Repository navigation
fix(core): resolve false-positive review findings - #124
Merged
Merged
Conversation
The sitemap walk caps entries at 500 and child sitemaps at 10. A page missing from the part it read may be listed in the part it skipped, so discovery-index-coverage now returns notApplicable instead of failing. Found on a large retail site whose 2455-URL product sitemap filled the cap before the one-URL sitemap that lists the homepage.
Nested Review, Comment, Answer and Question dates record when someone else wrote, not when the page changed. Reading them as page signals reported product pages that publish no page date as divergent instead of unverifiable. Count lastmods within one hour as one build stamp. A generator that writes the clock per URL spreads one run over seconds, and exact string matching missed it.
The 14 per-bot robots.txt audits warned at 0.5 when a bot was allowed only through User-agent: *. Under RFC 9309 section 2.2.1 that is the same access a named group grants, and no vendor documents a difference. They now pass and name the group that applied. A blocked bot still fails. A missing or unreadable robots.txt is not applicable. Control-token copy no longer says Google-Extended or Applebot-Extended crawl.
fix(core): pass crawler bots allowed through the catch-all group
The audit warned when YouBot or AI2Bot was allowed through User-agent: *. Its only reason was that the policy could flip under a later blanket block; no source documents a difference, and RFC 9309 section 2.2.1 grants the same access. The dossier is corrected first. Inherited access now passes and names the rule that applied; a block still fails. A missing or soft-404 robots.txt is not applicable.
…allow fix(core): pass ai-bot-directives when bots inherit the catch-all
The audit reports contradictions between channels; a site with no signal in any channel has nothing to contradict. The dossier called silence a real cost with no source, while its own sources read absence as unknown or no preference. Dossier corrected first; notes stay in details.
fix(core): treat AI-usage silence as not applicable in coherence audit
When nothing advertises an RSL licence, the audit guesses /license.xml and /rsl.xml. A site that redirects both to its homepage got four conformance errors about the homepage HTML. A guessed path is now kept only when its body has an <rsl> element; otherwise the audit returns notApplicable.
fix(core): ignore RSL path guesses that return no RSL document
Random root .txt paths that 301 to the homepage were reported as an SPA catch-all, because the audit counted the homepage's final 200. A probe whose final path differs from the requested one now counts as absent. An HTML 200 at the requested path still fails.
fix(core): read a redirected root .txt probe as absent
A readable storefront that loads the Turnstile api.js for its forms still drew three findings. cart-handoff-reachability now fails only a cart that is a challenge page or only a widget. no-bot-detection passes a loader on a page the scan could read. no-blocking-captcha matches vendor script src and widget elements instead of the vendor name, so inline config, CSP lists and prose no longer match.
fix(core): stop reading a form Turnstile loader as a bot wall
The semantic extractor took the first <article>. On a page with many, that was a promo strip, and extraction determinism reported 0.00 agreement. It now takes the article with the most text, and falls back to the body when none holds a fifth of the page.
…article fix(core): read the largest article in the semantic extractor
The aggressive extractor dropped any element whose class contained a blocklisted word, which deleted a page wrapper named page-content--banner-enabled. It now tests whole class tokens and ids, and keeps an element holding most of the page. Script contents no longer count as prose, so JSON-LD URLs stop being key spans.
…tokens fix(core): match stripper class tokens, not substrings
The span after an h2/h3 was whatever text followed it. A tile grid became one answer crossing every block, and a one-word button repeated under each tile became an ambiguous answer. Heading spans now have to be sentences of three or more words; a sentence split across sibling blocks is still reported.
fix(core): take only sentences as text-fragment answer spans
Image arrays and ImageObjects were read as no image. A ProductGroup's AggregateOffer range and variant offer prices were read as no price, and productGroupID did not count as an item group. Resolve seller @id references on the page; a dangling reference still fails.
fix(core): read every JSON-LD shape in feed parity
A store locator's 'City or postcode' box matched the postal-code keyword and failed the audit. Query forms take a keyword or place, not profile data. Skip them, and skip location fields whose name offers a choice between concepts.
fix(core): skip search and locator forms in autofill coverage
Page builders emit whitespace-only <section> row slots. They have nothing to label and dragged a homepage to fail. Skip them, and return not applicable when no section has content, as the dossier requires.
fix(core): skip empty layout sections in section-headings
A feed is optional and the dossier says the audit informs rather than penalises. Return not applicable when no feed answers and no page advertises one. An advertised feed that does not answer still fails.
fix(core): rss-feed is not applicable without a feed
…ards fix(core): match text fragments over nearest-block runs
fix(core): skip @id references in JSON-LD duplicate count
fix(core): read namespaced atom:link in feed WebSub discovery
…control fix(core): skip wrappers and inner labels of native controls in ghost scan
…e-only fix(core): compare aria-label with visible text on controls only
fix(core): treat FAQPage entries as editorial in UGC boundary scan
fix(core): decline contact-form when a contact page was not sampled
fix(core): skip hidden regions and keycaps in semantic-lists
…tional fix(core): report THIN sections without warning on them
…hidden fix(core): count title-kept h1 and skip hidden spans in survival recall
fix(core): let Last-Modified corroborate but not contradict lastmod
chore(release): mark the false-positive sweep as 6.0.0
- dom-visibility: share one declaration parser. Drop invalid values as a browser does, accept var() as a valid override, and let the nearest element that declares visibility decide for notRendered. Readers still treat a visibility:hidden subtree as removed, as Readability does. - css-hidden-ghost-content: use the shared parser for inline markers and stylesheet display rules instead of its own regex and blockDisplay copy. - text-fragment-addressability: judge each element on its own ancestor chain, so a visible answer under a hidden wrapper stays addressable. - ghost-clickable-element-ratio: resolve the first recognised ARIA role, case-insensitively; share one role list; count gridcell and scrollbar wrappers; exempt observing inline handlers inside a control and flag only handlers that stop propagation. - sitemap gatherer: a child that already failed as a root still marks the index scope incomplete. - sitemap-lastmod-verifiability: a deploy-time Last-Modified header no longer vouches for a recent stamp run; those URLs are unverifiable.
12 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix the six findings from the review of
staging/false-positive-fixes. This PR targetsmain. The initial false-positive sweep reachedmainthrough PR #109.displayandvisibilitydeclarations using source order and!important.Add regression and boundary tests beside the affected audits and gatherers. Update five evidence dossiers and add five core patch changesets. Audit IDs, grades, tiers, weights, and result schemas remain unchanged.
Validation:
Follow-up: gaps in the first pass (9361a70)
A second review of this branch found that some of the fixes above overreached or stopped short. This commit closes those gaps:
dom-visibility.tsnow has one shared declaration parser. It drops invalid values the way a browser does, sodisplay:none;display:noneestays hidden. It acceptsvar()as a valid override, sodisplay:none;display:var(--layout, block)no longer counts as hidden. A pre-check skips styles that mention neither property.notRendered, the nearest element that declaresvisibilitydecides, so avisibility:visiblechild of a hidden block is rendered.visibility:collapsehides.hiddenFromReadersstill treats the whole hidden subtree as removed, as Readability does.displayrules. Its own regex and itsblockDisplaycopy are removed.role="img button"is an image.gridcellandscrollbarwrappers count as holding a control.Last-Modifiedheader no longer vouches for them. Those URLs become unverifiable and the audit warns. Before this commit they passed. Content dates still decide as before.Five dossiers and four of the existing changesets were updated. Every bump stays
patch. Audit IDs, grades, tiers, weights and schemas are unchanged.Validation for this commit: build, typecheck, lint, check:dossiers, check:requires, check:audit-map and format:check all pass.
AL_SKIP_NETWORK=1 pnpm testpasses 5,696 tests in 340 files, with 251 skipped, so the live-site scans did not run in this pass. The new sitemap and lastmod tests, and the three role, var() and visible-descendant cases from the second review, were confirmed to fail on the previous code.