+    // and the noindex check above use.
+    const home = read("_site/index.html");
+    const prod = home !== null && !/<meta[^>]+name=["']robots["'][^>]+noindex/i.test(home);
     const leak = siteHtml().filter((f) => AD_CODE.test(fs.readFileSync(f, "utf8")));
     if (!prod && leak.length)
       return { status: FAIL, note: `ad code in ${leak.length} non-production page(s)` };
@@ -371,13 +471,21 @@ const CHECKS = {
   },
 
   forms: () => {
-    const layout = read("src/_includes/layout.njk") || "";
+    // A form can live anywhere in the built output, not only in layout.njk
+    // (a contact page's own template, say) — scan every page, and treat "no
+    // form anywhere" as N/A rather than a false FAIL on a site that has none.
+    const pagesWithForms = siteHtml().filter((f) => /<form[\s>]/i.test(fs.readFileSync(f, "utf8")));
+    if (!pagesWithForms.length) return { status: NA, note: "no <form> in the built output" };
+    const hasHoneypot = pagesWithForms.some((f) =>
+      /netlify-honeypot|name="bot-field"/.test(fs.readFileSync(f, "utf8")),
+    );
+    if (!hasHoneypot) return { status: FAIL, note: "no honeypot field in the form" };
     const handlers = grepSrc(/addEventListener\(["']submit["']/, [".js"]);
-    if (!/netlify-honeypot|name="bot-field"/.test(layout))
-      return { status: FAIL, note: "no honeypot field in the form" };
     if (handlers.length > 1)
       return { status: FAIL, note: `submit handler in ${handlers.length} files — consolidate` };
-    return { status: PASS, note: "one handler in site.js; honeypot present" };
+    if (handlers.length === 0)
+      return { status: FAIL, note: "a form exists but no submit handler was found" };
+    return { status: PASS, note: "one handler; honeypot present" };
   },
 
   "domain-tests": () => {
@@ -404,13 +512,18 @@ const CHECKS = {
     };
   },
 
-  "the-gate": () =>
-    fromDoctor(
-      "gate-stages",
-      /doctor|compliance/.test(JSON.parse(read("package.json")).scripts.check)
-        ? "doctor/compliance leaked into check"
-        : "doctor + compliance kept out",
-    ),
+  "the-gate": () => {
+    // A gate missing a stage (e.g. a11y quietly dropped from `check`) is a
+    // mechanically-known Contract violation — FAIL it, don't bury it in MANUAL.
+    const leaked = /doctor|compliance/.test(
+      (JSON.parse(read("package.json") || "{}").scripts || {}).check || "",
+    );
+    if (leaked) return { status: FAIL, note: "doctor/compliance leaked into `npm run check`" };
+    return fromDoctor("gate-stages", "doctor + compliance kept out", {
+      strict: true,
+      missingIsFail: true,
+    });
+  },
 
   compliance: () => {
     const pkg = JSON.parse(read("package.json") || "{}");
@@ -564,7 +677,20 @@ function changelogSlugs(changelog, pin) {
     const coreM = line.match(/^###\s+core:\s+(.+)/);
     if (coreM) {
       for (const part of coreM[1].split(/[·,]/)) {
-        const slug = (part.trim().match(/^[a-z0-9-]+/) || [])[0];
+        // Strip wrapping punctuation a heading can carry — `(a, b, c)`
+        // splits into parts like `(a` and `c)` — before matching, or the
+        // leading "(" makes the slug regex miss the first entry entirely.
+        const cleaned = part.trim().replace(/^[^a-z0-9]+|[^a-z0-9]+$/gi, "");
+        if (!cleaned) continue;
+        if (/^all$/i.test(cleaned)) {
+          // "### core: all" (the initial-split entry) means every chapter,
+          // not a literal slug named "all" — the registry has no such slug,
+          // so emitting it as one would print a `MANUAL: re-check #all` row
+          // that looks real but isn't.
+          slugs.add("(all core chapters)");
+          continue;
+        }
+        const slug = (cleaned.match(/^[a-z0-9-]+/) || [])[0];
         if (slug) slugs.add(slug);
       }
     }
@@ -674,4 +800,6 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { runCompliance, summarize, changelogSlugs };
+// CHECKS is exported for the "coverage" test — nothing else should read it as
+// data (call runCompliance() for results).
+module.exports = { runCompliance, summarize, changelogSlugs, CHECKS };

package/lib/content-check.js

@@ -4,42 +4,94 @@
 //
 //   whs content-check
 //
-// Also warns — does not block — when the working tree has changes outside the
-// content set, so a stray code edit doesn't ride along in a `content:` commit.
+// A **staged** file outside the reserved content set is an error — a `content:`
+// commit can't carry a code/structure change. An unstaged stray only warns (it
+// won't be in the commit unless staged). Also reports the open requests/ notes
+// (the content-arm → build-arm escalation channel, core.md#content-model).
 
 const { execSync } = require("node:child_process");
+const { openRequests } = require("./_project.js");
 
-// Files an agent following CONTENT.md is expected to touch.
-const CONTENT_SET = [/^src\/content\//, /^src\/_data\/nav\.js$/, /^src\/_data\/glossary\.js$/];
+// Files an agent following CONTENT.md may touch — the reserved content set plus
+// its own escalation drawer. Everything else (the *.schema.json editor aids,
+// schema.js, the page shells, the includes, config) is a build-arm change.
+const RESERVED_SET = [
+  /^src\/content\/(?!.*\.schema\.json$)[^/]+\.json$/,
+  /^src\/_data\/nav\.js$/,
+  /^src\/_data\/glossary\.js$/,
+  /^requests\//,
+];
 
-function changedFiles() {
+// One `git status --porcelain` line → { path, staged }. `staged` is true when
+// the index column (X) holds a real status letter — i.e. the change is part of
+// the next commit. Untracked ("??") and worktree-only (" M") are not staged.
+function parsePorcelain(out) {
+  return out
+    .split("\n")
+    .filter(Boolean)
+    .map((l) => {
+      const x = l[0];
+      const rest = l.slice(3);
+      const path = rest.includes(" -> ") ? rest.split(" -> ")[1] : rest;
+      return { path: path.trim(), staged: x !== " " && x !== "?" };
+    });
+}
+
+function changedEntries() {
   try {
-    const out = execSync("git status --porcelain", { encoding: "utf8" });
-    return out
-      .split("\n")
-      .map((l) => l.slice(3).trim())
-      .filter(Boolean)
-      .map((f) => (f.includes(" -> ") ? f.split(" -> ")[1] : f));
+    return parsePorcelain(execSync("git status --porcelain", { encoding: "utf8" }));
   } catch {
     return [];
   }
 }
 
-const stray = changedFiles().filter((f) => !CONTENT_SET.some((re) => re.test(f)));
-if (stray.length) {
-  console.warn("\n⚠  changes outside the content set — these are code changes, not content:");
-  for (const f of stray) console.warn(`     ${f}`);
-  console.warn("   Commit them separately (a Claude Code task), or confirm they're intentional.\n");
+function strayFiles(paths) {
+  return paths.filter((f) => !RESERVED_SET.some((re) => re.test(f)));
 }
 
-const steps = ["lint", "validate", "build", "links"];
-for (const s of steps) {
-  process.stdout.write(`content-check: npm run ${s}\n`);
-  try {
-    execSync(`npm run ${s}`, { stdio: "inherit" });
-  } catch {
-    console.error(`\ncontent-check: '${s}' failed — fix it before committing.`);
+function splitStray(entries) {
+  return {
+    staged: strayFiles(entries.filter((e) => e.staged).map((e) => e.path)),
+    unstaged: strayFiles(entries.filter((e) => !e.staged).map((e) => e.path)),
+  };
+}
+
+function main() {
+  const { staged: stagedStray, unstaged: unstagedStray } = splitStray(changedEntries());
+
+  if (stagedStray.length) {
+    console.error("\n✗ staged changes outside the reserved content set (CONTENT.md):");
+    for (const f of stagedStray) console.error(`     ${f}`);
+    console.error(
+      "\n  A `content:` commit can't carry a code or structure change. Unstage them\n" +
+        "  (git restore --staged <file>), or file a requests/ note for the build arm.\n",
+    );
     process.exit(1);
   }
+  if (unstagedStray.length) {
+    console.warn("\n⚠  uncommitted changes outside the reserved set (not staged):");
+    for (const f of unstagedStray) console.warn(`     ${f}`);
+    console.warn("   They won't ride a `content:` commit unless you stage them.\n");
+  }
+
+  const reqs = openRequests();
+  if (reqs.length) {
+    console.log(`\nℹ  ${reqs.length} open request(s) in requests/ awaiting the build arm.\n`);
+  }
+
+  const steps = ["lint", "validate", "build", "links"];
+  for (const s of steps) {
+    process.stdout.write(`content-check: npm run ${s}\n`);
+    try {
+      execSync(`npm run ${s}`, { stdio: "inherit" });
+    } catch {
+      console.error(`\ncontent-check: '${s}' failed — fix it before committing.`);
+      process.exit(1);
+    }
+  }
+  console.log("\ncontent-check: ok — lint · validate · build · links");
 }
-console.log("\ncontent-check: ok — lint · validate · build · links");
+
+module.exports = { strayFiles, parsePorcelain, splitStray, RESERVED_SET };
+
+if (require.main === module) main();

package/lib/doctor.js

@@ -21,7 +21,8 @@
 const fs = require("node:fs");
 const path = require("node:path");
 const { execSync } = require("node:child_process");
-const { ROOT, projectRequire } = require("./_project.js");
+const { ROOT, projectRequire, openRequests } = require("./_project.js");
+const { asRegexMap } = require("./header-expect.js");
 
 const CACHE = path.join(ROOT, ".cache", "doctor.json");
 
@@ -30,14 +31,9 @@ const CACHE = path.join(ROOT, ".cache", "doctor.json");
 const loadSite = () => projectRequire("src/_data/site.js");
 const loadThirdparties = () => projectRequire("src/_data/thirdparties.js");
 
-// Live values expected on every response — same patterns the /audit/ page uses.
-const HEADER_EXPECT = {
-  "Content-Security-Policy": /default-src 'self'/,
-  "X-Content-Type-Options": /nosniff/,
-  "X-Frame-Options": /DENY|SAMEORIGIN/,
-  "Referrer-Policy": /strict-origin/,
-  "Permissions-Policy": /geolocation=\(\)/,
-};
+// Expected header value patterns — the single source (header-expect.js) also
+// feeds the /audit/ page's live-header check via _data/headerExpect.js.
+const HEADER_EXPECT = asRegexMap();
 
 const GATE_STAGES = ["lint", "validate", "test", "build", "links", "a11y"];
 
@@ -380,6 +376,26 @@ function main() {
   }
 
   if (preflight) {
+    // Open content-arm → build-arm requests gate the deploy: a conditional
+    // hard stop (core.md#content-model). Zero → ship; one or more → refuse
+    // unless --ack-requests says the operator has reviewed them.
+    const reqs = openRequests();
+    if (reqs.length && !args.includes("--ack-requests")) {
+      console.error(
+        `\ndoctor: ${reqs.length} open request(s) in requests/ — the content arm is ` +
+          `waiting on\nthe build arm. Clear them, or re-run the deploy with ` +
+          `--ack-requests to ship anyway:`,
+      );
+      reqs.forEach((r) => console.error(`  - requests/${r}`));
+      console.error("\nRefusing to continue.");
+      process.exit(1);
+    }
+    console.log(
+      reqs.length
+        ? `\nOpen requests: ${reqs.length} — acknowledged (--ack-requests).`
+        : "\nOpen requests: 0.",
+    );
+
     const cr = complianceRegressions();
     if (!cr.checked) {
       console.log(

package/lib/header-expect.js

@@ -0,0 +1,34 @@
+// The baseline security-header value patterns (core.md#security-headers),
+// shared by two runtimes that can't `require()` each other:
+//   - doctor.js (Node) — reads them against the netlify.toml *declaration*.
+//   - the audit page's static/audit.js (browser) — reads them against the
+//     *live* response headers on `/`.
+// Regex patterns are kept as source strings, not RegExp objects, so this one
+// array can cross the Node -> build-data -> browser boundary as JSON (a
+// project's `_data/headerExpect.js` re-exports this; audit.njk embeds it as
+// an inline JSON block; static/audit.js reads that instead of hardcoding its
+// own copy). Changing an expected value here changes both checks at once.
+
+const HEADER_EXPECT = [
+  ["content-security-policy", "default-src 'self'"],
+  ["x-content-type-options", "nosniff"],
+  ["x-frame-options", "DENY|SAMEORIGIN"],
+  ["referrer-policy", "strict-origin"],
+  ["permissions-policy", "geolocation=\\(\\)"],
+];
+
+// Node-side convenience: the same list as compiled RegExp objects, keyed by
+// the doctor.js header-name casing it already uses.
+function asRegexMap() {
+  const map = {};
+  for (const [key, pattern] of HEADER_EXPECT) {
+    const headerName = key
+      .split("-")
+      .map((w) => w[0].toUpperCase() + w.slice(1))
+      .join("-");
+    map[headerName] = new RegExp(pattern);
+  }
+  return map;
+}
+
+module.exports = { HEADER_EXPECT, asRegexMap };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piercebarney/whs-eleventy",
-  "version": "2026.9.1",
+  "version": "2026.9.3",
   "description": "The web house style's Eleventy + Netlify tooling — the compliance sweep, the infra doctor, the link/CSP integrity check, and the a11y scan, shared by every project on the stack.",
   "bin": {
     "whs": "cli.js"
@@ -28,7 +28,7 @@
     "directory": "packages/whs-eleventy"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "dependencies": {
     "axe-core": "^4.13.0",