This site is judged by its own law.
On every deploy, Rule of Code audits this website and publishes the real result. If the audit fails, the deploy fails. A site that claims to enforce a constitution while not passing its own is the exact artifact this product exists to kill.
It passed — with 16 laws of visible debt we don't hide. Passing was never the same as perfect. Here is every number, unedited.
Generated, never hand-written. Last run: npx ruleofcode audit --mode=full
The result, unedited
Passed — and 16 laws we haven't satisfied yet.
Green does not mean perfect. It means zero errors and a live law set above the floor. Everything short of satisfied is shown below as visible debt — a warning, never a hidden waiver. A hidden waiver is worse than debt you can see.
The debt ledger
Every law we haven't earned yet — all 16, most-owed first.
No competitor publishes this, because no competitor dares. A tool that hides its own debt is exactly the tool you shouldn't trust. The number next to each is its violation count.
Not applicable — argued, not hidden
13 laws don't apply here. Each says why, with a date and an author.
"Unknown" and "not applicable" are different words. A waiver without a reason is a hidden lie. These carry theirs.
The concern does NOT exist: the site is prerendered static and has NO NgRx store — the data is build-time JSON from `laws --json`, not runtime state. (FE, 2026-07-15)
The concern does NOT exist: the site makes NO HTTP requests — the registry is imported as build-time JSON. There is no HTTP layer. (FE, 2026-07-15)
No authentication surface: prerendered static site, build-time JSON data, no logins/sessions/tokens/protected resources. (FE, 2026-08-04)
No API to test: the SSR Express server serves only prerendered HTML; there is no request-handling API surface. (FE, 2026-08-04)
No backend or API surface to security-test; the site is prerendered static served over SSR. (FE, 2026-08-04)
No API: there are no endpoints to test; data is imported as build-time JSON. (FE, 2026-08-04)
No runtime production service: incident response is an org/ops process, not a property of a prerendered static site. (FE, 2026-08-04)
Monolingual product by decision: the site ships in English only; there is no i18n requirement. (FE, 2026-08-04)
No NgRx and no runtime store to inspect; the devtools mandate does not apply. (FE, 2026-08-04)
No API and no deployed server: firebase.json publishes only dist/apps/web/browser and declares no Functions, so apps/web/src/server.ts is a build-time prerenderer that never runs in production — its only route example is commented out in the Angular template. There is nothing to authenticate, rate-limit or CORS. The HTTPS-redirect finding is not answerable either: Firebase Hosting serves HTTPS and redirects to it with no setting to declare. (FE, 2026-08-18)
No running service to health-check: the deployed artefact is prerendered HTML on static hosting, with no server process, no database and no external service dependency. Liveness here means the pages answer, which the post-deploy verification in PRE_DEPLOYMENT_CHECKLIST.md checks against the live site on every release. (FE, 2026-08-18)
No telemetry by promise, not by omission: every finding here — Real User Monitoring, error tracking, alerts, dashboards — needs a backend collecting from readers, and this site tells them it has none. The sentence "No account, no service, no telemetry" is published on /start, and global-error-handler.ts records the same decision in code. Satisfying this law would require breaking a claim the product makes to its readers. What CAN be measured without watching anyone is measured: the build fails on Angular budgets, and artefact.perf.spec.ts asserts page weight and asset hashing against the shipped output. (FE, 2026-08-20)
Same concern as performance-monitoring-policy and the same answer: RUM, monitoring tools and error tracking all require collecting from readers, which this site publicly promises not to do. Not "we have not got to it" — there is no runtime service here at all: firebase.json publishes dist/apps/web/browser and declares no Functions, so nothing of ours runs anywhere to be monitored. (FE, 2026-08-20)
The deepest honesty
Some of our debt is the tool being wrong — and we said so, in public.
When a law fails here because the checker cannot see what it is looking for, we do not silence it — we file it against the tool and leave the law red. This list is that record, read from the tracker rather than written from memory: 6 open, 67 closed, 73 in total.
67 already fixed — the maintainer closed them
Generated from gh issue list --repo Rule-Of-Code/RoC --state all on 2026-08-29. Every line here is a link you can open and judge for yourself — which is the only kind of "the tool is wrong" claim worth publishing.
The numbers on this page are real, or this page isn't here.
Generated at deploy from an actual audit. A red one never ships — so if you're reading this, it passed, debt and all.