We have audited ourselves three times and published every reading.

Why the score went down

Read the coverage line under each number first. The baseline and after scans resolved 34 of the rubric’s 100 points; today’s resolves 96. They measure different things, and our own comparison tool refuses to print a difference between them.

96.3% was thirteen checks out of thirty-three. The other twenty are assisted: they gather evidence and stay inconclusive until a person reads it and signs a rating with a reason. Nobody had, so sixty-six points left the denominator, and the thirteen that remained were the ones a machine settles by reading bytes. Almost all passed. The report’s confidence line said low.

74.2% is thirty-one checks out of thirty-three, twenty of them read and signed, at high confidence. Two are inconclusive and their four points left the denominator. Between the second and third readings the site grew from nineteen sampled pages to thirty-three and gained a measurement stack. It did not get worse; somebody read the rest of the rubric. Every figure on this page now carries its coverage next to it.

What this proves, and what it does not

It shows the loop works: a real scan produced a punch list, the list was worked, and a second scan of the same site under the same rubric moved. Every number here comes from the published reports.

It is not an independent verdict. This is our own site, measured by our own tool against our own rubric, by the person who wrote all three. The audit of a site we do not own is closer to independent, though still not independent.

In the first two readings none of the twenty assisted checks was signed, so those figures are the deterministic score only. The third reading signs all twenty, each with its reason. The lowest ratings are about us: no customer is named anywhere on this site, no credential links to an issuer, and no recheck is scheduled.

What moved

Eight of the thirteen changed. Seven improved because we fixed the site; one improved because we fixed the check. Two more are still short of complete and are covered below.

The after scan is re-collected when the site changes, so its date moves and the baseline’s does not. It can be behind the site; the date on the report is the fact. The baseline is the control and is never re-run.

The finding that got worse

We added a standards-compliant security.txt and our own score went down.

AC-02 keeps a 600-character excerpt of each guidance file for display, and it was analysing that excerpt while reporting on the whole file. A URL crossing the 600th character was cut in half. https://citeu does not contain citeunseen.io, so the check reported an off-domain link that did not exist and took a point for it.

On the operator's other published sample it had missed a real off-site link past the same boundary. The fix moved that sample's score down from 45.25 to 44.75 of 77, noted in the correction on the sample page.

A check that invents a finding is the worst defect this product can have, because a customer cannot disprove it without reading our source.

What we did not fix, and why

Two findings were argued rather than fixed. One argument was wrong and has been reversed; the other was a fault in the check.

AC-02: the link we kept, then removed

Our llms.txt linked chrisbrock.io, the site the published sample audits, so a machine would know those findings describe that site. The check counts it as an off-domain link. For two days this page argued the link should stay. The operator overruled that: “the check is right but we are keeping it anyway” is what every vendor says about its own site. llms.txt now names the domain in prose and says why it is not linked.

Working it found two more defects. The check counted strings that are not links, such as a sentence ending “starting with https://.” and this page quoting https://citeu. A match now needs a host. And /llms-full.txt, a full-text file, names the audited domain in the sample's provenance line, which no site publishing work for someone else can avoid.

That was settled in rubric v0.5: links in a guidance file are checked for leaving the domain only where the file is a link index, meaning llms.txt and ai.txt. On the scan of 11 September AC-02 reads substantial, the same as the baseline. The dip came from the check, and the check was corrected rather than the file edited.

TA-04: closed by changing the check, in a new rubric version

The finding was five URLs reachable from only one other page. Two were real: the baseline and after reports were linked only from this page. They are in the footer now.

The other three were /request/?tier=audit, ?tier=audit-plus and ?tier=monitoring. Each declares a canonical to /request/, which has thirteen routes in. The advice could not be followed without adding pointless links or deleting a working feature, and declaring no canonical was scored the same, so the correct behaviour was penalised. Sites with faceted navigation, UTM-tagged links or paginated archives would have had hundreds of these.

The rule now treats a URL whose canonical names another sampled page as that page, and credits its inbound links there. Changing what a check means is a new rubric version. Earlier versions stay on disk and keep scoring as they did, so the baseline report still reproduces exactly from its own captured bytes.

That implementation had a bug. A review on 11 September found it counting every outbound link rather than distinct pages, so a nav repeated four times counted forty-eight links. Corrected, five pages here link to one other page or fewer: the two reports on this page, the two sample reports, and the scan sheet. They are standalone artifacts meant to open from a downloads folder. That is a real finding, and it is why TA-04 reads substantial, not complete. The 3 of 3 this page used to show came from the bug. Fixing it means changing what a delivered report links to, which is still undecided.

SD-04: closed

The after scan reported one duplicate title across nineteen pages: the two reports on this page, both titled AI Discoverability Implementation Audit — citeunseen.io. The renderer now takes an edition, and the next re-derivation came back complete.

How to read the three reports

All three are the full technical report. The baseline was produced on 8 September 2026 before any of this work; the after report from a fresh crawl once it was done; today’s on 17 September from a third crawl, the first with every assisted check signed.

They are scored under the rubric version each was collected at: the baseline under v0.3, the after scan under v0.5, today’s under v0.6. The checks whose meaning changed are TA-04 and AC-02, and on the baseline’s own evidence both score the same under old and new versions: TA-04 at 2.25 of 3 and AC-02 at 1.5 of 2. The difference between the numbers is the site.

A build gate checks every figure on this page against the three reports. Each report is frozen at its crawl and can be behind the site; the date on the report is the fact.

Each finding names the URL it came from, when it was observed, and the captured response it was read from. Checks that could not be settled are marked inconclusive and left out of the denominator, which is why the first two are scored out of 34 and the third out of 96.

The captured responses are published too. A build gate replays each edition from its own bytes on every change and fails if a finding no longer matches, or if a difference is not recorded with a reason. Seven differences are recorded, and four are defects we found in our own checks.