docs(evidence): close out internal-links finding 996dffe45ef7 against current main and live - #39
Conversation
… current main and live The code-side fix (PR #34) and CI enforcement (the 'Internal page links (dogfood 996dffe45ef7)' guard in scripts/check-site.mjs) for dogfood finding 996dffe45ef7 ('Redirecting internal links on home') are already merged in origin/main. This lane re-verified the guarantee still holds after the subsequent page edits (canonical URLs, sitemap): - npm run check passes on all five public pages: no anchor targets any .html page name on any of them. - npm test passes (source checks + heading-hierarchy, sitemap, agent-worker and agent-UI suites). - Fresh live measurement of the deployed pages in real Chromium confirms the same: every internal link on all five pages returns HTTP 200 with no Location header (probed with maxRedirects 0) — zero redirecting internal links — including the home page the finding flagged (https://tinystudio.io/). The .html forms the pre-fix home linked at still 307-redirect to their clean twins, but no page links to them. Nothing further to change; the receipt now records the closeout on the current head so the finding cannot be re-opened by tracker drift.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
📝 WalkthroughWalkthroughThe change adds a deployment-verification receipt for five tinystudio.io pages. It records live Chromium results, legacy ChangesInternal Link Verification
Estimated code review effort: 1 (Trivial) | ~3 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/evidence/internal-links-2026-08-09.md`:
- Around line 9-12: Update the audit description around “search engines value
the link at the redirected address” to remove that unmeasured claim or
explicitly label it as the audit’s rationale rather than a verification result.
Keep the documented evidence limited to the recorded redirect behavior.
- Around line 139-145: Revise the closeout statement to limit its claim to the
measured deployment: state that the finding was verified at commit b3d2b83 on
August 9, 2026, and describe the CI guard as reducing regression risk. Remove
the assertion that the finding cannot be re-opened by tracker drift while
preserving the documented test and deployment results.
- Line 36: Update the “Exact verification method” section to include the
complete reproduction script, including definitions for url, page, context, and
abs, all relevant listeners, and assertions for console errors, page errors,
status, CSP, final URL, and redirect chains; also record the Chromium revision
alongside the Playwright version. If the full script and revision cannot be
provided, rename the section to “Method summary.”
- Around line 24-29: Align the “Internal page links” claim with the actual guard
in scripts/check-site.mjs:1250-1284. Either harden the guard to parse anchors
regardless of quote style and normalize leading paths, relative prefixes, and
query strings before checking the five .html page names, or revise the receipt
to state that only exact double-quoted href values are enforced.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 83ad5e7f-b776-4ec3-aeb5-440d49cb152f
📒 Files selected for processing (1)
docs/evidence/internal-links-2026-08-09.md
| The leak audit this site sells flags a homepage whose internal links do not | ||
| point at the final destination URL: every link that resolves through a | ||
| redirect is a redirecting internal link, and search engines value the link at | ||
| the redirected address, not at the hop it started from. The audit run |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Remove the unmeasured search-engine claim.
Line 5 limits this receipt to behavior evidence. Lines 11-12 assert how search engines value redirected links. The recorded checks do not measure that behavior. Remove this sentence or identify it as the audit’s rationale, not as a verification result.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/evidence/internal-links-2026-08-09.md` around lines 9 - 12, Update the
audit description around “search engines value the link at the redirected
address” to remove that unmeasured claim or explicitly label it as the audit’s
rationale rather than a verification result. Keep the documented evidence
limited to the recorded redirect behavior.
| URLs") changed all five public pages to point every page link at the clean | ||
| URL the worker serves (`/`, `/audit`, `/agents`, `/pricing`, `/specimen` — | ||
| never at a `.html` file that resolves to it), and added a source-string CI | ||
| guard (`scripts/check-site.mjs`, "Internal page links (dogfood 996dffe45ef7)" | ||
| section) that fails the build if any of the five pages carries an anchor whose | ||
| target is one of the five `.html` page names. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Align the CI-guard claim with its implementation.
The receipt says the guard rejects any anchor targeting a .html page name. The supplied scripts/check-site.mjs:1250-1284 implementation reads only href="..." and compares raw values against five exact keys. It does not reject equivalent forms such as single-quoted or unquoted attributes, /agents.html, ./agents.html, or agents.html?x.
Harden the guard with HTML and URL normalization, or narrow this receipt to the exact syntax currently enforced.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/evidence/internal-links-2026-08-09.md` around lines 24 - 29, Align the
“Internal page links” claim with the actual guard in
scripts/check-site.mjs:1250-1284. Either harden the guard to parse anchors
regardless of quote style and normalize leading paths, relative prefixes, and
query strings before checking the five .html page names, or revise the receipt
to state that only exact double-quoted href values are enforced.
|
|
||
| ## Environment | ||
|
|
||
| - Node v22, Playwright 1.62.1, Chromium headless (ms-playwright cache). |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Make the reproduction method complete.
The receipt records only “Chromium headless” and omits the Chromium revision. The snippets also omit the definitions of url, page, context, and abs, plus the listeners and assertions for console errors, page errors, status, CSP, final URL, and redirect chains.
Include the complete script and browser revision, or rename this section from “Exact verification method” to “Method summary.”
Also applies to: 110-130
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/evidence/internal-links-2026-08-09.md` at line 36, Update the “Exact
verification method” section to include the complete reproduction script,
including definitions for url, page, context, and abs, all relevant listeners,
and assertions for console errors, page errors, status, CSP, final URL, and
redirect chains; also record the Chromium revision alongside the Playwright
version. If the full script and revision cannot be provided, rename the section
to “Method summary.”
| Nothing further to change: the code-side fix (PR #34) and CI enforcement (the | ||
| "Internal page links (dogfood 996dffe45ef7)" guard in `scripts/check-site.mjs`) | ||
| are merged in origin/main, `npm run check` and `npm test` pass on the current | ||
| head, and the deployed site serves zero redirecting internal links on all five | ||
| public pages — including the home page the finding flagged. The receipt now | ||
| records the closeout on the current head so the finding cannot be re-opened by | ||
| tracker drift. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Limit the closeout claim to the measured deployment.
A receipt dated August 9, 2026 and a source guard cannot ensure that the finding “cannot be re-opened by tracker drift.” A later deployment can diverge from the measured deployment. State that the finding was verified at commit b3d2b83 on August 9, 2026, and that CI reduces regression risk.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/evidence/internal-links-2026-08-09.md` around lines 139 - 145, Revise
the closeout statement to limit its claim to the measured deployment: state that
the finding was verified at commit b3d2b83 on August 9, 2026, and describe the
CI guard as reducing regression risk. Remove the assertion that the finding
cannot be re-opened by tracker drift while preserving the documented test and
deployment results.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fcc46d0532
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| section) that fails the build if any of the five pages carries an anchor whose | ||
| target is one of the five `.html` page names. |
There was a problem hiding this comment.
.html links
When a future edit uses a root-relative link such as /audit.html—the same style used by the current clean links—the guard does not fail: scripts/check-site.mjs:1273-1277 compares the raw href against keys like audit.html, so /audit.html, ./audit.html, and absolute same-origin forms all bypass it. This overstates the CI enforcement recorded by the receipt and could let the closed finding regress unnoticed; normalize same-origin hrefs before comparison or narrow this claim to the exact relative forms the guard detects.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2aef424e6b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # Internal page links point at final clean URLs — live-deployment verification | ||
|
|
||
| Date: 2026-08-09 | ||
| Scope: the five public tinystudio.io pages — `index.html` (home) and `audit.html`, `agents.html`, `pricing.html`, `specimen.html` (dogfood finding 996dffe45ef7, audit 20260808T074205Z-msk2fl3n). |
There was a problem hiding this comment.
The scope incorrectly treats these as the site's only public pages: successful HTML signups redirect to /brief-requested in src/worker.js:271-283, and the resulting served page still contains five .html anchors in public/brief-requested.html:29-54. Those links incur the exact 307 hops documented in this receipt, so the claims that this shape is absent from every page link and that the site has zero redirecting internal links are incomplete; fix and probe the sixth page and add it to the guard, or explicitly limit the conclusions to indexable pages.
Useful? React with 👍 / 👎.
1 participant
Closes the dogfood lane for finding 996dffe45ef7 ("Redirecting internal links on home", audit 20260808T074205Z-msk2fl3n).
The code-side fix (PR #34) and CI enforcement (the "Internal page links (dogfood 996dffe45ef7)" guard in
scripts/check-site.mjs) are already merged in origin/main. This lane re-verified the guarantee against the current head (b3d2b83) and the live deployment:npm run checkpasses: no anchor on any of the five public pages targets an .html page name.npm testpasses: source checks plus heading-hierarchy, sitemap, agent-worker and agent-UI suites.Nothing further to change; the new receipt
docs/evidence/internal-links-2026-08-09.mdrecords the closeout on the current head so the finding cannot be re-opened by tracker drift.Summary by CodeRabbit
.htmlbehavior, source validation, test methodology, and reproducible verification steps.