Assay

Marketing site for Assay: independent verification for AI-authored code.

Astro 7 + TypeScript, Tailwind v4, no component library. Static output.

Running it

Needs Node 22.12 or newer (Astro 7 requires it). .nvmrc pins 22.

nvm use
npm install
npm run dev      # http://localhost:4321
npm run build    # → dist/
npm run preview  # serve dist/ exactly as a static host would
npm run check    # astro check, then build, then the protected-copy guard
npm run check:copy  # the copy guard alone, against an existing dist/

npm run check must stay at 0 errors. It builds before checking copy because the protected lines are verified against the rendered HTML, not the source: a line can be intact in a component and still reach the page split by an inline tag or run on into the next clause.

Protected lines live in PROTECTED-COPY.md, which is the single source the guard reads. Add a line there and it is enforced from the next run.

Deploy target is Vercel, live at https://assay.website. No vercel.json is needed: the output is plain static files and the defaults serve them correctly.

Commits must be authored by an email on the Vercel team, or Vercel blocks the deployment with "Git author ... must have access to the team". The repo-local git identity is set accordingly.

Homepage and email capture

Shared navigation now leads to Benchmark, How it works and Evidence. The dark visual direction lives in src/styles/landing.css. The hero animation retains its timeline, with an explicit Play demo option for reduced-motion visitors. The content migration and claim boundaries are recorded in docs/content-map.md. Historical reports keep their URLs; consolidated top-level URLs redirect. Provider results are computed from the committed pilot records, not handwritten marketing figures. Tested tools are not presented as live integrations.

ContactButton.astro opens the shared EmailModal.astro with contact-specific copy. Email addresses post to the existing Loops newsletter endpoint in src/lib/site.ts, with userGroup=talk-to-team. Existing Index and benchmark waitlists keep their own groups. This collects contacts in Loops; any internal notifications or follow-up automation must be configured in Loops itself.

Hosted scoring remains gated by both PUBLIC_BENCHMARK_API and PUBLIC_BENCHMARK_SCORING=1. Until the backend is deployed, the homepage labels scoring as coming soon and links to the existing benchmark/waitlist.

Before launch

Security reports use GitHub private vulnerability reporting via SECURITY_ADVISORY_URL; enable it under Settings > Code security. The shared navigation uses the Loops contact popup on every page.

Structure

src/
  components/     one file per section, plus the primitives
  layouts/        BaseLayout (shell, SEO, JSON-LD), PostLayout (markdown)
  lib/
    site.ts       nav, footer, method version, signup endpoint
    og.ts         build-time Open Graph card
    highlight.ts  build-time JSON tokeniser
  pages/
    index.astro                 home
    the-index.astro             /the-index
    methodology.astro           /methodology
    about.astro                 /about
    research/index.astro        blog index
    research/*.md               posts
    og.png.ts                   renders /og.png at build time
  styles/global.css             tokens, both themes, primitives
public/fonts/                   latin-subset woff2, self-hosted

Decisions worth knowing

/the-index, not /index. The brief asked for /index. That route is not available on a static host: the home page is index.html, so a request for /index resolves to the home page before the resolver ever tries index/index.html. Verified against astro preview, which serves the built output the way a static host does. /the-index matches the nav label and cannot collide.

Three tokens deviate from the brief, all for WCAG AA. Each is commented in global.css with its measured ratio:

Token	Brief	Shipped	Why
--graphite	#5A6068	#4E545C	6.08:1 on --paper; the original failed
--graphite-d	#8A919B	#9AA1AB	6.96:1 on --ink-bg
--blue	#1B5FD9	#1A55C6	was 4.09:1 on --paper-2, so eyebrows on tinted sections failed

The code-comment colour in CodePanel.astro moved for the same reason.

The chart draws bars in SVG but sets its labels in HTML. A single scaled viewBox holding <text> renders labels at roughly 6px on a phone, because text scales with the viewBox. Stretching axis-aligned rectangles is exactly what a bar chart does, so nothing distorts, and the type stays on the site scale at every width. There is a visually hidden data table alongside it.

The OG card converts text to vector paths. sharp renders SVG through librsvg, which ignores @font-face, so anything left as <text> silently falls back to whatever font the build machine has. src/lib/og.ts lays glyphs out from the real Archivo and IBM Plex Mono files with manual kerning. It positions each glyph with a transform rather than baking the offset into getPath, because opentype.js emits an occasional NaN control point when given a fractional offset, and librsvg abandons the rest of that subpath without an error. The layout function throws on NaN so a broken card can never ship silently.

Grids declare grid-cols-1 at the base breakpoint. An implicit grid track is sized auto and can grow to an item's max-content, which pushed a horizontal scrollbar onto the page at mobile widths. Panels that scroll their own content also carry min-w-0, since grid and flex children default to min-width: auto.

Adding a research post

Drop a markdown file in src/pages/research/. The index picks it up and sorts by date; no registration step.

---
layout: ../../layouts/PostLayout.astro
title: ...
description: ...
date: 2026-09-01
author: ...
readingTime: 6 min read
---

House style

• No em dashes or en dashes in prose. Commas, colons, full stops. The only — on the site is the empty-value marker in the Index table.
• No "AI-native", "agentic" (except the CSA framework's actual name), "revolutionise", "empower", "seamless", "cutting-edge".
• Every statistic carries its source and year inline, in mono.
• Never claim customers, logos or testimonials. There are none yet.