OFB-SA-001 · Observed 2026-08-04 · Documentation integrity
Public methodology versions had drifted from the runtime
Meaning: Readers could not reliably connect the public methodology surface to the rule versions recorded in a completed report.
Remediation: The homepage, methodology index, changelog, and trust record now consume shared release metadata. API methodology metadata also follows the roadmap rules actually generated.
Fresh verification condition: Automated tests require public trust surfaces to consume the shared release source and require API roadmap metadata to match the generated roadmap.
State: corrected and regression checked
OFB-SA-002 · Observed 2026-08-04 · Machine-readable discovery integrity
Machine-readable llms.txt freshness and no-score wording had drifted
Meaning: The file still carried an older update date and described the methodology as including scoring even though the current product explicitly produces no aggregate score.
Remediation: llms.txt is now generated from the shared release metadata, links the public trust artifacts, and describes the current no-score methodology accurately.
Fresh verification condition: Production validation requires the current review date, report contract, self-audit links, and no scoring claim in llms.txt.
State: corrected and regression checked
OFB-SA-003 · Observed 2026-08-04 · Accessibility and brand trust
Dark trust sections inherited illegible page-level text colors
Meaning: The homepage FAQ and audit-boundary sections could render dark navy text on a near-black background, making important limitations difficult or impossible to read.
Remediation: A final shared dark-surface contract now sets explicit navy backgrounds, white headings, light body text, muted light secondary text, and accessible border colors for both sections.
Fresh verification condition: Regression tests require the shared selectors and calculate contrast ratios of at least 4.5:1 for body text and 3:1 for headings against the dark surface.
State: corrected and regression checked
OFB-SA-004 · Observed 2026-08-04 · Evidence timestamp integrity
Report timestamps used ambiguous locale-dependent formatting
Meaning: A timestamp such as 04/08/2026 could be interpreted as either 4 August or 8 April, and the displayed value did not identify its timezone.
Remediation: Completed reports now format checked and generated timestamps as YYYY-MM-DD HH:mm:ss UTC and retain the exact ISO instant in the title attribute.
Fresh verification condition: Regression tests reject toLocaleString-based report timestamps and require the explicit UTC formatter and ISO timestamp pattern.
State: corrected and regression checked
OFB-SA-005 · Observed 2026-10-04 · Privacy and persistence integrity
Public persistence and account copy lagged the shipped history product
Meaning: The detailed methodology still said completed reports were not intentionally stored, while the Trust Center described the product as stateless and the Privacy notice still said accounts and sign-in had not shipped. Those statements conflicted with anonymous snapshot retention, optional saved history, and user export and deletion controls already in the product.
Remediation: The methodology, Privacy, Terms, Trust Center, shared release metadata, and canonical product facts now distinguish anonymous 30-day retention from explicitly saved account history, state that the basic audit remains account-free, and describe the available account controls.
Fresh verification condition: Public trust surfaces should no longer describe the product as stateless or say accounts and report persistence are unavailable; they should distinguish anonymous retention from saved history and keep external-provider outcome limits explicit.
State: corrected and reviewed
OFB-SA-006 · Observed 2026-10-04 · Crawler policy interpretation integrity
Crawler-policy interpretation overstated search relevance and user-triggered robots enforcement
Meaning: The crawler registry had stale provider semantics for ChatGPT-User and Anthropic verification data, and the unified evidence layer treated string-valued search relevance such as not_direct and indirect as truthy. A blocked training or user-triggered token could therefore be counted as a blocked search-relevant crawler, while policy-goal alignment could imply robots.txt enforcement for agents whose provider says the rule may not apply or is generally ignored.
Remediation: Crawler records were revalidated against current OpenAI, Anthropic, and Perplexity documentation. Unified evidence now normalizes direct Search relevance to a boolean and requires provider-documented robots applicability before producing a Search-blocked finding. Policy-goal alignment returns not determined for non-applicable or uncertain user-triggered robots controls, and its rules version was advanced.
Fresh verification condition: Regression tests require blocked non-Search crawlers to stay out of Search-access findings, require genuinely blocked direct Search crawlers to remain actionable, and require false or unknown robots applicability to remain not determined in policy-goal alignment.
State: corrected and regression checked
OFB-SA-007 · Observed 2026-10-04 · Structured-data interpretation integrity
Structured-data checks blurred provider requirements, heuristics, and page scope
Meaning: The focused JSON-LD model could fail Organization markup for missing fields even though current Google Organization guidance documents no required properties; the Recipe checker advertised recipe-page checking while actually inspecting the homepage; and the Organization generator omitted the stable @id that the adjacent identity checker recommended.
Remediation: Structured-data rules now distinguish documented provider requirements from OpenForBots focused-shape heuristics. Organization gaps are recommendations rather than provider-required failures; Recipe retains Google-required name and image plus the conditional recipeYield rule when per-serving nutrition calories are declared; the focused Recipe tool safely inspects the submitted same-site page without adding it to homepage audit history; and the Organization generator now emits a reusable #organization @id while describing sameAs as an identity-reference relationship.
Fresh verification condition: Regression tests require Organization recommendation gaps to avoid provider-required failures, Recipe conditional requirements to remain provider-documented, targeted Recipe checks to reuse the bounded public-page retriever and stay out of saved homepage history, and generated Organization markup to include the stable identifier used by the identity guidance.
State: corrected and regression checked