audit: site-wide honesty pass + sketch tool fixes (Wave 1)#5
Merged
Conversation
Findings from a 6-agent autonomous audit (engineering, content/strategy, cross-repo, package code review, sketch UX/a11y, codex second-opinion). Verified each load-bearing claim before acting (ghcr.io 401, /sdk/ts/ 404, brew tap 404, 11 H1s on /architecture/, iframe -233px desktop clip, sketch same-row edge bug, Sharp libvips LGPL transitive). Site copy honesty: - Architecture H1: "Bank-Grade Platform Architecture" -> "Reference architecture for bank-grade internal-tooling fleets" + v0.1.0-vs-target callout note. Demoted 10x "# Part X" -> "## Part X" (was 11 H1s, now 1). - Removed duplicate six-commitments recap from §4 (links to manifesto). - Aligned starter-api stack to shipped state (Go 1.25 + chi + pgx, not Go 1.23 + Fiber + GORM). Marked Temporal as v1.0 target. - Fixed OTel auto-instrumentation list (chi+pgx, not Fiber+GORM). - Launch H1: "bank-grade foundation" -> "first SDK release". Reframed "everything... on a public registry you can install from right now" to honest "SDKs on registries; substrate from source". - Launch table CLI: pinned-version @v0.1.1 -> @latest (avoids drift claim). - Try-it: kept "Stand it up in an afternoon" but rewrote step 2 to use git-clone + values-dev.yaml (the path that works at v0.1.0); helm-OCI flow moved into a v1.0-target caution block. Dropped non-existent Homebrew tap line. Dropped Argo-CD reconcile step (it isn't shipped). Added kind-cluster prerequisites. - /sdk/ index: added per-package status column (all v0.1.0 today). - /tools/: trimmed 5 "coming soon" cards down to 2 (OTel Config + CloudEvents Validator) per strategist call. Softened "Excalidraw (looks amateur)" punch-down. Sketch promoted to its own H2 from the tools/diagrams pair. - /examples/access-requests/: disclosed dev-cookie-shim limitation. - Stale "Spectral" comment in astro.config -> IBM Plex Sans. - Dropped IBM Plex Mono fallback from theme.css (JetBrains Mono is canonical). Engineering: - IFrameTool.astro: fixed full-bleed via JS measurement instead of 100vw + calc(50% - 50vw) trick (which misaligns with Starlight's splash-template left-anchored content column, off-screen left -233px). Also: forwards parent location.hash into iframe src so /tools/sketch/ share links route the encoded DSL into the embedded tool. - Removed iframe sandbox= attr: `allow-scripts + allow-same-origin` together negates sandbox and Chromium warns. Same-origin anyway. - check.yml: added permissions: contents:read minimal token scope. - index.md: title "Plinth" (-> rendered as "Plinth | Plinth") replaced with the tagline. Added theme-color meta site-wide. Sketch tool (public/tools/sketch-app.html): - Toolbar wraps on mobile (was clipping Copy share link off-screen). - "Empty" example now actually empty (was rendering a non-empty SVG with just the cite floating; placeholder text wasn't shown). - Share-link encoding chunked to 8KB, with a 64KB DSL cap. - Bad hash now flashes "share link malformed" instead of silently falling through to default. - Status: aria-live=polite, distinct ✕ vs ● glyph for err/ok (not just color). Updates via replaceChildren (no innerHTML) so SR doesn't over-announce. - Added <h1 visually-hidden>, wrapped editor in <main>, <label for> on the example select, autofocus on textarea (primary surface). - Fixed render: shows placeholder when DSL parses to 0 nodes (was rendering an empty cite-only SVG). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Findings from a 6-agent autonomous audit (engineering, content/strategy, cross-repo, package code, sketch UX/a11y, codex second-opinion). Each load-bearing claim was verified by reproduction before acting.
Site copy honesty
Engineering
100vw + calc(50% − 50vw)(was clipping iframe -233px off viewport on splash template)location.hashinto iframe so /tools/sketch/#d=… share links work end-to-endsandbox="allow-scripts allow-same-origin allow-downloads"(Chromium warns; both flags together negates sandbox; iframe is same-origin anyway)check.ymlworkflow: minimalpermissions: contents:readtheme-colormeta addedSketch tool (public/tools/sketch-app.html)
flex-wrap: wrapon narrow viewports (was clipping Copy-share-link off-screen at 390px)role="status" aria-live="polite", distinct ✕/● glyph (not just color),replaceChildrenupdates (no innerHTML)<h1>,<main>landmark,<label for>on example select,autofocuson textarea (primary surface)Verifications run before commit
Test plan
pnpm lintcleanpnpm buildclean (26 pages)/tools/sketch/parent → iframe🤖 Generated with Claude Code