How this site is built, and where it falls short

Instrumentation: present. PageTelemetry collects web-vitals in the browser (src/components/PageTelemetry.tsx), on every pageview. Delivery: unverified. Whether those events arrive and aggregate correctly has not been confirmed against the processor. Reporting: none. No field figure is published here, because insufficient data is not a score — and a score from a developer machine is not a claim about what a visitor experiences, which is the unfounded number this page exists to avoid.

The site is built to the obvious disciplines — semantic HTML, visible focus, labeled controls, contrast from a fixed token palette, no keyboard traps, honored reduced-motion — and it has not been audited against real assistive technology by someone qualified. Until it has, no conformance is claimed.

A nonce policy in the App Router needs middleware on every request, which makes every route dynamic and costs the static prerender. This site renders no visitor-supplied HTML anywhere, so the surface a nonce would close is close to nil — but it is a real weakening and it is recorded rather than glossed. On the directive carrying most of the value: connect-src 'self' restricts which origins scripts running in the browser may contact — it is a browser-side restriction on this page's own scripts. It is not a guarantee against exfiltration, because analytics is deliberately proxied: the browser sends events to this site's own origin, and the server forwards them on to the analytics processor. The data path is website host → proxy → processor, and a same-origin endpoint can forward information onward — the header does not prevent that, and was never intended to.

Both instruments measure what a visitor says, not what is true. The examination is designed around that limit rather than despite it — the follow-up question is there precisely because a claim and its evidence are different things. Neither should be read as an assessment.

Confirmed against primary sources and now cited. The internal research note had carried it as unconfirmed since compilation; the restriction is lifted and the correction is dated at the head of that document.

Removed from all four positioning surfaces. It was a category-level reference doing work it could not support. A citation to a NIST publication on ISO 23247 remains inside one article, because that is a primary source rather than a credential.

Superseded on 17 April 2026 by Fed SR 26-2 / OCC Bulletin 2026-13, which also places agentic and generative systems expressly outside scope. Corrected across the estate. This is the correction the practice is most often right about before others are.

The diagnostic, the booking screener, the search ranking and the examination are all deterministic and their methods are published on their own pages. No model sits in the path of any decision this site makes about a visitor. The same inputs always produce the same output, and you can check.

connect-src 'self' stops a browser script on this site from contacting another host directly. Analytics is proxied first-party and configured with no autocapture, no session recording and no person profiles — but the events it does send are then forwarded by the server to PostHog, which is a deliberate second hop the header above does not, and is not meant to, block. What actually happens to the address on each event — the specific claim this page previously got wrong — is in the inventory below and at /privacy, not summarized here in prose.

Every page is prerendered and readable before any script runs. The interactive instruments need JavaScript to be driven, but their method and question set are rendered as static prose so a reviewer — or a crawler that executes nothing — can still examine how they work.

A structured-data graph, an enriched llms.txt, an ungated search endpoint and a read-only MCP server. An assistant assembling a shortlist can quote the published positions accurately instead of paraphrasing them.