npm - @piercebarney/whs-eleventy - Versions diffs - 2026.9.1 - Mend

@piercebarney/whs-eleventy 2026.9.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (12) hide show

package/README.md +61 -0
package/cli.js +55 -0
package/lib/_project.js +42 -0
package/lib/a11y.js +178 -0
package/lib/check-links.js +288 -0
package/lib/compliance.js +677 -0
package/lib/content-check.js +45 -0
package/lib/doctor.js +416 -0
package/package.json +44 -0
package/scripts/bundle-standard.js +35 -0
package/standard/CHANGELOG.md +625 -0
package/standard/core.md +1493 -0

package/lib/compliance.js ADDED Viewed

@@ -0,0 +1,677 @@
+// Codebase-vs-standard conformance (core.md#compliance). One PASS / FAIL /
+// MANUAL / N/A per chapter of the web house style — the drift-and-completeness
+// sweep that `npm run check` (regressions only) does not do.
+//
+//   whs compliance            print the grid + summary
+//   whs compliance --strict   exit 1 if any chapter is FAIL
+//
+// NOT part of `npm run check`: a FAIL is a migration backlog item, not a
+// regression. `_data/infra.js` reads the cache this writes for the /audit/
+// Compliance tab; `bin/deploy` diffs it against .cache/compliance-last.json and
+// warns on any PASS -> FAIL since the last deploy.
+//
+// Reuses doctor.js (repo introspection) and check-links.js's output
+// (_site/links-report.json) rather than re-implementing either.
+const fs = require("node:fs");
+const path = require("node:path");
+const { execSync } = require("node:child_process");
+const { runRepoChecks } = require("./doctor.js");
+const { ROOT, resolveStandard } = require("./_project.js");
+const SITE = path.join(ROOT, "_site");
+const CACHE = path.join(ROOT, ".cache", "compliance.json");
+// The standard's text — WHS_STANDARD, this package's bundled copy, or the legacy
+// ~/.claude symlink. null when none of them resolves (drift then reports MANUAL).
+const STANDARD = resolveStandard();
+const PASS = "PASS";
+const FAIL = "FAIL";
+const MANUAL = "MANUAL";
+const NA = "N/A";
+function read(rel, base = ROOT) {
+  try {
+    return fs.readFileSync(path.join(base, rel), "utf8");
+  } catch {
+    return null;
+  }
+}
+const has = (rel, base = ROOT) => fs.existsSync(path.join(base, rel));
+function walk(dir) {
+  const out = [];
+  if (!fs.existsSync(dir)) return out;
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) out.push(...walk(p));
+    else out.push(p);
+  }
+  return out;
+}
+// grep the tracked source tree (not _site, not node_modules).
+function grepSrc(re, exts = [".js", ".njk", ".css", ".json"]) {
+  const roots = ["src", "static", "scripts"].map((d) => path.join(ROOT, d));
+  const hits = [];
+  for (const r of roots) {
+    for (const f of walk(r)) {
+      if (!exts.includes(path.extname(f))) continue;
+      const t = fs.readFileSync(f, "utf8");
+      if (re.test(t)) hits.push(path.relative(ROOT, f));
+    }
+  }
+  return hits;
+}
+// Content pages — excludes the audit tool page (its own <head>, noindex).
+const siteHtml = () =>
+  walk(SITE)
+    .filter((f) => f.endsWith(".html"))
+    .filter((f) => !f.endsWith(path.join("audit", "index.html")));
+// ---- CLAUDE.md House-style keys -----------------------------------------
+const claudeMd = read("CLAUDE.md") || "";
+const adsMode = (claudeMd.match(/^-?\s*ads:\s*(\S+)/m) || [])[1] || "none";
+const contentType = (claudeMd.match(/^-?\s*content-type:\s*(\S+)/m) || [])[1] || "tool";
+const aiMode = (claudeMd.match(/^-?\s*ai:\s*(\S+)/m) || [])[1] || "none";
+// ---- doctor repo checks, indexed --------------------------------------
+// Populated by runCompliance() (not on import — the checks read the project
+// tree, which isn't there when this module is required only for its API).
+let doc = {};
+const loadDoctor = () => {
+  doc = {};
+  for (const c of runRepoChecks({ preflight: false })) doc[c.id] = c;
+};
+const fromDoctor = (id, extra = "") => {
+  const c = doc[id];
+  if (!c) return { status: MANUAL, note: `doctor check ${id} not found` };
+  return {
+    status: c.severity === "ok" ? PASS : c.severity === "blocker" ? FAIL : MANUAL,
+    note: [c.detail, extra].filter(Boolean).join(" · "),
+  };
+};
+// ---- per-chapter checks ------------------------------------------------
+// Each returns { status, note }. Keep them mechanical; hand judgement to MANUAL.
+const CHECKS = {
+  "repo-hygiene": () => {
+    const docs = ["README.md", "CLAUDE.md"].filter((f) => has(f));
+    if (has("PROJECT.md"))
+      return { status: FAIL, note: "PROJECT.md present (should be folded into CLAUDE.md)" };
+    if (docs.length < 2) return { status: FAIL, note: "expected README.md + CLAUDE.md" };
+    if (!has("package-lock.json")) return { status: FAIL, note: "package-lock.json not committed" };
+    const branch = execSync("git rev-parse --abbrev-ref HEAD", {
+      cwd: ROOT,
+      encoding: "utf8",
+    }).trim();
+    return { status: PASS, note: `2 docs, lockfile committed, on ${branch}` };
+  },
+  "runtime-pin": () => {
+    if (/NODE_VERSION/.test(read("netlify.toml") || ""))
+      return { status: FAIL, note: "NODE_VERSION in netlify.toml — use .nvmrc" };
+    return fromDoctor("nvmrc-node");
+  },
+  "config-idiom": () => {
+    if (has(".eleventy.js")) return { status: FAIL, note: ".eleventy.js — use eleventy.config.js" };
+    if (has("public")) return { status: FAIL, note: "public/ dir — reserved by Eleventy" };
+    return { status: PASS, note: "eleventy.config.js; no reserved dir names" };
+  },
+  "content-model": () => {
+    if (!has("src/content") || !has("src/content/schema.js"))
+      return { status: FAIL, note: "src/content/*.json + schema.js expected" };
+    if (!/validateAll|readAndValidate/.test(read("eleventy.config.js") || ""))
+      return { status: FAIL, note: "eleventy.before does not call the validator" };
+    try {
+      execSync("npm run validate", { cwd: ROOT, stdio: "ignore" });
+    } catch {
+      return { status: FAIL, note: "npm run validate exits non-zero" };
+    }
+    const protocol =
+      has("CONTENT.md") && /"content-check"/.test(read("package.json") || "")
+        ? "agent content-ops protocol present"
+        : "no CONTENT.md / content-check — add it if content is agent-edited";
+    return {
+      status: MANUAL,
+      note: `validator wired + green; ${protocol}; confirm page prose lives in content/*.json, not templates`,
+    };
+  },
+  rendering: () => {
+    if (!has("src/404.njk")) return { status: FAIL, note: "no src/404.njk" };
+    return { status: PASS, note: "server-rendered HTML; 404 page present" };
+  },
+  assets: () => {
+    const toml = read("netlify.toml") || "";
+    if (!/for = "\/site\.webmanifest"[\s\S]*?application\/manifest\+json/.test(toml))
+      return { status: FAIL, note: "site.webmanifest not served as application/manifest+json" };
+    const fontFiles = walk(path.join(ROOT, "static")).filter((f) => /\.(woff2?|ttf|otf)$/.test(f));
+    if (fontFiles.length && !grepSrc(/@font-face/, [".css"]).length)
+      return { status: FAIL, note: `${fontFiles.length} font file(s) but no @font-face` };
+    return {
+      status: PASS,
+      note: fontFiles.length
+        ? "self-hosted fonts with @font-face; manifest content-type set"
+        : "self-contained; system font stack; manifest content-type set",
+    };
+  },
+  styling: () => {
+    const shift = grepSrc(/style=(["']).*?\1/, [".njk"]);
+    return shift.length
+      ? { status: FAIL, note: `inline style= in ${shift.join(", ")}` }
+      : { status: PASS, note: "Pico classes + one project stylesheet; no inline style=" };
+  },
+  "client-logic": () => {
+    // executable inline <script> only — JSON-LD (type="application/ld+json") is data.
+    const re =
+      /<script(?![^>]*\ssrc=)(?![^>]*type=["'](?:application\/ld\+json|application\/json)["'])[^>]*>[\s\S]*?\S[\s\S]*?<\/script>/i;
+    const inline = siteHtml().filter((f) => re.test(fs.readFileSync(f, "utf8")));
+    if (inline.length) return { status: FAIL, note: `inline <script> in ${inline.length} page(s)` };
+    return {
+      status: PASS,
+      note: "loaded modules; calc wiring in a typeof-document block; no inline script",
+    };
+  },
+  theme: () => {
+    if (!has("static/theme-init.js")) return { status: FAIL, note: "no static/theme-init.js" };
+    if (!/src="\/theme-init\.js"/.test(read("src/_includes/layout.njk") || ""))
+      return { status: FAIL, note: "layout.njk does not load /theme-init.js" };
+    return { status: PASS, note: "anti-FOUC init is a loaded file" };
+  },
+  "seo-urls": () => {
+    const readers = grepSrc(/process\.env/, [".js", ".njk"]).filter((f) => f.startsWith("src/"));
+    if (readers.length !== 1 || readers[0] !== "src/_data/build.js")
+      return {
+        status: FAIL,
+        note: `process.env readers under src/: ${readers.join(", ") || "none"}`,
+      };
+    const bad = siteHtml().filter((f) => {
+      const m = fs.readFileSync(f, "utf8").match(/<link rel="canonical" href="([^"]+)"/);
+      return m && !m[1].startsWith("https://");
+    });
+    return bad.length
+      ? { status: FAIL, note: `${bad.length} non-absolute canonical(s)` }
+      : { status: PASS, note: "single process.env reader; canonicals absolute" };
+  },
+  "seo-meta": () => {
+    const need = [
+      'property="og:title"',
+      'property="og:image"',
+      'name="twitter:card"',
+      'name="twitter:image"',
+    ];
+    const miss = siteHtml().filter((f) => {
+      const t = fs.readFileSync(f, "utf8");
+      return need.some((n) => !t.includes(n));
+    });
+    return miss.length
+      ? { status: FAIL, note: `${miss.length} page(s) missing an OG/Twitter tag` }
+      : { status: PASS, note: `full OG + Twitter set on ${siteHtml().length} pages` };
+  },
+  "og-image": () => {
+    let bad = 0;
+    for (const f of siteHtml()) {
+      const m = fs
+        .readFileSync(f, "utf8")
+        .match(/property="og:image" content="[^"]*?\/og\/([^"]+?)\.png"/);
+      if (!m) {
+        bad++;
+        continue;
+      }
+      if (!has(`_site/og/${m[1]}.png`)) bad++;
+    }
+    return bad
+      ? { status: FAIL, note: `${bad} page(s) with a missing/!1200x630 og:image` }
+      : { status: PASS, note: "every og:image resolves" };
+  },
+  "structured-data": () => {
+    const miss = siteHtml().filter(
+      (f) => !/application\/ld\+json/.test(fs.readFileSync(f, "utf8")),
+    );
+    return miss.length
+      ? { status: FAIL, note: `${miss.length} page(s) with no JSON-LD` }
+      : { status: PASS, note: "≥1 JSON-LD block per page (check-links validates @type)" };
+  },
+  "sitemap-robots": () => {
+    if (!has("_site/sitemap.xml") || !has("_site/robots.txt"))
+      return { status: FAIL, note: "sitemap.xml / robots.txt missing from output" };
+    const feed = contentType === "article";
+    return {
+      status: PASS,
+      note: `sitemap + robots present${feed ? "" : "; no feed (content-type: tool)"}`,
+    };
+  },
+  noindex: () =>
+    fromDoctor(
+      "prod-indexable",
+      "DEPLOY_TARGET unset => noindex present (verified in check-links)",
+    ),
+  "brand-source": () => {
+    // Per the standard: grep src/, static/style.css, scripts/og-card.js|icons.js.
+    // A colour literal, or a `font-family:` that isn't a var()/token reference.
+    const targets = ["static/style.css", "scripts/og-card.js", "scripts/icons.js"]
+      .concat(walk(path.join(ROOT, "src")).map((f) => path.relative(ROOT, f)))
+      .filter(
+        (f) =>
+          /\.(css|js|njk)$/.test(f) && f !== "src/_data/brand.js" && f !== "src/tokens.css.njk",
+      );
+    const bad = [];
+    for (const rel of targets) {
+      const t = read(rel);
+      if (!t) continue;
+      for (const line of t.split("\n")) {
+        if (/^\s*(\/\/|\/\*|\*|#|<!--)/.test(line)) continue;
+        if (/#[0-9a-fA-F]{3}(?:[0-9a-fA-F]{3})?\b/.test(line) && !/\{\{/.test(line))
+          bad.push(`${rel} (hex)`);
+        else if (/font-family\s*:/.test(line) && !/var\(--brand/.test(line))
+          bad.push(`${rel} (font-family)`);
+      }
+    }
+    return bad.length
+      ? { status: FAIL, note: `literal outside brand.js: ${[...new Set(bad)].join(", ")}` }
+      : { status: PASS, note: "no hex/font literal outside _data/brand.js" };
+  },
+  "audit-page": () => {
+    const a = read("src/audit.njk") || "";
+    if (!/noindex/.test(a)) return { status: FAIL, note: "audit page not noindex" };
+    if (!/id="show-all"/.test(a)) return { status: FAIL, note: 'no "show all" toggle' };
+    const need = ["Brand", "Content &amp; Links", "Infrastructure", "Compliance"];
+    if (adsMode !== "none") need.push('id="t-ads"');
+    const missing = need.filter((t) => !a.includes(t));
+    if (missing.length)
+      return { status: FAIL, note: `audit tabs incomplete: missing ${missing.join(", ")}` };
+    return { status: PASS, note: "noindex; show-all toggle; all tabs present" };
+  },
+  "security-headers": () =>
+    fromDoctor("security-headers", doc["csp-thirdparties"] ? doc["csp-thirdparties"].detail : ""),
+  caching: () => {
+    const toml = read("netlify.toml") || "";
+    const ok = /for = "\/\*\.html"/.test(toml) && /for = "\/\*\.css"/.test(toml);
+    return ok
+      ? { status: PASS, note: "per-type Cache-Control in netlify.toml" }
+      : { status: FAIL, note: "cache headers not per-type" };
+  },
+  "third-parties": () => {
+    if (!has("src/_data/thirdparties.js"))
+      return { status: FAIL, note: "no _data/thirdparties.js" };
+    const rep = read("_site/links-report.json");
+    return rep
+      ? { status: PASS, note: "origin manifest present; check-links found no undeclared origin" }
+      : {
+          status: MANUAL,
+          note: "manifest present; run npm run links to confirm no undeclared origin",
+        };
+  },
+  privacy: () => {
+    const p = read("src/privacy.njk") || "";
+    if (!has("src/privacy.njk")) return { status: FAIL, note: "no privacy page" };
+    if (!/for\s+t\s+in\s+thirdparties/.test(p))
+      return {
+        status: FAIL,
+        note: "privacy third-party list not rendered from _data/thirdparties.js",
+      };
+    return { status: PASS, note: "third-party list rendered from the manifest" };
+  },
+  ads: () => {
+    if (adsMode === "none") return { status: NA, note: "ads: none" };
+    if (!has("src/_data/ads.js"))
+      return { status: FAIL, note: `ads: ${adsMode} but no _data/ads.js` };
+    if (!has("src/ads.txt.njk")) return { status: FAIL, note: "no src/ads.txt.njk" };
+    const layout = read("src/_includes/layout.njk") || "";
+    const gated =
+      /build\.isProduction/.test(layout) &&
+      /adsbygoogle\.js/.test(layout) &&
+      /fundingchoicesmessages/.test(layout);
+    if (!gated)
+      return {
+        status: FAIL,
+        note: "layout.njk: loader + CMP not present or not gated on build.isProduction",
+      };
+    // Real ad CODE (not a bare origin string the audit page shows as data).
+    const AD_CODE = /adsbygoogle\.js|<ins[^>]+adsbygoogle|google-adsense-account/;
+    const prod = doc["prod-indexable"] && /indexable/.test(doc["prod-indexable"].detail || "");
+    const leak = siteHtml().filter((f) => AD_CODE.test(fs.readFileSync(f, "utf8")));
+    if (!prod && leak.length)
+      return { status: FAIL, note: `ad code in ${leak.length} non-production page(s)` };
+    return {
+      status: MANUAL,
+      note: "wired; verify on production: decline consent => no ad requests, accept => ads + CLS ok",
+    };
+  },
+  "internal-links": () => {
+    const rep = read("_site/links-report.json");
+    return rep
+      ? { status: PASS, note: `check-links passed (${JSON.parse(rep).pages} pages)` }
+      : { status: MANUAL, note: "run npm run links (not run under --serve)" };
+  },
+  forms: () => {
+    const layout = read("src/_includes/layout.njk") || "";
+    const handlers = grepSrc(/addEventListener\(["']submit["']/, [".js"]);
+    if (!/netlify-honeypot|name="bot-field"/.test(layout))
+      return { status: FAIL, note: "no honeypot field in the form" };
+    if (handlers.length > 1)
+      return { status: FAIL, note: `submit handler in ${handlers.length} files — consolidate` };
+    return { status: PASS, note: "one handler in site.js; honeypot present" };
+  },
+  "domain-tests": () => {
+    const mods = walk(path.join(ROOT, "static/calc"))
+      .filter((f) => f.endsWith(".js"))
+      .map((f) => path.basename(f, ".js"));
+    const tests = new Set(
+      walk(path.join(ROOT, "test"))
+        .filter((f) => f.endsWith(".test.js"))
+        .map((f) => path.basename(f, ".test.js")),
+    );
+    const missing = mods.filter((m) => !tests.has(m) && !tests.has(m.replace(/-/g, "")));
+    return missing.length
+      ? { status: FAIL, note: `no test for: ${missing.join(", ")}` }
+      : { status: PASS, note: `${mods.length} calc modules, each with a test/*.test.js` };
+  },
+  a11y: () => {
+    if (!/\ba11y\b/.test(JSON.parse(read("package.json") || "{}").scripts?.check || ""))
+      return { status: FAIL, note: "no a11y stage in the gate" };
+    return {
+      status: MANUAL,
+      note: "axe scan is in the gate; confirm the checklist items beyond the scan (focus order, live regions)",
+    };
+  },
+  "the-gate": () =>
+    fromDoctor(
+      "gate-stages",
+      /doctor|compliance/.test(JSON.parse(read("package.json")).scripts.check)
+        ? "doctor/compliance leaked into check"
+        : "doctor + compliance kept out",
+    ),
+  compliance: () => {
+    const pkg = JSON.parse(read("package.json") || "{}");
+    const wired = /whs compliance|scripts\/compliance\.js/.test(pkg.scripts?.compliance || "");
+    const dep =
+      (pkg.devDependencies || {})["@piercebarney/whs-eleventy"] ||
+      (pkg.dependencies || {})["@piercebarney/whs-eleventy"];
+    if (!wired) return { status: FAIL, note: "no `compliance` script in package.json" };
+    return {
+      status: PASS,
+      note: dep
+        ? "npm run compliance → whs compliance; wired to /audit/ + bin/deploy"
+        : "npm run compliance; wired to /audit/ + bin/deploy",
+    };
+  },
+  "ci-cd": () => {
+    const d = (read("bin/deploy") || "")
+      .split("\n")
+      .filter((l) => !/^\s*#/.test(l))
+      .join("\n");
+    if (/\s--force\b|\s--no-verify\b/.test(d))
+      return { status: FAIL, note: "bin/deploy has a bypass flag" };
+    if (!has(".githooks/pre-push") || !has(".githooks/pre-commit"))
+      return { status: FAIL, note: "git hooks not committed" };
+    if (!/core\.hooksPath/.test(read("package.json") || ""))
+      return { status: FAIL, note: "prepare does not set core.hooksPath" };
+    if (!has(".github/workflows/ci.yml")) return { status: FAIL, note: "no ci.yml" };
+    // core.hooksPath being live is a property of "npm install has run here", not
+    // of the codebase — a fresh clone is still compliant. doctor's hooks-path
+    // check surfaces the live state on /audit/ (a warn, not a compliance FAIL).
+    return {
+      status: PASS,
+      note: "hooks committed + prepare wires core.hooksPath; ci.yml present; bin/deploy has no bypass",
+    };
+  },
+  secrets: () => {
+    const gi = read(".gitignore") || "";
+    if (!/^\.env$/m.test(gi)) return { status: FAIL, note: ".env not git-ignored" };
+    if (!has(".env.example")) return { status: FAIL, note: "no .env.example" };
+    const leak = siteHtml().filter((f) =>
+      /NETLIFY_AUTH_TOKEN|ghp_|AKIA[0-9A-Z]{16}/.test(fs.readFileSync(f, "utf8")),
+    );
+    if (leak.length)
+      return { status: FAIL, note: `secret-shaped string in ${leak.length} output file(s)` };
+    return fromDoctor("env-untracked", ".env.example committed; no secret in _site/");
+  },
+  observability: () => ({
+    status: MANUAL,
+    note: "post-launch: Search Console coverage, Core Web Vitals, form deliverability — see /audit/ manual checklist",
+  }),
+  "llm-integration": () => {
+    if (aiMode === "none") return { status: NA, note: "ai: none" };
+    const fnDir = has("netlify/functions") || has("netlify/edge-functions");
+    if (!fnDir)
+      return {
+        status: FAIL,
+        note: `ai: ${aiMode} but no netlify/functions/ — a keyed model call belongs in a Function`,
+      };
+    const keyInData = grepSrc(/ANTHROPIC_API_KEY|OPENAI_API_KEY|x-api-key/, [".js"]).filter((f) =>
+      f.startsWith("src/_data/"),
+    );
+    if (keyInData.length)
+      return {
+        status: FAIL,
+        note: `provider key referenced in ${keyInData.join(", ")} — move it to the Function env`,
+      };
+    const disclosure =
+      has("src/_includes/ai-disclosure.njk") ||
+      grepSrc(/AI-generated|ai-disclosure/, [".njk"]).length;
+    if (!disclosure) return { status: FAIL, note: "no visible AI-generated disclosure partial" };
+    return {
+      status: MANUAL,
+      note: "Function proxy wired; verify: key in Function env only, explicit timeout + capped retry + app-side ceiling, per-request cost telemetry, moderation sized to the subject, provider-usage-policy check date recorded",
+    };
+  },
+  "agent-artifacts": () => ({
+    status: NA,
+    note: "out of scope for a static site — model-driven code execution + sandboxing + artifact storage need a running app (stacks/phoenix.md)",
+  }),
+  "usage-metering": () => ({
+    status: NA,
+    note: "out of scope for a static site — a per-subject event log + pre-spend enforcement + reconciliation need a datastore (stacks/phoenix.md)",
+  }),
+  "generated-asset-freshness": () => {
+    const s = read(".claude/settings.json") || "";
+    const hook = read(".claude/hooks/og-guard.sh") || "";
+    if (!/og-guard\.sh/.test(s))
+      return { status: FAIL, note: "no PostToolUse hook in .claude/settings.json" };
+    const covers = ["brand.js", "tokens.css.njk", "og-card.js"].every((g) => hook.includes(g));
+    return covers
+      ? { status: PASS, note: "hook rebuilds on brand.js / tokens.css.njk / og-card.js edits" }
+      : { status: FAIL, note: "hook globs don't cover the brand source set" };
+  },
+  "beyond-this-standard": () => ({
+    status: NA,
+    note: "static+forms envelope; documented in CLAUDE.md scope key",
+  }),
+  adopting: () => {
+    const c = claudeMd.replace(/\s+/g, " ");
+    const hasDirective =
+      /follows the web house style/.test(c) &&
+      /Run `npm run check` before reporting a change done/.test(c);
+    const keys = [
+      "framework:",
+      "css:",
+      "scope:",
+      "ads:",
+      "production-url:",
+      "content-type:",
+      "standard-version:",
+    ].filter((k) => c.includes(k));
+    if (!hasDirective)
+      return {
+        status: FAIL,
+        note: "CLAUDE.md House-style section missing the directive paragraph",
+      };
+    if (keys.length < 7)
+      return { status: FAIL, note: `House-style block missing keys (${keys.length}/7)` };
+    return { status: PASS, note: "directive + full data block present" };
+  },
+  "out-of-scope": () => ({ status: NA, note: "situational list — nothing to verify mechanically" }),
+  "anti-patterns": () => ({
+    status: MANUAL,
+    note: "read the anti-pattern lists in core.md + the stack doc against recent changes",
+  }),
+};
+// ---- standard-version drift -----------------------------------------
+// Every chapter slug the CHANGELOG records as changed after `pin`. `### core: a
+// · b · c` yields every slug on the line, not just the first; a
+// `### stacks/eleventy-netlify.md` heading yields the binding marker.
+function changelogSlugs(changelog, pin) {
+  const slugs = new Set();
+  let inRange = false;
+  for (const line of (changelog || "").split("\n")) {
+    const dateM = line.match(/^##\s+([0-9]{4}-[0-9]{2}-[0-9]{2})/);
+    if (dateM) inRange = dateM[1] > pin;
+    if (!inRange) continue;
+    const coreM = line.match(/^###\s+core:\s+(.+)/);
+    if (coreM) {
+      for (const part of coreM[1].split(/[·,]/)) {
+        const slug = (part.trim().match(/^[a-z0-9-]+/) || [])[0];
+        if (slug) slugs.add(slug);
+      }
+    }
+    if (/^###\s+stacks\/eleventy-netlify\.md/.test(line)) slugs.add("(eleventy binding)");
+  }
+  return [...slugs];
+}
+function versionDrift() {
+  const pin = (claudeMd.match(/standard-version:\s*([0-9-]+)/) || [])[1];
+  if (!STANDARD) {
+    return {
+      pin,
+      current: null,
+      rows: [
+        "MANUAL: standard text not resolvable — set WHS_STANDARD or install @piercebarney/whs-eleventy to check drift against the pin",
+      ],
+    };
+  }
+  const coreMd = read("core.md", STANDARD) || "";
+  const current = (coreMd.match(/\*\*Version:\*\*\s*([0-9-]+)/) || [])[1];
+  if (!pin || !current) return { pin, current, rows: [] };
+  if (pin >= current) return { pin, current, rows: [] };
+  const changelog = read("CHANGELOG.md", STANDARD) || "";
+  return {
+    pin,
+    current,
+    rows: changelogSlugs(changelog, pin).map(
+      (s) => `MANUAL: re-check #${s} — changed since the pinned ${pin}`,
+    ),
+  };
+}
+// ---- run --------------------------------------------------------------
+function runCompliance() {
+  loadDoctor();
+  const results = [];
+  for (const [slug, fn] of Object.entries(CHECKS)) {
+    let r;
+    try {
+      r = fn();
+    } catch (e) {
+      r = { status: MANUAL, note: `check threw: ${(e.message || "").split("\n")[0]}` };
+    }
+    results.push({ slug, ...r });
+  }
+  const manualList = [
+    "page prose is genuinely in content/*.json, not the templates",
+    "every content page's `related` list is 2–4 genuinely relevant siblings",
+    "the a11y checklist holds beyond the axe scan (focus order, skip link, live regions)",
+    "the OG card design still matches the brand after any redesign",
+  ];
+  const drift = versionDrift();
+  return { results, manualList, drift, generatedAt: new Date().toISOString() };
+}
+function summarize({ results, drift }) {
+  const n = (s) => results.filter((r) => r.status === s).length;
+  return {
+    pass: n(PASS),
+    fail: n(FAIL),
+    manual: n(MANUAL) + drift.rows.length,
+    na: n(NA),
+  };
+}
+function writeCache(payload) {
+  try {
+    fs.mkdirSync(path.dirname(CACHE), { recursive: true });
+    fs.writeFileSync(CACHE, JSON.stringify(payload, null, 2));
+  } catch {
+    /* .cache read-only in some CI — console output is the source of truth */
+  }
+}
+function main() {
+  const strict = process.argv.includes("--strict");
+  const payload = runCompliance();
+  const s = summarize(payload);
+  console.log("\nCompliance — codebase vs web house style\n");
+  for (const r of payload.results) {
+    console.log(`  ${r.status.padEnd(6)} #${r.slug}${r.note ? ` — ${r.note}` : ""}`);
+  }
+  if (payload.drift.rows.length) {
+    console.log(
+      payload.drift.current
+        ? `\n  standard-version: pinned ${payload.drift.pin}, standard at ${payload.drift.current}`
+        : `\n  standard-version: pinned ${payload.drift.pin || "(none)"}`,
+    );
+    for (const row of payload.drift.rows) console.log(`  ${row}`);
+  }
+  console.log("\n  Manual review (not mechanically checkable):");
+  for (const m of payload.manualList) console.log(`   - ${m}`);
+  console.log(`\n${s.pass} pass · ${s.fail} fail · ${s.manual} manual · ${s.na} n/a\n`);
+  writeCache({ ...payload, summary: s });
+  if (strict && s.fail) {
+    console.error("compliance --strict: FAIL chapters present.");
+    process.exit(1);
+  }
+}
+if (require.main === module) main();
+module.exports = { runCompliance, summarize, changelogSlugs };