Seven of my own landing pages described test suites nobody had written. They were live for nine days — while my CV linked to those pages inviting the reader to go and audit them. The fix that day was manual. This is the part that should not have been: a check that reads a published page, pulls out every claim that can be verified, and fails the build when the repository does not back it.
On 16 July 2026 I audited my own portfolio. What I found was not a typo.
The same invented test_robustness file appeared in six repositories, with coverage figures and latencies nobody had ever run. All seven pages carried the same date. One of them went as far as insisting in writing that the figures were measured rather than estimated.
Three landings had a "View the code" button pointing at repositories that publish only a licence and a readme. An architecture write-up is real work and sells as such — what breaks trust is letting a reader infer an implementation, then losing them on the next click.
A hardware detail leaked into seven public readmes while the CV and the landings used the careful phrasing. The rule existed and was being applied — everywhere people look. A rule applied only where people look is a coat of paint.
Documenting from a stale local checkout describes software that no longer exists. And raw.githubusercontent.com cheerfully returns HTTP 200 for branches that were never there, so "I checked the raw file" proves nothing at all.
"No source in the repo, it does not get written" had been my rule for months. It is a good rule. It failed because enforcing it depended on a person reading every line of every page every time — and the failure mode is not malice, it is completion. Text flows, one more sentence sounds right, and the sentence is furniture. Writing the rule down is what failed. So it became code.
| Check | Fails when | Default |
|---|---|---|
denylist | A term that must never reach a public surface appears on one | FAIL |
path-claim | The page names a file path that is not in the repository | FAIL |
test-claim | The page names a test that appears in no source file | FAIL |
code-promise | The page says "view the code" and the repo publishes almost none | FAIL |
measured-claim | A number is presented as measured with no source marker | WARN |
To mark a number as sourced, put the source beside it. The gate does not re-derive the figure — it insists that somewhere, someone can.
<!-- source: runs/2026-08-04-rtx.json --> <p>Measured throughput: 10.5 tok/s.</p>
Every target is fetched fresh from origin before anything is checked. That is not caution, it is the second half of the same incident: the checkout on disk was behind, and a page validated against it would have passed while lying. Whichever branch the remote hands back is the one that counts — so a portfolio split across main and master never has to be configured.
Pages can be local files, checked before they ship, or URLs, checked as actually served. The second one is what a reader really clicks.
A gate that cries wolf gets switched off, and a gate switched off is worse than none — it leaves the belief that something is watching. Both calibrations below are rules, not conveniences.
tests/test_robustness with a directory in it can only be a file in this repository — if it is missing, the page lies. A bare name might be a third-party library. The dividing line is how ambiguous the token is, never a hand-maintained list of exceptions, because that list is the thing that rots.
"There is no coverage measurement in this repository, so this page will not quote you one" is exactly the writing the rule wants. A gate that flags it teaches you to stop declaring your ceilings — which is how you get back to the original problem by a different road.
Two pages ship with the repository. The red one reproduces each real mistake and must trip all five checks and exit 1. The green one is the honest version of the same page — correct phrasing, a file that exists, a sourced number, a ceiling declared out loud — and must pass in silence.
Every block is a mistake this portfolio actually made. If any check stops tripping, the gate has quietly stopped working.
The same content, written correctly. If anything trips here, the gate is punishing the writing it exists to reward.
This verifies verifiable claims. It reads a page, extracts the things that can be checked against a working tree, and checks them. It cannot tell you whether a sentence is true.
"Designed for high availability" passes, because there is nothing in it to check. A number with a source marker passes because the marker is there — the gate does not open the file and recompute it. Those are real holes and I am not going to pretend otherwise on the page whose entire subject is not doing that.