{
  "_comment": "Operator review decisions for the chrisbrock.io validation sample. Every entry required reading the evidence record it cites. Checks deliberately absent from this file stay inconclusive and leave the denominator; they are not zeroes. Reviewer identity is recorded on each finding in the report.",
  "EN-01": {
    "rating": "substantial",
    "confidence": "high",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "One identity name, 'Chris Brock', is declared on all 25 sampled pages in JSON-LD and in og:site_name, with a consistent email and a structured postal address, and 25 distinct meta descriptions with no duplication. The gap that keeps this short of Complete: the site markets professional work but never names the operating legal entity behind it, so a reader cannot tell whether they would be contracting with an individual or with a company.",
    "evidence_ids": [
      "ev_02acb40138951a1a",
      "ev_37df1c06d90f71ac"
    ],
    "limitations": [
      "Whether 'Chris Brock' and the operating entity should be presented as one identity or two is a business decision, not an observation."
    ]
  },
  "EN-02": {
    "rating": "partial",
    "confidence": "high",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "Read /situations and its five child pages. The site organizes itself around customer situations rather than named offerings, which reads well but leaves no stable name for anything purchasable. /situations/fractional-cio is titled 'Technology Strategy for Growth' and the phrase 'fractional CIO' appears nowhere in its title, headings, or body, so the one URL that names the offering is the one place the page does not. No Product, Service, or ProfessionalService entity is declared in structured data on any sampled page.",
    "evidence_ids": [
      "ev_5cfea00370e86080",
      "ev_2414ab046b888d58"
    ],
    "limitations": [
      "The offering labels in the intake file are the auditor's paraphrase of the site, not the owner's own wording. A mismatch between a paraphrased label and the site's language is not by itself a site defect; the finding rests on the fractional-cio page and the absent structured data, both read directly."
    ]
  },
  "EN-03": {
    "rating": "substantial",
    "confidence": "high",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "A Person entity with jobTitle, address, knowsAbout, and sameAs links to LinkedIn and GitHub is declared on all 25 sampled pages, all six sampled articles carry an author attribution, and /about carries a substantive first-person biography with specific roles and scope. Short of Complete because no credential is tied to an issuer or a date, so the expertise is described rather than evidenced.",
    "evidence_ids": [
      "ev_37df1c06d90f71ac",
      "ev_02acb40138951a1a"
    ]
  },
  "CI-01": {
    "rating": "partial",
    "confidence": "high",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "Read the top matching page for each priority question. The writing is strong but narrative: answers are embedded in flowing paragraphs rather than in self-contained passages under a heading that names the question. No heading anywhere in the sample is phrased as a question, and two priority questions ('what does a fractional CIO actually do' and 'how much does it cost') have no page that answers them at all.",
    "evidence_ids": [
      "ev_5cfea00370e86080",
      "ev_37df1c06d90f71ac"
    ]
  },
  "CI-02": {
    "rating": "minimal",
    "confidence": "high",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "Read the detected claims in context on the homepage, /about, and the situation pages. The claims are specific and commercially important: zero major nonconformities across six annual audit cycles, roughly 68 percent of company revenue tied to that capability, productivity gains equivalent to roughly 30 FTE, one integration enabling roughly $2M in annual revenue, roughly $5M in managed technology spend, roughly 15 percent annual vendor savings, and ticket resolution moving from eight business days to under two business hours. Not one of them states a measurement period, a baseline, a scope, or a method on the page where it appears. These are precisely the sentences an answer engine would lift and repeat without their caveats. This is the single highest-value gap in the audit.",
    "evidence_ids": [
      "ev_02acb40138951a1a",
      "ev_37df1c06d90f71ac",
      "ev_5cfea00370e86080"
    ]
  },
  "CI-04": {
    "rating": "minimal",
    "confidence": "high",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "Only two of 25 sampled pages link to any external destination that could function as a source, and none points at a standards body, regulator, or research host. Nine pages exceed 600 words while citing nothing external. Pages that discuss ISO 27001, SOC 2, HIPAA, and AI governance frameworks by name never link to the standard or framework they discuss.",
    "evidence_ids": [
      "ev_02acb40138951a1a",
      "ev_37df1c06d90f71ac"
    ]
  },
  "TA-01": {
    "rating": "partial",
    "confidence": "moderate",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "Six of eight priority questions have a substantive page. The two with no owning page are the two a buyer asks first: what a fractional CIO does, and what it costs. Four questions are matched by three or more competing pages, which reflects the site's structure: situation pages, book notes, and blog posts all touch the same subjects without one being the designated answer.",
    "evidence_ids": [
      "ev_1a94ac29449f2fa0",
      "ev_2414ab046b888d58"
    ],
    "limitations": [
      "Term overlap identifies topical proximity, not answer quality. The two uncovered questions were confirmed by reading the closest pages; the competition count was not individually verified for every question."
    ]
  },
  "TA-02": {
    "rating": "substantial",
    "confidence": "high",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "This is the site's genuine strength. The situation pages and the longer blog posts carry operator-level specifics that a summariser could not generate: seven ecommerce platforms consolidated into one, three ERPs merged, roughly 60 client integrations, a compliance program taken from zero to audit-ready in under a year. Short of Complete because none of it is backed by a published artifact: no template, dataset, worked example, or repository a reader could open and use.",
    "evidence_ids": [
      "ev_5cfea00370e86080",
      "ev_37df1c06d90f71ac"
    ]
  },
  "TA-03": {
    "rating": "partial",
    "confidence": "moderate",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "The site does state fit boundaries in prose, and does so honestly, for example being explicit about where AI will not work in a given business. What it does not have is any comparison or decision page: no criteria table, no fractional-versus-full-time discussion, and no alternatives named. A buyer comparing options has nothing here to compare with.",
    "evidence_ids": [
      "ev_2414ab046b888d58",
      "ev_37df1c06d90f71ac"
    ],
    "limitations": [
      "No competitors were supplied at intake, so competitor-specific coverage could not be assessed."
    ]
  },
  "TE-01": {
    "rating": "substantial",
    "confidence": "high",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "Read /about, /contact, and /privacy. A named individual, a stated role, a city, a working email address, a contact form that states plainly what it does with a submission, and detailed privacy pages. Accountability is well above what most sites in this category offer. Short of Complete only because the operating legal entity is never named.",
    "evidence_ids": [
      "ev_37df1c06d90f71ac",
      "ev_d76db615ec2be435",
      "ev_05b6bc243d937501"
    ],
    "limitations": [
      "The contact path was not exercised: no form was submitted and no mail was sent, by policy."
    ]
  },
  "TE-02": {
    "rating": "partial",
    "confidence": "high",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "ISO 27001, SOC 2 Type 2, and HIPAA appear repeatedly and are central to the site's positioning, but they are described as programs built inside an employer rather than as credentials held, and no issuer, audit period, certifying body, or scope statement appears anywhere. Only two of sixteen distinct credential statements sit within 120 characters of a date; the sixteen are repeated 37 times across the sample. A reader cannot tell which certifications belong to which organization, or when.",
    "evidence_ids": [
      "ev_37df1c06d90f71ac",
      "ev_02acb40138951a1a"
    ],
    "limitations": [
      "No credential was verified against its issuing body. That verification is outside the scope of a public-content audit and would be a Verified Audit tier activity."
    ],
    "corrections": [
      "2026-09-01: counts restated from occurrences to distinct statements after ADR 0014, and the date test broadened to accept a month and year. The rating is unchanged and was not re-decided; only the tool's counts in this reason were wrong."
    ]
  },
  "TE-03": {
    "rating": "partial",
    "confidence": "high",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "Outcome claims are abundant and unusually specific, but there is no case study: no named or responsibly anonymized customer, no authorization signal, no engagement scope, and a baseline or measurement period on only three of 25 sampled pages. The quotations detected are the situation-page headlines in the owner's own voice, not customer testimonials.",
    "evidence_ids": [
      "ev_2414ab046b888d58",
      "ev_37df1c06d90f71ac"
    ]
  },
  "TE-04": {
    "rating": "substantial",
    "confidence": "high",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "Read /privacy and /privacy/maildash. Both are substantive, current, and specific, including a separate children's privacy policy for a named product and an explicit data-minimization statement in the footer of every page. No terms-of-service page exists, but the site sells nothing on-site and takes no payment, so a terms page is not applicable to the current offer. Short of Complete because the contact form collects a message and a company website without the privacy policy being linked from the form itself.",
    "evidence_ids": [
      "ev_05b6bc243d937501",
      "ev_d76db615ec2be435"
    ]
  },
  "AC-01": {
    "rating": "substantial",
    "confidence": "high",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "robots.txt is a single permissive wildcard group allowing all paths, with a declared sitemap and no exclusion of any AI crawler. That is aligned with the owner's stated intent to be retrievable and citable. Short of Complete because the alignment is a default rather than a recorded decision: no named AI crawler group exists, so nothing in the repository or the file states that permitting them was chosen rather than inherited.",
    "evidence_ids": [
      "ev_fac7362013e17212"
    ]
  },
  "AC-03": {
    "rating": "substantial",
    "confidence": "high",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "The site exposes exactly one interactive surface, the contact form, and the page states its boundary in plain language directly beside it: the form sends a single email and adds the sender to no list. There is no checkout, no account, no public API, and nothing that could commit a visitor to anything. Short of Complete because that boundary is stated only in prose, with no machine-readable equivalent.",
    "evidence_ids": [
      "ev_d76db615ec2be435"
    ],
    "limitations": [
      "No form was submitted and no state-changing request was made, by policy. The boundary was read from the page, not exercised."
    ]
  },
  "MR-01": {
    "rating": "minimal",
    "confidence": "high",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "Eight priority questions were recorded in the intake file, but they were written by the auditor from the site's own content rather than agreed with the owner, and they carry no target-engine list, no rationale, and no dated baseline. A question set authored after reading the site is not a baseline; it is a description of the site.",
    "evidence_ids": [
      "ev_1a94ac29449f2fa0"
    ]
  },
  "MR-03": {
    "rating": "missing",
    "confidence": "high",
    "reviewer": "Chris Brock (signed 2026-08-30); assisted review by Claude Code",
    "reviewed_at": "2026-08-28T22:05:00+00:00",
    "reason": "No recheck schedule for the rubric, crawl sample, question set, competitors, or evidence exists. The intake file records none and no such schedule has been agreed. This is a documented absence rather than a collection failure, so it is rated Missing rather than left inconclusive.",
    "evidence_ids": [
      "ev_1a94ac29449f2fa0"
    ]
  }
}