Pre-launch smoke-test fixes, statute-anchored positioning, and a partner offer a channel will carry

[thecelestialmismatch]

Summary

Three commits. A read-only smoke test of every public flow surfaced launch-blocking defects and self-contradictions; market research then found the positioning was anchored to a deadline that no longer exists and a partner offer no MSP would carry. This PR fixes all three. It does not touch the proxy detection engine, auth, or the database.

Commit	What it does
f7b5aa4	Smoke-test fixes across public flows
934300d	Statute + liability positioning; partner margin 20% → 67–73%
0cd95ed	Merge main (PR #316), keeping the $499 gate its version would have dropped

Change type

• Bug fix
• New capability
• Security hardening
• Documentation or developer-experience improvement
• Refactor or maintenance
• Breaking change

1 — Smoke-test fixes (f7b5aa4)

• Sample report PDF — page 4 rendered null-byte mojibake because non-WinAnsi glyphs (⚠ U+26A0, Δ U+0394) forced those jsPDF text runs into UTF-16. Removed. Replaced the "DEMO MODE — Connect Supabase for real data" banner with an honest illustrative-sample line. Corrected the sample violation_rate (0.015 was 100× low, forcing the cover score to a flat 100% — now a believable 99%) and added an illustrative Merkle root instead of "N/A".
• /install — the quickstart's curl -sSL https://houndshield.com/install | bash target was a 404. Now 302-redirects to the canonical proxy/install.sh.
• DPA — the party-name slot interpolated the full controllerDisclosure() sentence mid-clause, rendering a broken contract. Added controllerPartyName(); the full disclosure stays its own sentence.
• Contradictions/typos — pattern count 90→53; latency standardised to <10ms; contractor count → 76,598; HIPAA breach stat $1.9M→$7.42M (IBM 2025, correctly labelled); "free tier" → "Scan free → /demo"; a an assessor (×4); one-time, one time.
• Fabricated-metric pages — kept, relabelled: illustrative banners atop /control-map and /roi; /about "General availability" → "Public Preview" (GA contradicted /legal); removed the second pricing grid from /changelog.
• Brand / mobile — per-page OpenGraph titles on 6 shared pages (all previously inherited one generic share card); houndshield-logo.png 1.44 MB → 87 KB; fixed a /demo grid forcing 2 columns on phones.

2 — Statute-anchored positioning + partner margin (934300d)

Both regulatory catalysts lapsed within sixty days: CMMC Phase 2 enforcement paused 13 July, and the HIPAA Security Rule update that would mandate an AI-tool inventory is deferred to at least July 2027. Every urgency claim rested on a date that no longer exists. Two drivers survive, and neither was on the site:

• FY2026 NDAA § 1513 directs the Department of War to build an AI/ML security framework and incorporate it into the DFARS and CMMC. A departmental memo can pause its own certification programme; it cannot repeal a statute.
• DOJ cyber-specific False Claims Act settlements reached $51.8M in 2025, up 233% YoY. The pause removed the assessor, not the prosecutor.

Added to lib/compliance/cmmc-status.ts as NDAA_AI and FCA_SCALE so the surfaces quoting these facts cannot drift, and surfaced on /cmmc-phase-2. Scope is stated precisely and guarded: § 1513 carries no implementation deadline, and § 1532's "covered AI" means adversary-linked providers — not ChatGPT or Copilot. Overstating either to a compliance buyer is the failure mode this repo already has scars from.

Partner economics. MSP compliance assessments list at $500–$2,000 and MSSPs target 60–75% gross margin, but reselling the identical artifact at its published $499 clears 20% — the trap being the published price itself, since a partner cannot quote more for the same deliverable their client can buy direct. Fixed without moving a price: retail stays $499 and the flat $100 partner discount stands. What changes is what the partner sells — PARTNER_ENGAGEMENT wraps the report in partner-delivered work (branding, remediation roadmap, client readout) listing at $1,200–$1,500, for 67–73% margin funded by their own labour, not a discount we fund.

3 — Merge main, keep the gate (0cd95ed)

PR #316 landed on main and rewrote the same surfaces: it deleted the fake nine-pattern demo scanner and extracted the real one into a shared components/scan/LocalScanPanel used by both /demo and /command-center/scanner. That architecture is better, so the three conflicted files take main's version wholesale.

Resolving in main's favour alone would have silently dropped a change this branch makes deliberately: main's commerce mode still hands the visitor a downloadable gap-report PDF for free. The gate is therefore re-applied on top of the new structure — the commerce block renders the assessor-ready report locked behind a single "Unlock the full report — $499" CTA, and generatePdf plus its now-dead imports and phase are removed. Two guards were updated to describe the new behaviour rather than the old, including the theme-parity guard, which still proves a paying customer is never re-sold the product inside their own dashboard. Auto-merge had also produced an await inside a non-async test; corrected.

Impact and operating considerations

• Authentication, sessions, identity, or authorization
• Sensitive-data handling, logging, telemetry, or outbound requests
• Proxy detection, policy evaluation, block/quarantine behavior, or performance
• Database schema, migrations, retention, or access controls
• Deployment, environment variables, integrations, or scheduled work
• Evidence, reporting, or audit-chain behavior
• None of the above

Operational impact and rollback. The evidence/reporting change is presentation-only: the PDF layout and the sample data it renders. No change to the audit chain, hashing, or scoring — the violation_rate fix corrects a display value, and the illustrative Merkle root appears only on the watermarked public sample. Removing the free PDF download changes what the public demo gives away; the scan itself, the engines and the local-only boundary are unchanged. Pricing constants are unchanged — PARTNER_ENGAGEMENT is additive and the existing coherence guard still pins $499/$399. The /install route redirects to a public repository path; it performs no auth and reads no data. Its installer pulls ghcr.io/thecelestialmismatch/houndshield-proxy:latest — publishing that image remains an ops step outside this PR. No env vars, migrations, or scheduled work are added. Rollback: revert the commits; no state or configuration is affected.

Validation

• Web plane: npx tsc --noEmit
• Web plane: npm run lint
• Web plane: npm run test:coverage
• Web plane: npm run build
• Proxy: npm run lint
• Proxy: npm run test:coverage
• Proxy: npm run bench
• Manual verification (described below)
• Documentation-only validation

Results. Web plane after the merge: tsc --noEmit → 0 errors; lint → 0 errors (35 pre-existing warnings, none in any touched file); test suite → 3091 passed / 222 files; build → exit 0. Proxy: tsc --noEmit → 0 errors, 92 passed / 4 files; bench and proxy lint were not re-run because no proxy source changed. node scripts/verify-structure.mjs → PASS after the file deletions.

Manual: rendered the sample PDF and extracted its text — page 4 is clean (no mojibake), the cover shows a 99% score, an illustrative Merkle root, and the illustrative-sample banner. Partner margin verified by executing the shipped constants: $399 wholesale against a $1,200–$1,500 engagement → 67–73%.

Review checklist

• The change is focused and does not include unrelated refactoring.
• Tests cover changed behavior, or the omission is explained above.
• No credentials, customer data, sensitive prompts, or production exports were added.
• Public claims are scoped, evidence-based, and consistent with the selected deployment boundary.
• Documentation and configuration guidance were updated where needed.
• Database migrations, configuration changes, and rollout dependencies are documented where applicable.
• I performed a self-review and addressed obvious failure paths.

Deferred (flagged, not in this PR): the large repo cleanup (skills/, agents/, rules/ ≈ 8 MB) is pinned by scripts/verify-structure.mjs and needs that guard updated in tandem. f48d464 on main changed homepage competitor naming to categories rather than brands; the market research argues the opposite for /compare (named category presence) — reconciling the two is a follow-up, not resolved here. STRIPE_WEBHOOK_SECRET, the GHCR image publish, and incorporation remain founder/ops actions; incorporation in particular blocks partner outreach, since an unincorporated counterparty is a real objection for an accreditation-dependent firm.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
compliance-firewall-agent	Ready	Preview	Aug 22, 2026 2:50am

[supabase]

This pull request has been ignored for the connected project qifynzuyrdxmxlumpsrq because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.