A practice arguing that systems should show their working is obliged to show its own. Every number here was measured rather than asserted, and the open defects are listed beside the passes — a page of green ticks would tell you nothing.
Production build, gzipped, on the build output rather than a development server — a development server ships unminified React and would have flattered these by roughly fifteen times. You can reproduce any of it from the repository.
| Measurement | Value | How and what it means |
|---|---|---|
| JavaScript, homepage | 265 KB | Gzipped, production build, 10 files. Almost all of it is the React and Next runtime; the site's own code is a small fraction. Measured by summing the gzipped size of every chunk the prerendered homepage references. |
| JavaScript, heaviest interactive page | 269 KB | The examination simulator — 4 KB more than the homepage, because the instrument itself is a few hundred lines of deterministic logic and no library. |
| CSS, whole site | 8 KB | Gzipped. One hand-written stylesheet, 582 lines, covering every page and both themes. No framework, no utility classes, no unused rules to purge. |
| HTML, homepage | 17 KB | Gzipped, prerendered. The page is readable and complete before any JavaScript executes. |
| Production dependencies | 6 | next, react, react-dom, pg, zod, posthog-js. No UI library, no component library, no animation library, no charting library, no CSS framework. Every interactive instrument on this site is written from scratch against the platform. |
| Automated tests | 92 | Covering the diagnostic scoring, the booking screener's routing rules, the retrieval ranking, the examination verdicts and the abuse limiter. The build fails if any of them do. |
| Pages · API routes · indexed documents | 32 · 9 · 83 | Every page is prerendered as static HTML except the handful that must read the database. |
The part that makes the rest worth reading. Anything not measured is listed as not measured rather than left out, because omission is how a scorecard lies.
Not measured under conditions worth publishing. A score from a developer machine is not a claim about what a visitor experiences, and quoting one would be the sort of unfounded number this page exists to avoid. Real-user measurement is the correct instrument and it is not yet wired up.
The site is built to the obvious disciplines — semantic HTML, visible focus, labelled controls, contrast from a fixed token palette, no keyboard traps, honoured reduced-motion — and it has not been audited against real assistive technology by someone qualified. Until it has, no conformance is claimed.
A nonce policy in the App Router needs middleware on every request, which makes every route dynamic and costs the static prerender. This site renders no visitor-supplied HTML anywhere, so the surface a nonce would close is close to nil — but it is a real weakening and it is recorded rather than glossed. The directives carrying most of the value are strict: connect-src 'self' means nothing can exfiltrate to a third party.
Both instruments measure what a visitor says, not what is true. The examination is designed around that limit rather than despite it — the follow-up question is there precisely because a claim and its evidence are different things. Neither should be read as an assessment.
Where something published here turned out to be wrong, the correction is recorded with a date rather than quietly applied. Being publicly wrong on purpose is the rarest credibility signal available, and the cheapest to offer honestly.
Confirmed against primary sources and now cited. The internal research note had carried it as unconfirmed since compilation; the restriction is lifted and the correction is dated at the head of that document.
Removed from all four positioning surfaces. It was a category-level reference doing work it could not support. A citation to a NIST publication on ISO 23247 remains inside one article, because that is a primary source rather than a credential.
Superseded on 17 April 2026 by Fed SR 26-2 / OCC Bulletin 2026-13, which also places agentic and generative systems expressly outside scope. Corrected across the estate. This is the correction the practice is most often right about before others are.
The diagnostic, the booking screener, the search ranking and the examination are all deterministic and their methods are published on their own pages. No model sits in the path of any decision this site makes about a visitor. The same inputs always produce the same output, and you can check.
connect-src 'self': nothing on this site can send data to another host. Analytics is proxied first-party and configured with no autocapture, no session recording, no person profiles and a null IP. The full inventory lists everything stored, why, and for how long.
Every page is prerendered and readable before any script runs. The interactive instruments need JavaScript to be driven, but their method and question set are rendered as static prose so a reviewer — or a crawler that executes nothing — can still examine how they work.
A structured-data graph, an enriched llms.txt, an ungated search endpoint and a read-only MCP server. An assistant assembling a shortlist can quote the published positions accurately instead of paraphrasing them.