AI drafts. Verification decides what ships.

Before anything is designed, I read your record

Your old site as it actually looked — the versions the Internet Archive kept, going back as far as it goes — plus whatever is still on your own drives. Brochures, spec sheets, old proposals, the paragraph someone wrote years ago that people in the company still quote at each other.

Two reasons. Most established businesses already said the true thing about themselves once and then lost it in a redesign; finding that sentence is better than inventing a new one. And comparing the old versions against the current one shows what has actually changed about the business, as opposed to what has only changed about the website. Those are different problems and they have different fixes.

The findings come to you in writing before any build decision is made. I do this part myself. It is the step where the work is decided, so it is not one I hand off.

Who "we" means

A specialist is brought in when a job genuinely needs one. So "we" is accurate rather than decorative — but it should not be read as a large team, because it is not one.

What does not change with the size of the job: one person is answerable for whether the result works, and for every promise made to get the work. If something delivered here is wrong, there is no question about whose problem it is.

A draft is not a deliverable

Drafting is fast now, and that is genuinely useful. It is also the part that carries no assurance. A model will produce something plausible whether or not it is correct, and plausible is the failure mode that survives a read-through.

So nothing here ships because it looked right. It ships because something other than the thing that wrote it agreed — a test, a measurement, a second reading, or a gate that would have refused. The work is in building checks worth trusting, and then trusting them instead of ourselves.

What runs on every build

These are not a checklist someone remembers. They are steps in the build command. A build that fails one of them does not produce a deployable site.

• Attribution

  check-attribution.mjs

  Any personal name, email, phone number or machine hostname reaching a machine-readable surface — meta tags, structured data, comments, package manifests, sitemaps, image metadata, commit author. One deliberate exception exists and is allowlisted as an exact string; a second occurrence fails.

• Language

  check-spelling.mjs

  Spelling that does not match the house standard, in published output and in source comments alike — because a comment is where the next piece of copy gets written.

• Credentials

  check-secrets.mjs

  Any credential-shaped string in the built site at all, and anywhere else any that sits on a line naming a credential. The gate holds no secret of its own; it matches a shape, not a value.

• Unfilled commitments

  check-placeholders.mjs

  A page reaching the build with a commitment still written as a blank — a response time, a fee, a threshold. A draft that promises something unspecified is worse than no page, so it cannot be published by accident.

• Links

  check-slashes.mjs

  Any internal link that would cost the visitor a redirect: a page address written without its trailing slash. Nothing looks broken when this happens, which is why it is checked rather than reviewed.

• Content Security Policy

  generate-csp-hashes.mjs

  Any inline script the policy has not been regenerated for. Change a script without rebuilding and the browser refuses to run it.

A check you have never seen fail is not a check

A gate that passes might be working, or might be looking in the wrong place. The two are indistinguishable from the outside, and the second one is worse than having no gate at all, because it comes with confidence attached.

So every gate here has been tested by deliberately introducing the thing it exists to catch, confirming it fails, then removing it and confirming it passes.

What we measured

Every figure below carries the date it was taken and, where one exists, the script that produced it, so any of them can be re-run by someone other than us. A figure without a date cannot be checked; a dated one can.

These are run deliberately before a release. They are not build gates: reproducibility runs the build twice, contrast needs a real browser, and the structured-data check reads the finished site after the build. Calling them gates would overstate what happens automatically.

Build reproducibility verify-reproducible.mjs measured 2026-08-30

Two clean builds from the same source produced 172 files with identical SHA-256 hashes — every file in the output, not a sample. The sitemap and the plain-text map for machine readers are generated inside the same build and dated from the source rather than from the clock, so they are part of that count.

Color contrast check-contrast.mjs measured 2026-08-30

725 text nodes across 9 pages, each measured against the surface it actually sits on rather than against the page background. 0 failures against WCAG AA. The script stops every transition before it measures, so repeated runs against the same build return the same figure.

Structured data against the copy check-structured-data.mjs measured 2026-08-30

Nine page graphs, and 12 questions and answers checked word for word against the visible text of the page carrying them. The schema and the copy are generated from one array, so they agree today; the check exists so they cannot quietly stop agreeing. It was tested by being made to fail on 2026-08-30 in four ways at once — an answer altered so it no longer matched the page, a reference pointed at an identifier nothing defined, an unmeasured priority field put back into the sitemap, and a link added to an address that was never built. Four planted, four caught, and it passed again once they were removed.

Gate verification measured 2026-08-30

Gates are tested by being made to fail. The attribution gate was given five planted leaks across five categories; it caught all five, reported each in the right category, and passed again once they were removed. The credentials gate was tested the same way on the day it was written — a key-shaped string in the built output, one on a line naming a credential in source, one in a document, and two non-UUID token formats — five planted, five caught, each in the right category. The language and attribution gates both read the scripts that build the site, not only the site itself. The attribution gate also fails on the presence of a metadata block in any delivered image, whatever the block contains, and was tested the same way: three planted, three caught.

What this costs

Every job is scoped before it is quoted, so there is no price list. Two things can be said before we ever talk.

There is a floor, and work below it is turned down rather than discounted — a job priced under what it takes is a job that ends badly for both sides. The figure is quoted in the conversation, not published here.

The first step is a paid review — the archive and inventory work described above — quoted and agreed before it begins. You get the findings in writing, and they are yours whether or not the build goes ahead. It is the one part of any engagement that can be scoped exactly, which is why it comes first.

If what you need is smaller than that, say so anyway. Sometimes the honest answer is a two-hour fix and an invoice for two hours, and sometimes it is the name of somebody better suited to it.

What your browser reaches

Fonts, images and video are all served from this site itself, and there is no analytics script of our own on any page. Two third parties are reached anyway, and they are named here because naming them is more useful to you than an absolute would be:

• Cloudflare hosts the site and provides its edge analytics, so it sees the request.
• Web3Forms relays the contact form, so it handles what you type into it.

There were three until 2026-08-29. An image CDN served the artwork, which meant this site could not actually be moved to another host without taking its pictures from somewhere else — so a claim we make on the work page was not true. The images now ship with the site.

That list is checkable against the site's own security policy, which has to permit each of them by name before your browser will connect.