Delete the four public files that publish what the mission forbids

[thecelestialmismatch]

Description

A live read of all 41 public URLs on www.houndshield.com (2026-08-19) found four stale files served from the marketing domain. Between them they publish a fabricated customer count, a second subscription pricing grid, and a C3PAO referral program — the three items at the top of the NEVER-DO list — at crawlable URLs, with no noindex and no robots disallow.

None of it is application code. The whole change is deletions plus one rewritten text file.

File	What it was publishing
public/stats.json	"orgs_protected": 143 with a comment reading "Numbers shown on landing page hero." We have zero customers.
public/hermes-demo.html	A complete stale site prototype: the retired $199/$499/$999/$2,499 grid with comparison table, "C3PAO Referral Partner — 30% recurring", invented tenant telemetry (14,363 scans, SPRS 78, Plan: Pro), and "we still sign a BAA on paid plans" — which /trust contradicts. Also reachable at /hermes and /hermes-redesign via next.config rewrites, removed here too.
public/_bootstrap.html	885 KB duplicate homepage saved from an artifact preview shell, badged "49/49 tests passing", leaking an internal prototype UUID. Its four orphaned dependencies (babel.min.js 3.0 MB, both React dev builds, css2) go with it.
public/llms.txt	Rewritten. The file AI answer engines read, last updated 2026-05-08. It led with the $199/month tier, pitched C3PAOs as a partner channel twice, carried an unsourced "vs Nightfall ($75K/yr)", and claimed CUI-safety with no Mode B caveat.

C3PAOs are barred by 32 CFR Part 170 and ISO 17020 cooling-off rules from recommending tools to organizations they assess. The existing guard in app/partner/__tests__/channel-framing.test.ts is scoped to app/partner/**, so none of these files were covered by it.

Why the pricing grid survived every previous correction

lib/pricing/__tests__/plans.test.ts asserted that llms.txt must list every monthly tier. The guard made publishing the retired grid mandatory.

PRICING_PLANS is dormant Stage-2 data with no rendering consumer — verified, there is no non-test importer of PRICING_PLANS, getPlan, or ANNUAL_DISCOUNT. So the assertion is inverted: llms.txt may not advertise a subscription that cannot be bought. Probe-tested both directions — injecting $199/month turns it red, reverting turns it green.

Same failure mode as the Netskope 43% assertion recorded in tasks/lessons.md: a test that pins a wrong value converts an error into a requirement.

Also removed

houndshield-logo1.png — byte-identical to houndshield-logo.png (same MD5), 1.4 MB for a second copy. index-DW_q7_qd.js and index-CO1gdLWv.css — referenced by nothing. houndshield-logo.png is kept (12 live references).

Rebased onto current main, so llms.txt quotes the partner price settled in #306: $399, a flat $100 discount, not a revenue share.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• Documentation update

Jordan's Test Plan (CMMC Buyer — required before merge)

• npm run build passes in compliance-firewall-agent/ — exit 0
• Brain AI tests pass — included in the full suite below, 0 failures
• No hardcoded secrets — the change only deletes files and edits prose
• Local-only data boundary preserved — no gateway, proxy, or scanner code touched
• Compliance patterns untouched — nothing under proxy/patterns/ modified
• SPRS scoring logic unchanged — no compliance engine file touched
• Proxy benchmark — p99 within the 10 ms budget (proxy unmodified; run for completeness)
• Supabase not used for CUI data storage — unchanged by this PR

Verification

Every deletion was reference-checked before removal, not assumed:

stats.json              0 references
index-DW_q7_qd.js       0 references
index-CO1gdLWv.css      0 references
houndshield-logo1.png   0 references
babel.min.js            1 — _bootstrap.html only
react*.development.js   1 each — _bootstrap.html only
css2                    1 — _bootstrap.html only
_bootstrap.html         comments only (verify-no-leaks.mjs, font-brand-contract)
hermes-demo.html        REAL couplings — handled below
houndshield-logo.png    12 references — KEPT

hermes-demo.html was the one file with genuine couplings: a byte-fidelity test asserting its exact size and SHA-256, and two next.config rewrites. Both are removed alongside it. A post-deletion grep for every deleted filename returns nothing.

• Local UI testing — production build renders 232 static pages
• npm run build succeeds locally — exit 0
• Linter passes
• Test suite passes — 2,993 passed / 212 files, 0 failures; proxy 92 passed / 4 files

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas — the inverted assertion carries a comment explaining why restoring the old one would re-publish the grid
• I have made corresponding changes to the documentation
• No TypeScript any types added in compliance-critical code

README

Corrected six stale measured numbers, replaced a regulatory paragraph that contradicted the live /cmmc-phase-2 page (it claimed the 10 Nov gate "no longer applies"), and rewrote a status section that reported checkout as broken when it sells today — while omitting that a completed purchase is recorded nowhere.

Dropped three hand-typed stat badges. All three were stale, and p99 measures 0.65–0.89 ms across runs, so pinning an exact figure in a badge guarantees drift.

Not in this PR

Found in the same audit, left for separate review because each touches rendered pages:

• /about animates its stats from 0, so crawlers and AI answer engines read "$0 — One-time AI Risk Assessment Report"
• /hipaa publishes $1.9M as the average healthcare breach cost; IBM's 2025 figure is $7.42M
• C3PAO channel framing still live in app/contact/layout.tsx and app/roadmap/page.tsx
• /dpa clause 1 is grammatically broken — the entity placeholder sits where a party name belongs
• Mode B has no install path: Docker Hub and houndshield.com/install both 404, while /docs/quickstart prints the curl command

Net ~42,000 lines and ~7.3 MB removed, none of it referenced by the application.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
compliance-firewall-agent	Ready	Preview	Aug 19, 2026 6:57am

[supabase]

This pull request has been ignored for the connected project qifynzuyrdxmxlumpsrq because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.