{
  "site": "chrome-extensions.sgit.ai",
  "version": "v0.1.0",
  "updated": "2026-09-09",
  "licence": "CC BY 4.0",
  "purpose": "The checklist an agent walks before writing an extension. Every row is derived from a specific incident in the four guides, so a score is a claim about which failures the extension can still suffer, not a style opinion.",
  "grading": {
    "scale": [
      "yes",
      "no",
      "not-applicable"
    ],
    "rule": "Never a number out of ten."
  },
  "claim_state_note": "The three efforts' grades below are REPORTED from the guides' own claims, not computed by re-reading source (gaps G2, G5 in the brief pack). The recorder's source lives in a separate vault this site does not have access to.",
  "sections": [
    {
      "id": "A",
      "title": "Does it stay safe to leave running?",
      "checks": [
        {
          "id": "A1",
          "check": "Never originates a request",
          "why": "Every fact in the dataset is something the target volunteered to a real user in a real session"
        },
        {
          "id": "A2",
          "check": "Never blocks, delays or alters a response",
          "why": "A recorder that alters a response can break the page it is watching and you will spend a day thinking the target changed"
        },
        {
          "id": "A3",
          "check": "Every hook wrapped in try/catch; never throws into the page",
          "why": "An exception in a wrapper is a bug in the target's app, from the target's point of view"
        },
        {
          "id": "A4",
          "check": "Never transmits; export is a manual download",
          "why": "The invariant that makes the tool defensible"
        },
        {
          "id": "A5",
          "check": "A deny list that is a privacy floor, re-derived per transport",
          "why": "Message content never captured in any mode, including all"
        }
      ]
    },
    {
      "id": "B",
      "title": "Can it prove what it saw?",
      "checks": [
        {
          "id": "B1",
          "check": "Build version stamped into every artefact",
          "why": "Ten days lost to a browser running an old build; a quiet week on the target"
        },
        {
          "id": "B2",
          "check": "Running build shown in the UI, on the surface opened first, and coloured when stale",
          "why": "The badge shipped to the side panel while the popup went on saying nothing for two versions — exactly the wrong way round"
        },
        {
          "id": "B3",
          "check": "Coverage reported per surface, including zeroes",
          "why": "A surface absent reads as 'nothing happened'. A surface listed with zero reads as 'we never looked'"
        },
        {
          "id": "B4",
          "check": "Truncation flagged, with the original length stored",
          "why": "A record that says truncated: true with 4 MiB of content is a fact you can act on. A dropped record is silence"
        },
        {
          "id": "B5",
          "check": "Skips counted by endpoint in an unparsed tally",
          "why": "That tally is the to-do list for the next parser"
        },
        {
          "id": "B6",
          "check": "An observations log recording what was refused, and why",
          "why": "Twice settled questions nothing else could, including proving an old build was running"
        }
      ]
    },
    {
      "id": "C",
      "title": "Does it fail in the right direction?",
      "checks": [
        {
          "id": "C1",
          "check": "Missing is null; never 0, '' or {}",
          "why": "res || {} turned 'no answer' into 'an answer with nothing in it' and cost two runs"
        },
        {
          "id": "C2",
          "check": "No file constructed from an unchecked value",
          "why": "new Blob([undefined]) writes the word 'undefined' and calls it undefined.json"
        },
        {
          "id": "C3",
          "check": "Records with no stable identifier yield nothing, never the previous id",
          "why": "Losing two is correct; mislabelling two is not"
        },
        {
          "id": "C4",
          "check": "Bulk data never crosses a size-limited channel",
          "why": "113 MB export vs chrome.runtime.sendMessage; the fix is to remove the boundary, not widen it"
        },
        {
          "id": "C5",
          "check": "A circuit breaker over live counters, with generous thresholds",
          "why": "Three runs lost silently; a breaker that trips on noise gets ignored, and an ignored breaker is worse than none"
        },
        {
          "id": "C6",
          "check": "Failures loud at mechanisms, quiet at data",
          "why": "Quiet-and-counted for what you did not understand; loud-and-stop for what did not work"
        }
      ]
    },
    {
      "id": "D",
      "title": "Is the evidence separable from the interpretation?",
      "checks": [
        {
          "id": "D1",
          "check": "Phase 0 first — a recorder with no parsers",
          "why": "'This is not the product.' The best decision in the project"
        },
        {
          "id": "D2",
          "check": "captures/ read-only; everything else regenerable",
          "why": "Being wrong costs a re-derive, not a re-capture"
        },
        {
          "id": "D3",
          "check": "Derived format versioned, and refused when unknown",
          "why": "Silently reading a v1 file understates the dataset without saying so"
        },
        {
          "id": "D4",
          "check": "Code and data in separate stores, with a per-folder publication rule",
          "why": "Different sensitivity, lifecycle, size and failure mode"
        },
        {
          "id": "D5",
          "check": "Exports split full / skeleton / debug, with a redaction verifier",
          "why": "The verifier counts what it checked, so '0 leaks' means something"
        }
      ]
    },
    {
      "id": "E",
      "title": "Is it built on evidence rather than one example?",
      "checks": [
        {
          "id": "E1",
          "check": "A shape survey written before the parser",
          "why": "Found 58 distinct type names in one run and answered a week-old question"
        },
        {
          "id": "E2",
          "check": "Routing on what the response says about itself",
          "why": "Request-side ids are the caller's opinion; three result sets shared a path and a prefix"
        },
        {
          "id": "E3",
          "check": "Derived facts verified against an artefact the system produced",
          "why": "Two independent clocks agreeing to within a round trip is strong. One clock agreeing with itself is nothing"
        },
        {
          "id": "E4",
          "check": "Structural markers read instead of rendered English",
          "why": "Parsing the sentence works until the string is localised, pluralised, or A/B tested"
        },
        {
          "id": "E5",
          "check": "Types in structured identifiers read as data, with branching",
          "why": "A variant means loosen; a different type means branch"
        },
        {
          "id": "E6",
          "check": "Sample caps checked for selecting against the evidence",
          "why": "59 of 70 whole — because the whole ones were the small ones"
        },
        {
          "id": "E7",
          "check": "Timestamp provenance labelled (urn vs captured)",
          "why": "Lets consumers filter on evidence quality"
        }
      ]
    },
    {
      "id": "F",
      "title": "Do the tests pin the lessons?",
      "checks": [
        {
          "id": "F1",
          "check": "Test files auto-discovered; exits non-zero on zero found",
          "why": "'No tests found' and 'all tests passed' must never look the same"
        },
        {
          "id": "F2",
          "check": "Optional-dependency suites print SKIPPED loudly",
          "why": "A suite silently dropping 11 tests will eventually be why a bug ships"
        },
        {
          "id": "F3",
          "check": "Test names state decisions, not behaviours",
          "why": "The label goes with the value; tells the next reader why the code looks that way"
        },
        {
          "id": "F4",
          "check": "Fixtures hand-authored and synthetic; real captures never become test data",
          "why": "A privacy rule that turned out to be a design rule"
        },
        {
          "id": "F5",
          "check": "A real browser drives anything with a real browser boundary",
          "why": "The 113 MB messaging bug was invisible to unit tests by construction"
        }
      ]
    }
  ],
  "graded_efforts": [
    {
      "name": "The recorder",
      "date": "2026-08 to 2026-09",
      "version": "v0.16.0",
      "evidence_state": "measured",
      "grade_note": "Reported from what the four guides claim about it — every check above describes behaviour the guides attribute to this tool. Not independently verified against its source (gap G2/G5).",
      "default_grade": "yes"
    },
    {
      "name": "SGraph Key Vault (March 2026)",
      "date": "2026-03-05",
      "version": "v0.11.12",
      "evidence_state": "recalled",
      "grade_note": "A 28-file dev pack, confirmed never built (8 Sep 2026). No code exists to check any behavioural claim against.",
      "default_grade": "not-applicable"
    },
    {
      "name": "The secrets manager (September 2026)",
      "date": "2026-09-05",
      "version": "v0.33.65",
      "evidence_state": "read",
      "grade_note": "A dev brief with platform constraints read from documentation. No code was written, so there is nothing to grade.",
      "default_grade": "not-applicable"
    }
  ]
}