⎔ Live self-audit · generated at deploy

This site is judged by its own law.

On every deploy, Rule of Code audits this website and publishes the real result. If the audit fails, the deploy fails. A site that claims to enforce a constitution while not passing its own is the exact artifact this product exists to kill.

It passed — with 16 laws of visible debt we don't hide. Passing was never the same as perfect. Here is every number, unedited.

Generated, never hand-written. Last run: npx ruleofcode audit --mode=full

The result, unedited

Passed — and 16 laws we haven't satisfied yet.

Green does not mean perfect. It means zero errors and a live law set above the floor. Everything short of satisfied is shown below as visible debt — a warning, never a hidden waiver. A hidden waiver is worse than debt you can see.

103
passed — clean
16
visible debt — warnings, shown in full
13
not applicable — argued, dated
96
score — out of 100
Audit liveness — laws that actually ran vs the floor that must be met119 ran · floor 117
119 laws executed117 = the floor; below it the audit REFUSESthe tool won't certify a subset as the whole

The debt ledger

Every law we haven't earned yet — all 16, most-owed first.

No competitor publishes this, because no competitor dares. A tool that hides its own debt is exactly the tool you shouldn't trust. The number next to each is its violation count.

16laws in visible debt · sorted by violations
visible debtunit-test-quality-standards4 violations
visible debtci/cd-constitutional-tribunal4 violations
visible debtpull-request-workflow-standards2 violations
visible debtconstitutional-compliance-headers2 violations
visible debtperformance-standards2 violations
visible debtperformance-budget-compliance2 violations
visible debttest-data-management2 violations
visible debtautomation-first-principle1 violation
visible debtcode-review-quality1 violation
visible debtcore-web-vitals-compliance1 violation
visible debtcdn-and-caching-strategy1 violation
visible debttest-coverage-constitutional-standard1 violation

Not applicable — argued, not hidden

13 laws don't apply here. Each says why, with a date and an author.

"Unknown" and "not applicable" are different words. A waiver without a reason is a hidden lie. These carry theirs.

not applicablengrx-state-normalization-mandate

The concern does NOT exist: the site is prerendered static and has NO NgRx store — the data is build-time JSON from `laws --json`, not runtime state. (FE, 2026-07-15)

not applicableerror-handling-standards

The concern does NOT exist: the site makes NO HTTP requests — the registry is imported as build-time JSON. There is no HTTP layer. (FE, 2026-07-15)

not applicableauthentication-security

No authentication surface: prerendered static site, build-time JSON data, no logins/sessions/tokens/protected resources. (FE, 2026-08-04)

not applicableapi-security-testing-requirements

No API to test: the SSR Express server serves only prerendered HTML; there is no request-handling API surface. (FE, 2026-08-04)

not applicablecomprehensive-security-testing-requirements

No backend or API surface to security-test; the site is prerendered static served over SSR. (FE, 2026-08-04)

not applicableapi-testing-standards

No API: there are no endpoints to test; data is imported as build-time JSON. (FE, 2026-08-04)

not applicableincident-response-protocol

No runtime production service: incident response is an org/ops process, not a property of a prerendered static site. (FE, 2026-08-04)

not applicableinternationalization-i18n-compliance-policy

Monolingual product by decision: the site ships in English only; there is no i18n requirement. (FE, 2026-08-04)

not applicablengrx-devtools-integration-mandate

No NgRx and no runtime store to inspect; the devtools mandate does not apply. (FE, 2026-08-04)

not applicableapi-security-standards

No API and no deployed server: firebase.json publishes only dist/apps/web/browser and declares no Functions, so apps/web/src/server.ts is a build-time prerenderer that never runs in production — its only route example is commented out in the Angular template. There is nothing to authenticate, rate-limit or CORS. The HTTPS-redirect finding is not answerable either: Firebase Hosting serves HTTPS and redirects to it with no setting to declare. (FE, 2026-08-18)

not applicablehealth-check-monitoring

No running service to health-check: the deployed artefact is prerendered HTML on static hosting, with no server process, no database and no external service dependency. Liveness here means the pages answer, which the post-deploy verification in PRE_DEPLOYMENT_CHECKLIST.md checks against the live site on every release. (FE, 2026-08-18)

not applicableperformance-monitoring-policy

No telemetry by promise, not by omission: every finding here — Real User Monitoring, error tracking, alerts, dashboards — needs a backend collecting from readers, and this site tells them it has none. The sentence "No account, no service, no telemetry" is published on /start, and global-error-handler.ts records the same decision in code. Satisfying this law would require breaking a claim the product makes to its readers. What CAN be measured without watching anyone is measured: the build fails on Angular budgets, and artefact.perf.spec.ts asserts page weight and asset hashing against the shipped output. (FE, 2026-08-20)

not applicableperformance-monitoring-standards

Same concern as performance-monitoring-policy and the same answer: RUM, monitoring tools and error tracking all require collecting from readers, which this site publicly promises not to do. Not "we have not got to it" — there is no runtime service here at all: firebase.json publishes dist/apps/web/browser and declares no Functions, so nothing of ours runs anywhere to be monitored. (FE, 2026-08-20)

The deepest honesty

Some of our debt is the tool being wrong — and we said so, in public.

When a law fails here because the checker cannot see what it is looking for, we do not silence it — we file it against the tool and leave the law red. This list is that record, read from the tracker rather than written from memory: 6 open, 67 closed, 73 in total.

67 already fixed — the maintainer closed them
Closed config-integrity-guard: the only non-law key it tolerates is /^law-\d+$/, so a $comment in laws.notApplicable fails the audit and $-comments in ignores.byRule warn on every runbug #130 · closed 2026-08-28 · config-integrity-guardClosed reinstall-hooks: validateHooks() checks commit-msg against the literal 'RuleOfCode' instead of the version, so a stale hook reports as up to datebug #129 · closed 2026-08-28 · reinstall-hooksClosed commit-msg: subject length is measured in bytes and reported as characters, and the body check changes unit with the localebug #128 · closed 2026-08-28 · commit-msgClosed code-complexity-control: calculateFileComplexity() counts split('\n').length, so every newline-terminated file measures one line too long and a file at exactly maxFileLines is rejectedbug #127 · closed 2026-08-28 · code-complexity-controlClosed code-duplication-control: normalizeCode() strips whitespace before comments, so an all-comment block collapses to an empty-string key and collides with any other file's comment-led blockbug #126 · closed 2026-08-28 · code-duplication-controlClosed unit-test-quality: the edge-case proxy only speaks in JS values, so an integration suite's empty-list and absence assertions read as no edge cases (11 of 13 here)bug #125 · closed 2026-08-28 · unit-test-qualityClosed performance-test-requirements: config-file detection scans TypeScript only, so all four paths are dead, and bundle size is matched by vendor namebug #109 · closed 2026-08-26 · performance-test-requirementsClosed core-web-vitals-compliance passes on an 18-byte file: the Lighthouse check tests existence and a substring, not a gatebug #108 · closed 2026-08-26 · core-web-vitals-complianceClosed pre-deployment-checklist: a sub-check defers to a waiver but not to the owning law passingbug #107 · closed 2026-08-26 · pre-deployment-checklistClosed code-complexity-control: maxComplexity governs a raw function count, so a routing table with 2 decisions trips it at 22 lambdasbug #106 · closed 2026-08-25 · code-complexity-controlClosed magic-number-prevention scans inside string literals and does not accept an object property as a name (217 hits here, 0 real)bug #105 · closed 2026-08-25 · magic-number-preventionClosed constitutional-supremacy and continuous-compliance match a script by name and never read what it runsbug #104 · closed 2026-08-26 · constitutional-supremacyClosed performance-standards and cdn-caching-strategy miss caching that core-web-vitals' own analyzer confirmsbug #103 · closed 2026-08-26 · performance-standardsClosed unit-test-quality: edge-case detection reads it() and describe() but not test(), so Playwright titles are invisiblebug #102 · closed 2026-08-25 · unit-test-qualityClosed automated-code-quality-gates: coverage threshold read only from the root jest config, which an Nx workspace keeps emptybug #98 · closed 2026-08-18 · automated-code-quality-gatesClosed pre-deployment-checklist-mandatory: sub-checks re-demand concerns that notApplicable already answeredbug #96 · closed 2026-08-18 · pre-deployment-checklist-mandatoryClosed performance laws report budgets, bundle optimization and resource hints as missing while other laws find them presentbug #95 · closed 2026-08-18 · performanceClosed environment-parity-standards: Angular/Nx build configurations are not recognised as environment configbug #94 · closed 2026-08-18 · environment-parity-standardsClosed test-coverage-constitutional-standard: counts 1 test file where 27 match its own isTestFilebug #93 · closed 2026-08-26 · test-coverage-constitutional-standardClosed pre-pr-quality-gates: isServerSideProtectionHost reads .git/config as a path, so the law fails inside a git worktreebug #86 · closed 2026-08-17 · pre-pr-quality-gatesClosed commit-size-control: a lockfile makes any dependency update uncommittable — no exclusions, no baselinebug #85 · closed 2026-08-17 · commit-size-controlClosed unit-test-quality: 'Awaiting non-promise values' regex flags three-level calls and line-wrapped chainsbug #84 · closed 2026-08-17 · unit-test-qualityClosed Commit-history laws never report the baseline they resolved, so a stale local ref is indistinguishable from a foreign commit blocking youenhancement #83 · closed 2026-08-17Closed branch-governance and feature-branch-protection disagree on valid branch names; chore/ is suggested by one and rejected by the otherbug #80 · closed 2026-08-17 · branch-governanceClosed semantic-versioning-standards: checkGitTags() tests the whole tag name against SemVer, so namespaced release tags failbug #77 · closed 2026-08-13 · semantic-versioning-standardsClosed release-tag-standards: isValidTagFormat() rejects every namespaced tag, so release/vX.Y.Z fails on its prefixbug #76 · closed 2026-08-13 · release-tag-standardsClosed database-query-optimization: DATABASE_CLIENTS regex matches any package with 'firebase' in its namebug #74 · closed 2026-08-13 · database-query-optimizationClosed bundle-optimization-strategy-policy and advanced-bundle-optimization-policy are the same detector, and both look for webpack keys an esbuild workspace must not have #73 · closed 2026-08-13 · bundle-optimization-strategy-policyClosed launch-readiness-checklist: security-review and monitoring-readiness detectors miss standard/first-party conventionsbug #71 · closed 2026-08-13 · launch-readiness-checklistClosed commit-size-control: merge commits occupy the 10-commit window but git log --stat gives them no diffstat, so the real sample is smaller than reported #70 · closed 2026-08-13 · commit-size-controlClosed magic-number-prevention never threads context.lawId through, so ignores.byRule cannot exempt any file from itbug #69 · closed 2026-08-13 · magic-number-preventionClosed magic-number-prevention: no exemption pattern for the HH:MM:SS portion of a full ISO 8601 datetime literalbug #68 · closed 2026-08-13 · magic-number-preventionClosed md-footer-template: footer-boundary regex captures from the first '---' in the file, not the last, so earlier prose can be misread as the ratingbug #64 · closed 2026-08-11 · md-footer-templateClosed health-check-monitoring: SERVER_DEPS list matches devDependencies, 'http-server' (a static-file server) false-positives a client as a backend servicebug #63 · closed 2026-08-11 · health-check-monitoringClosed #53's Firebase-headers fix landed in one analyzer; three sibling analyzers (asset/http2/browser-caching) are still unfixedbug #62 · closed 2026-08-11Closed hasCICDConfiguration() fix (#48) didn't reach 3 sibling CI detectors with their own hardcoded provider listsbug #61 · closed 2026-08-11Closed merge-conflict-prevention flags every merge commit, resolved or not, because it checks MERGE_HEAD existencebug #56 · closed 2026-08-11 · merge-conflict-preventionClosed --mode=pre-commit law-selection count is non-deterministic between identical runsbug #55 · closed 2026-08-11Closed code-documentation-standards: comment-ratio counter misclassifies JSDoc continuation lines as codebug #54 · closed 2026-08-11 · code-documentation-standardsClosed core-web-vitals/cdn-caching-strategy: Firebase Hosting headers schema misread as a dictionary, plus Nx/angular.json assumptionsbug #53 · closed 2026-08-11Closed md-footer-template: rating regex breaks on bolded labels, and file discovery ignores includes/ignores configbug #52 · closed 2026-08-11 · md-footer-templateClosed i18n-compliance-policy translation-file discovery is still hardcoded to root-relative pathsbug #51 · closed 2026-08-11 · i18n-compliance-policyClosed health-check-monitoring still misclassifies a client-side health probe as a backend servicebug #50 · closed 2026-08-11 · health-check-monitoringClosed performance-test-requirements: is*File/is*Config predicates crash when called unbound, silently reported as falsebug #49 · closed 2026-08-11 · performance-test-requirementsClosed hasCICDConfiguration() hardcodes 6 CI providers, missing Cloud Build (and others)bug #48 · closed 2026-08-11Closed Default commit-msg pattern rejects the Conventional Commits '!' breaking-change markerbug #47 · closed 2026-08-11Closed commit-msg hook does not enforce the subject length that Commit Message Standards auditsbug #46 · closed 2026-08-11 · commit-msgClosed Violations report a count but never the artefacts, and --verbose does not helpbug #42 · closed 2026-08-09Closed jest-unit-test-100%-coverage-mandate reports thresholds as unconfigured in an Nx workspacebug #40 · closed 2026-08-09Closed test-coverage-constitutional-standard does not honour ignores.byRulebug #39 · closed 2026-08-09 · test-coverage-constitutional-standardClosed performance-test and environment-parity discovery misses Nx project layoutbug #38 · closed 2026-08-09 · performance-testClosed Git-history laws in the pre-commit hook deadlock the fix for a history violationbug #37 · closed 2026-08-09Closed class-documentation check misses every decorated Angular classbug #36 · closed 2026-08-09 · class-documentationClosed code-complexity-control sums per file but is thresholded per functionbug #35 · closed 2026-08-09 · code-complexity-controlClosed health-check and i18n laws miss client-shaped and Nx-shaped projectsbug #34 · closed 2026-08-09 · health-checkClosed md-footer-template: the only valid investment rating is 10/10 SUPREME EXCELLENCEbug #33 · closed 2026-08-09 · md-footer-templateClosed Performance and CDN laws miss Nx project.json budgets and bitbucket-pipelines.ymlbug #32 · closed 2026-08-09Closed angular-testing-excellence misreads parameterised and quote-containing test namesbug #30 · closed 2026-08-09 · angular-testing-excellenceClosed typescript-strict requires moduleResolution node, which is wrong for bundler-based Angularbug #28 · closed 2026-08-09 · typescript-strictClosed init writes ruleofcode.config.js but the audit reads ruleofcode.config.jsonbug #27 · closed 2026-08-09Closed seeded-randomness: no way to distinguish a crypto-grade id factory from ambient randomnessenhancement #26 · closed 2026-08-17 · seeded-randomnessClosed Config: "notApplicable" written as a laws.severity value is silently ignored (and an unknown slug in laws.notApplicable waives nothing)bug #25 · closed 2026-08-09Closed environment-parity-standards: build-config check scans a hardcoded JS-only file list, unsatisfiable on Pythonbug #24 · closed 2026-08-09 · environment-parity-standardsClosed Should the package run a postinstall script at all?question #22 · closed 2026-08-09Closed Git Hook Compliance flags every hook as non-executable on Windowsbug #15 · closed 2026-08-08Closed satisfiedBy keys and stack values use different vocabulariesdocumentationquestion #11 · closed 2026-08-08Closed Intermittent SIGABRT (exit 134) during audit — reproduction neededbugquestion #10 · closed 2026-08-08

Generated from gh issue list --repo Rule-Of-Code/RoC --state all on 2026-08-29. Every line here is a link you can open and judge for yourself — which is the only kind of "the tool is wrong" claim worth publishing.

The numbers on this page are real, or this page isn't here.

Generated at deploy from an actual audit. A red one never ships — so if you're reading this, it passed, debt and all.