The site is now a view over bigtech.db, not a hand-maintained set of pages.
- packages/core/db/render.mjs emits report/<product>.html and method.html into
web/public, so Vite copies them into the deployable bundle. Re-running
db:build regenerates them from whatever the database currently says.
- The report page leads with the score, then the dimension table with the
weakest rung highlighted, then findings, then the evidence table with its
tiers, then what was not tested, then how to clone and re-run the audit.
- The method page publishes the eight weights, the evidence tiers, both caps
(reproducible builds and the closed-source ladder), the D1-D4 dynamic test,
and a plain section on what the method cannot do.
Deployable bundle is 372K: the game, the method, the oath, the catalog and the
report. No server-side code, so it can sit on a Caddy static root and be nobody
else's problem to host.
Rendered 1 report page + method.html. All instrument checks still pass.
The roster writes itself. The scores do not.
- db/ingest/sources.mjs: GitHub and Flathub adapters. GitHub is ranked by
stars (usage); Flathub is a curated store of end-user Linux apps, so
relevance is free there and has to be earned on GitHub.
- db/ingest/run.mjs: discovers into the roster as unassessed products, never
as scores. Every discovery leaves a receipt (source, url, usage metric,
timestamp) so a reader can see where a product came from and why it ranks.
- LooksLikeUserSoftware gate: topic:messaging sorts RabbitMQ to the top
because brokers are highly starred and are not things people install.
- build.mjs no longer wipes the database. The DB authors itself, so a rebuild
would have thrown the roster away. --fresh is now explicit.
- v_backlog view: what to assess next, ordered by measured usage.
- packages/web/public/oath.html: the Ranch Oath, with an ASCII Bible crest,
bound to a SHA-256 of catalog.json. The page recomputes the digest in the
browser and reports VERIFIED or BROKEN. An oath you cannot break is decoration.
Roster now 122 products, 1 assessed. All instrument checks pass.
The database is the source of truth; the site is a view over it.
- packages/core/db/schema.sql: vendors, products, categories, the 8-dimension
instrument, assessments, scores, evidence, findings, off-ramp, plus the
derived v_product_score view the game reads.
- packages/core/db/build.mjs: rebuilds bigtech.db, absorbs the legacy 43-product
roster as unassessed, applies seeds, then verifies the instrument's own rules
(weights sum to 100, totals recompute, grades match bands, every score has a
rationale, no tier-4 evidence on a scored dimension, reproducible-build caps
actually enforced).
- packages/core/db/seed/0001-signal.sql: Signal Desktop 8.36.0-alpha.1 on linux,
75.9/100 grade B, weakest dimension local_data_exposure. Evidence points at
the re-runnable audit artifacts in the Servetus vault.
- packages/core/src/data/generated/catalog.{ts,json}: generated export.
Verified: 44 products, 1 assessed, all checks pass.
