Black Site

S1 Rendered defect BSI-2026-0001: Covert Mode Is a Page Navigation, Not a Toggle

On the Engineer's Report, pressing the covert button navigates to /analysis/{id}/view/C (full page load) instead of toggling. User loses scroll position. On non-results pages, the same button does a client-side class toggle.

“Results page requires server-rendered covert template, so navigation is architecturally necessary. Scroll position loss and inconsistent interaction pattern were unaddressed.”

Root cause: activateCovertOrSwitch() uses location.href navigation on analysis pages with no scroll preservation. Fixed by adding sessionStorage save/restore of scrollY.

S1 Rendered compliance_gap BSI-2026-0006: Compare Select Rows Keyboard Inaccessible

Domain comparison rows use click handlers on bare tr elements. No tabindex, no role, no aria-label. Keyboard-only users cannot reach or activate these rows.

Root cause: Missing keyboard accessibility attributes. Fixed by adding tabindex=0, role=button, aria-label, and Enter/Space keydown handler.

S1 Detained incident BSI-2026-0018b: Sanity Token Exposed in HTML

A Sanity Token exposed in analysis view HTML. Sanity documents tokens as credentials that should generally be considered secret. Browser-exposed tokens are a bad idea.

“Token may be a read-only public dataset token, but exposure should be verified and scoped.”

S1 Detained weakness BSI-2026-0019: CSP script-src Allows Wildcard

The script-src directive uses *, allowing JavaScript execution from any origin. This effectively disables browser-side XSS defense.

S2 Rendered design_debt BSI-2026-0002: Glass Treatment Only on Posture Cards

Glassmorphism CSS selectors only match cards with exact class combination card.border-{status}.bg-{status}.bg-opacity-10. Confidence and Currency cards use card.bg-dark and get no glass treatment or hover-lift.

“CSS selectors were written for the first card type and never extended to other card patterns.”

Root cause: Missing .card.bg-dark glass treatment rule. Fixed by adding glassmorphism and hover-lift to .card.bg-dark selector.

S2 Rendered compliance_gap BSI-2026-0004: No prefers-reduced-motion in CSS

Users who set Reduce Motion in OS settings still see every CSS transition, transform, and animation. JavaScript handles topology SVG SMIL but CSS transitions are unprotected.

Root cause: Missing @media (prefers-reduced-motion: reduce) block. Fixed by adding universal selector that kills animation-duration and transition-duration.

S2 Rendered compliance_gap BSI-2026-0005: Stats Metric Label 2.1:1 Contrast Ratio

.stats-confidence-metric-label uses color #484f58 on #161b22 background. Contrast ratio approximately 2.1:1. WCAG AA requires 4.5:1 for normal text.

Root cause: Hardcoded color too dark. Fixed by changing to #8b949e (5.1:1 contrast ratio).

S2 Rendered defect BSI-2026-0007: Architecture Page SVG Diagrams 404

Two SVG diagrams (drift-notification-pipeline.svg and github-issues-triage.svg) reported as returning 404 on the architecture page.

“Files may have been missing from static/images/diagrams/ directory.”

Root cause: Files exist and serve HTTP 200. Issue was previously resolved.

S2 Rendered compliance_gap BSI-2026-0008: Copy Buttons Mouse-Only Visibility

.copy-btn has opacity: 0 by default and only becomes visible on :hover. Keyboard-only users never see the button and cannot focus on an invisible element.

Root cause: Missing keyboard focus reveal. Fixed by adding :focus-within and :focus selectors alongside :hover for opacity:1.

S2 Detained defect BSI-2026-0009: Anchor Scroll Handler Hijacks Bootstrap Collapse

A generic smooth-scroll handler on ALL a[href^="#"] links calls e.preventDefault(), blocking Bootstrap collapse triggers that use href="#target" instead of data-bs-target.

“Bootstrap collapse relies on default click behavior which is being intercepted.”

S2 Detained defect BSI-2026-0015: Mobile Navbar Menu Extends Below Viewport

Navbar collapse dropdown uses position: absolute with no max-height and no overflow-y: auto. With 11+ nav items on shorter mobile screens, menu extends below viewport.

S2 Rendered claim_integrity BSI-2026-0003: Golden Ratio Claim Scope Verification

Topology SVG claims golden ratio (320/198 = 1.616 ≈ phi) which is mathematically accurate. CSS type scale uses ad hoc values not derived from phi.

“Claim may have been broader than implementation.”

Root cause: Verified: claim is correctly scoped to topology SVG aria-description only. No system-wide golden ratio claim found in user-facing code.

S2 Detained design_debt BSI-2026-0020: 908 !important Declarations

~908 !important declarations, ~450 in covert mode alone. Architecturally inevitable without CSS @layer. Every future style must also use !important.

“CSS @layer would resolve the specificity arms race. Supported since March 2022.”