PageScope

Most audit tools fetch a page with a browser and hand back a score. PageScope fetches with HTTP, parses what the server actually sent, runs 13 rules and returns a finding only where it has something to point at. The report also states what it did not look at: no JavaScript, no crawling, no WCAG conformance claim, no exploitability claim. Those omissions are the design, because an audit that guesses is worse than one that says which questions it could not answer.

An automated audit has one failure mode that matters: asserting something it did not observe. A missing title reported alongside a title tag that was never there. A page that needs JavaScript scored as though its body were empty. A missing security header rewritten as an exploit. Every one of those reads as a result when it is not one, and a reader has no way to tell which findings came from a measurement and which came from a default.

• Designed the contracts: a snapshot in, a result out, so a rule cannot issue a second request or invent evidence.
• Wrote all 13 rules across SEO, technical, accessibility and security, each a pure function of one snapshot.
• Built the engine: statuses, coverage, and limitations derived from coverage rather than written by hand.
• Wrote the CLI, the four reporters and the baseline mode that lets a CI gate ignore findings already known.
• Wrote the SSRF guard: address classification inside the DNS lookup callback, IP literals checked separately, every redirect hop re-validated.

1. 01

   A status for every state, including the honest ones

   passed · failed · needs-review · not-applicable · unobservable · error

   A rule that did not run is never reported as passed, and a rule's return type cannot even express unobservable or error, so the engine owns those two. Unobservable stays separate from not-applicable because finding no images on a page you could read and failing to see the body at all are different claims, and reporting both the same way told the reader nothing.

2. 02

   Evidence is a type, not a sentence

   html-snippet · http-header · http-response · measurement · absence

   Every finding carries at least one piece of evidence from a discriminated union. Absence exists so that a search which found nothing can be stated as itself: a missing title never arrives next to a title tag that was never served.

3. 03

   The limitations are derived, not written

   engine/limits.ts, limitationsFor(coverage)

   Each report states what it deliberately did not inspect. Those sentences are generated from the coverage block, so removing an item when the feature ships removes the sentence from every report without anyone remembering to edit it.

4. 04

   The rule list cannot change quietly

   packages/core/test/engine/audit.test.ts

   A test asserts the rule count, so registering a rule fails the suite until the number is updated. That friction is the point: a change to the public rule list becomes visible in review instead of appearing in a release note.

5. 05

   A gate that only fails on what is new

   createBaseline · applyBaseline · --min-confidence

   A gate that fails on findings you already know about gets switched off within a week. A baseline records the current state, and identity is a hash of the rule id plus a semantic discriminator rather than a line number, so inserting a paragraph above a finding does not make the baseline forget it.

6. 06

   Fetching a URL someone else chose is the risk

   packages/core/test/collection/ip-guard.test.ts

   Every resolved address is classified before a socket opens: loopback, private ranges, link-local including the cloud metadata address, CGNAT, multicast and reserved space. Classification runs inside the DNS lookup callback, so the address validated is the address connected to, and IP literals take the same check because Node skips DNS when the host is already an address.

• 01

  Not published to npm

  Both packages are version 0.1.0 and neither is on the registry, so npx pagescope does not work yet. Running it means cloning and building. The release checklist names two hygiene items rather than smoothing them over, one of them being that the v0.1.0 tag predates the version alignment.

• 02

  No JavaScript execution

  Only the raw HTML response is inspected. A browser would make every run slower and unusable on a bare CI runner. The two rules that need the rendered DOM report unobservable on pages it detects as client-rendered, instead of a false pass.

• 03

  One page per run

  Links are not crawled. Crawling changes the security model and the promise of the tool, so it stays a separate question rather than a flag.

• 04

  Detection is deliberately narrow

  A page is called client-rendered only when there is a recognised mount element with no children, or an explicit enable-JavaScript message. A missed detection costs a rule its unobservable status; a guessed detection would cost the tool its credibility.

• 05

  No score, and no hosted service

  One number hides which findings are guesses, so there is no score. There is also no public endpoint, by design. Anyone exposing an instance owns the authentication, rate limiting and egress isolation it does not provide.

It runs as a CLI, as a library, and as an opt-in gate that fails a build only on findings it has not seen before. The two packages are still pre-release, so this is a working tool with an unpublishable install line rather than a shipped one. What it will not do is the part worth reading: it will not score a page, will not guess at a body it could not see, and will not turn an absent header into a claim about what an attacker can do with it.