git:20260908.ab222d4 to git:20260908.eaa73be

10 added, 8 removed. Audit A to A.

# x-md

Read [`AGENTS.md`](AGENTS.md) first — it holds the conventions for this repo (build order, design tokens,

landing copy frame, the error module, versioned routes, quotas, discovery documents, and the checks to run

before pushing). This file only adds what is specific to working here with Claude Code.

- - **Open work lives in [`TODO.md`](TODO.md).** Read it at the start of a session. Right now it tracks the

- agent-readiness push (getting x.pcstyle.dev to 100/100 on is-agentic): what is already on the branch, what

- needs a human, and what was deliberately left undone with the reasoning. Update it when you finish or

- change one of those items rather than letting it rot.

- Checks before pushing: `bun run test` and `bun run build` (the build starts with `tsc`, so a separate run is

redundant). After touching `lib/openapi.ts`, run `bun run openapi:build` and **commit** the regenerated

`public/openapi.json` — `bun run build` rewrites that file in place, so `openapi:check` can never fail

straight after a build; it is the CI guard against a stale committed copy.

- `main` takes a PR. Its ruleset requires the `build` and `CodeRabbit` checks, a deployment to the `Preview`

environment, **signed commits**, and the branch up to date with `main`. No approvals are required, and

merges must be squash or merge — rebase is disabled. An unsigned commit blocks the merge no matter how

green everything else is. Repo admins hold an always-on bypass; other contributors do not.

- - The `CodeQL` check is red on the open PR and that is expected: three alerts are knowingly open, one of them

- pre-existing and flagged critical. CodeQL is not a required check. Read TODO.md before "fixing" any of them —

- the two that are ours are false positives, and the obvious fixes would corrupt JSON bodies or clobber the

- `problem+json` content type.

+ - Two CodeQL alerts are dismissed as false positives, with the reasoning on the alerts themselves:

+ `js/xss-through-exception` in `lib/apierror.ts` and `js/reflected-xss` in `api/oembed.ts`. Both responses set

+ an explicit JSON content type via `setHeader` and the site sends `nosniff` globally; CodeQL flags

+ `res.send(string)` because Express infers `text/html` when no type is set. Do not "fix" them — HTML-escaping

+ inside a JSON body corrupts legitimate text, and `res.json()` would clobber the `problem+json` type the RFC

+ 9457 error handling depends on.

+ - Scoring work is measured against the scorer's own data, not guesswork: `https://ora.ai/api/checks` lists all

+ 125 checks with their criteria and weights, and `https://ora.ai/api/score/x.pcstyle.dev` gives the per-check

+ result with the exact evidence string. `npx is-agentic x.pcstyle.dev` reads the latest *stored* report and

+ cannot force a re-scan — trigger one at <https://is-agentic.com/scan/x.pcstyle.dev>.