From 327a3ff071d38025f49432a025e687fc1e944829 Mon Sep 17 00:00:00 2001 From: eskokoivula <117045464+eskokoivula@users.noreply.github.com> Date: Fri, 30 Oct 2026 11:20:50 +0200 Subject: [PATCH 1/3] docs: record why deep SEO audits stay out of the skill Co-Authored-By: Claude Opus 5.5 --- DECISIONS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/DECISIONS.md b/DECISIONS.md index bf9dbbe..2d85736 100644 --- a/DECISIONS.md +++ b/DECISIONS.md @@ -35,3 +35,4 @@ Choices that neither the code nor the git log shows, newest first. One line each - 2026-10-29: The evals run on two invented domains under the reserved `.example` top-level domain instead of the pilot site and a real site that is not Esko's; eval runs are gitignored because their answers name the user and their setup. - 2026-10-29: MIT licence, copyright BuildexLabsAI, as the material-3 skill is MIT. - 2026-10-29: The audit step names the public skill `objective-brand-audit` (`BuildexLabsAI/objective-brand-audit`) instead of the private brand-audit skill the build used, because a public user cannot install a private skill; the public copy keeps the same phases 1–4 and `data/findings.md`, but writes English reports only, so the full report is in English. +- 2026-10-30: No deeper SEO audit inside the skill and no audit-type question at intake (brand audit + light SEO, page audit + light SEO, page audit + full SEO), because the skill's job is to keep a site's design without breaking it: SEO stays a guard (`livecheck.py seo`, every fact unchanged after a change), the audit's light SEO comes from the brand audit's phases 1–4 (title, description, og:image, JSON-LD, PageSpeed), and a client who wants a deep SEO audit gets a separate SEO audit skill. No real site has needed more yet, and the question would slow every run (Esko). From 8f72589af987a738b75b382d26937b92f58ccb7e Mon Sep 17 00:00:00 2001 From: eskokoivula <117045464+eskokoivula@users.noreply.github.com> Date: Fri, 30 Oct 2026 11:24:15 +0200 Subject: [PATCH 2/3] ci: ignore the planted test key in gitleaks The invented test site carries a fake key on purpose; tests/run_all.py checks that no skill output repeats it. The fingerprints cover the git and the folder scan. Co-Authored-By: Claude Opus 5.5 --- .gitleaksignore | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 .gitleaksignore diff --git a/.gitleaksignore b/.gitleaksignore new file mode 100644 index 0000000..c950fc9 --- /dev/null +++ b/.gitleaksignore @@ -0,0 +1,5 @@ +# Planted fake key in the invented test site: tests/run_all.py checks that no skill output ever repeats it. +ee1342f84ff714ea6ef8d0ebbf38f66807beaf2a:tests/fixtures/code-site/lib/keys.ts:generic-api-key:2 +ee1342f84ff714ea6ef8d0ebbf38f66807beaf2a:tests/run_all.py:generic-api-key:72 +tests/fixtures/code-site/lib/keys.ts:generic-api-key:2 +tests/run_all.py:generic-api-key:72 From 94e3bbc9e71411bea2801bb3daf901a7a20476fa Mon Sep 17 00:00:00 2001 From: eskokoivula <117045464+eskokoivula@users.noreply.github.com> Date: Fri, 30 Oct 2026 11:28:08 +0200 Subject: [PATCH 3/3] docs: drop the SEO line from DECISIONS.md Esko: the SEO answer is not a project decision. Co-Authored-By: Claude Opus 5.5 --- DECISIONS.md | 1 - 1 file changed, 1 deletion(-) diff --git a/DECISIONS.md b/DECISIONS.md index 2d85736..bf9dbbe 100644 --- a/DECISIONS.md +++ b/DECISIONS.md @@ -35,4 +35,3 @@ Choices that neither the code nor the git log shows, newest first. One line each - 2026-10-29: The evals run on two invented domains under the reserved `.example` top-level domain instead of the pilot site and a real site that is not Esko's; eval runs are gitignored because their answers name the user and their setup. - 2026-10-29: MIT licence, copyright BuildexLabsAI, as the material-3 skill is MIT. - 2026-10-29: The audit step names the public skill `objective-brand-audit` (`BuildexLabsAI/objective-brand-audit`) instead of the private brand-audit skill the build used, because a public user cannot install a private skill; the public copy keeps the same phases 1–4 and `data/findings.md`, but writes English reports only, so the full report is in English. -- 2026-10-30: No deeper SEO audit inside the skill and no audit-type question at intake (brand audit + light SEO, page audit + light SEO, page audit + full SEO), because the skill's job is to keep a site's design without breaking it: SEO stays a guard (`livecheck.py seo`, every fact unchanged after a change), the audit's light SEO comes from the brand audit's phases 1–4 (title, description, og:image, JSON-LD, PageSpeed), and a client who wants a deep SEO audit gets a separate SEO audit skill. No real site has needed more yet, and the question would slow every run (Esko).