Code Issues Pull Requests Actions Security InsightsSettings

Website honesty + one-box reliability: pre-launch label, doctype site-wide, one price list, no fabricated claims, host-capability gates, bounded readiness, served-SHA deploy gate #5500

Merged⚡ AI-generatedXSccantynz wants to mergefix/website-honesty-2026-08-19→mainopened 13d ago

ccantynzcommented 13d ago

Why

Owner directive 2026-08-19: audit platform + website at the deepest level; no false or misleading stubs, no dark services; be unbreakable on one box; add a small not-yet-operational label. Four parallel audits (competitor pain crawl, ~155-finding stub sweep, spine/reliability review, live render audit) fed this branch. Full map: docs/AUDIT-2026-08-19-PLATFORM-AND-20-MOVES.md.

What (10 commits)

Site shells — Preview · GA 2026–27 pill beside the wordmark + footer sentence on every document shell (layout, landing, sign-in), default ON, PRELAUNCH_LABEL=0 on launch day. <!DOCTYPE html> middleware (Hono's c.html() emits none — the entire site was in quirks mode). /login is a real document (was a bare fragment).

Honest copy — one price source (listPlans()) for home + /pricing + bundle math; enterprise page tells the truth (OIDC + SCIM shipped, single US region, SOC 2 planned/not audited, SLA-backed plans at GA, no HIPAA BAA); pricing FAQ SLA; /status headline honest about unmonitored rows and 24h window; fabricated social proof (Anthropic partner / 300+ waitlist / YC W26) removed; sponsors relabelled as pledges (no payment rail); deps' hardcoded "0 CVEs" removed; advisories say built-in list, not a CVE feed; unconditional Verified badge, Slack/Discord/Teams install CTAs to non-existent routes, "cross-repo search on the roadmap" (it exists) — all fixed; /:owner/:repo/memory fabricated page gated like /trust; block codes and dated model names gone; changelog gains July + August 2026.

Dead surfaces — /terms /privacy served [YOUR LEGAL ENTITY NAME] template text → now resolve to the maintained NZ-law drafts. Dead links (/signup /api /vscode /trust /security /roadmap /quickstart) → src/routes/aliases.ts. Sign-in "Email me a link" was a fake button → real POST; /sso /keys links fixed; reset/magic flows stop claiming an email was sent on a log-only mail provider. hostCapabilities() gates previews / dev-envs / PR sandboxes / SSH so nothing pretends to build, poll, or provision where the host cannot; MCP tools return ok:false. Enterprise contact form no longer swallows DB errors; new /admin/enterprise-leads. Billing: existing subscribers switch plan via Customer Portal (Checkout created a second subscription); purchase CTAs hidden where Stripe is unconfigured.

Reliability — /readyz bounded (3s race + repo store stat; it hung on a Neon stall), /healthz 503 while draining; src/lib/lifecycle.ts (unhandledRejection/uncaughtException → error store, SIGTERM drain, compose stop_grace_period: 20s); merge-queue stale-running reaper; dep:disk spine probe; auto-update.sh served-SHA gate (a failed image build used to be logged as a complete deploy) + builder-cache prune; compose no longer depends_on the unused local Postgres.

Tests

Full suite on the branch: 4716 pass / 7 fail / 133 skip — the 7 are pre-existing on main before this session (claude-config, close-keywords-apply, json-in-script, suppression-quality ×2, …) minus three this branch fixed. ~110 new tests across 8 files. bun run typecheck clean.

Owner inputs still needed (not blocking merge)

Legal entity name + address for /legal/*; pricing decision (#200); SAML decision (impl unhardened; copy now sells OIDC + SCIM only); ntfy/Pushover topic + R2/B2 creds + healthchecks.io URL to unlock reliability moves 1–3.

🤖 Generated with Claude Code

ccantynzAI Reviewcommented 13d ago

AI Triage

(no summary)

Priority: medium Risk area: mixed

Suggested labels: (no label suggestions) Suggested reviewers: (no reviewer suggestions)

Suggestions only — nothing has been applied. The PR author stays in control.

gluecron[bot]🤖 botAI Reviewcommented 13d ago

AI review unavailable

The platform's AI balance is exhausted, so AI generation is temporarily unavailable. Nothing was lost. You can queue this as a repair for the internal agent from the repository's Health page, or try again once the balance is restored. The PR is otherwise unchanged.

Cross-repo impact

See what breaks downstream if this PR merges.

Analyze →

⮌ Merged

This pull request was merged into main.

c comment · e edit title · m merge · a approve · r request changes · ? shortcuts