@piercebarney/whs-eleventy 2026.9.30 → 2026.10.1

package/lib/compliance.js

@@ -18,7 +18,7 @@ const path = require("node:path");
 const { execSync } = require("node:child_process");
 const { parse: parseHtml } = require("node-html-parser");
 const { runRepoChecks } = require("./doctor.js");
-const { ROOT, resolveStandard } = require("./_project.js");
+const { ROOT, resolveStandard, tryProjectRequire } = require("./_project.js");
 
 const SITE = path.join(ROOT, "_site");
 const CACHE = path.join(ROOT, ".cache", "compliance.json");
@@ -467,11 +467,36 @@ const CHECKS = {
     // The privacy page may be a standalone src/privacy.njk or a pages.json
     // entry rendered by a src/pages/ shell — check the built output, with a
     // source fallback for when _site isn't built yet.
-    const built = has("_site/privacy/index.html") || has("_site/privacy.html");
+    const builtPath = has("_site/privacy/index.html")
+      ? "_site/privacy/index.html"
+      : has("_site/privacy.html")
+        ? "_site/privacy.html"
+        : null;
     const source =
       has("src/privacy.njk") ||
       /["']slug["']\s*:\s*["']privacy["']/.test(read("src/content/pages.json") || "");
-    if (!built && !source) return { status: FAIL, note: "no privacy page" };
+    if (!builtPath && !source) return { status: FAIL, note: "no privacy page" };
+
+    // Prefer checking the built page's own rendered HTML for every declared
+    // third party's name — what a user actually sees, independent of which
+    // source file or templating approach produced it. Falls back to the
+    // source-level pattern only when there's no built output yet, or
+    // nothing declared to check against.
+    if (builtPath) {
+      const thirdparties = tryProjectRequire("src/_data/thirdparties.js", null);
+      if (Array.isArray(thirdparties) && thirdparties.length) {
+        const html = read(builtPath) || "";
+        const missing = thirdparties
+          .filter((t) => t?.name && !html.includes(t.name))
+          .map((t) => t.name);
+        return missing.length
+          ? { status: FAIL, note: `privacy page missing disclosure for: ${missing.join(", ")}` }
+          : {
+              status: PASS,
+              note: "privacy page present; built output discloses every declared third party",
+            };
+      }
+    }
     // The third-party disclosure must be generated from _data/thirdparties.js,
     // never hand-maintained — the loop lives in the privacy shell or an include.
     if (!hasThirdPartyLoop())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piercebarney/whs-eleventy",
-  "version": "2026.9.30",
+  "version": "2026.10.1",
   "description": "The web house style's Eleventy + Netlify tooling — the compliance sweep, the infra doctor, the link/CSP integrity check, and the a11y scan, shared by every project on the stack.",
   "bin": {
     "whs": "cli.js"

package/standard/CHANGELOG.md

@@ -21,6 +21,33 @@ enforced, new *opt-in* chapters/capabilities, tooling-only changes — is
 
 ---
 
+## 2026-10-01 [non-breaking]
+
+### packages/whs-eleventy
+
+Supersedes yesterday's (2026-09-30) `hasThirdPartyLoop()` widening, which was
+correct but unreachable: the standard's own reference `audit.njk` template
+independently contains a matching loop pattern for its unrelated Content &
+Links tab, so `privacy`'s broad source scan always found that coincidental
+match first, before the new fallback logic could ever run — this affected
+every project descended from the template, not just the one that reported
+it. `privacy` in `lib/compliance.js` now checks the built privacy page's own
+rendered HTML for every third party declared in `src/_data/thirdparties.js`,
+by name — what a user actually sees, independent of which source file or
+templating syntax produced it — falling back to yesterday's source-pattern
+mechanism (unchanged, still present) only when there's no built output yet
+or nothing is declared to check against. Confirmed against the reference
+template itself: `privacy` still PASSes, now for the correct reason (built
+output discloses every declared party) instead of the coincidental
+`audit.njk` match. Resolves
+`feedback/2026-09-23-privacy-thirdparty-check-scans-wrong-file.md` (the
+original report) and
+`feedback/2026-09-24-privacy-thirdparty-fix-still-short-circuits-on-audit-loop.md`
+(the follow-up that diagnosed why the 2026-09-30 fix didn't work). Fixed in
+`56f5c67`.
+
+---
+
 ## 2026-09-30 [non-breaking]
 
 ### packages/whs-eleventy

package/standard/core.md

@@ -1,6 +1,6 @@
 # Web project house style — CORE (stack-agnostic)
 
-**Version:** 2026-09-30 · **Status:** active
+**Version:** 2026-10-01 · **Status:** active
 
 This is the stack-agnostic contract every web project follows, regardless of
 framework, host, or CSS system. It says **what** must be true, with concrete
@@ -1467,7 +1467,7 @@ governs it and follow that chapter — the slugs are the index (a `<script>` →
 - production-url: https://example.com
 - content-type: tool           # tool | article  (article => feeds)
 - publishing-rate: ~5 pages/week
-- standard-version: 2026-09-30  # recommended — enables standard-version drift tracking (#compliance)
+- standard-version: 2026-10-01  # recommended — enables standard-version drift tracking (#compliance)
 ```
 
 If the section is absent, the assistant's first action is to run the flow above