[sindredg]

Waiting for review: the README and four new diagrams change how the repository reads.

Change

• The README leads with a tech summary by layer and five headline numbers, then reading paths, one overview image, and a dedicated section for the AI triage agent: its path, speed, results and guardrails.
• Four diagrams, each in a light and a dark PNG, switched by <picture>: overview, triage path, triage speed, triage accuracy. Sources are HTML in scripts/diagrams/, rendered by scripts/render-diagrams.sh through headless Chromium.
• The Serving and Delivery Mermaid diagrams move under a Platform section. The capability table is grouped into Platform, Delivery, and Security and the agent.
• reference/triage-worker.md opens with a reading order. decisions.md opens with an index of its domains.
• scripts/check-docs.sh now counts images referenced from src and srcset attributes.

Corrections

• "Crash to recorded verdict on redelivery: 285 ms" was wrong. The redelivery arrived about 25 s after the crash, and 285 ms is the time to write four ledger states once it did. The row now says both.
• Cloudflare is DNS only: sindrg.com resolves to the reserved Google address, so HTTPS goes straight to the load balancer. The overview and the Serving diagram drew traffic through Cloudflare; both now show a DNS lookup and a separate HTTPS path. The Serving diagram on main had the same error.
• The worker skips vulnerability findings, so the tagline names the three classes it triages: misconfiguration, threat and external exposure.
• The model path in the speed chart is the measured rules-path delivery (2.80 s to the worker), plus the model call (1.3 s p50, 1.9 s p95, slice 13), plus the 285 ms a notifying verdict took to write (slice 7): 4.4 s at p50 and 5.0 s at p95.
• Two guardrails were narrowed to what was tested. A crash cannot lose a finding, and a message that fails five deliveries is parked with its body intact. The injection drill covered the fields a resource's creator controls; detector-written fields are covered by unit tests only.
• The headline speed is 2.9 s from finding change (14:54:27.039Z) to acknowledged verdict (14:54:29.968Z), read from the ledger object generations in Phase 15 slice 8. It is measured on the rules path only. The model path is summed from measured parts and labelled that way.

Validation

• ./scripts/check-docs.sh: ok: 745 links and 325 images resolve, local.
• The srcset rule fails when pointed at a missing file: image not committed images/diagrams/missing-dark.png and image unreferenced images/diagrams/speed-dark.png, exit 1. Restored, it passes.
• shellcheck v0.11.0, the CI pin, passes on scripts/*.sh loadtest/*.sh, local.
• Each PNG was rendered and inspected locally in both themes.
• GitHub keeps the <picture> tags in its rendered HTML, read through the readme API with Accept: application/vnd.github.html.
• The branch README, captured with headless Chromium on github.com: the light theme shows the light images and the dark theme the dark ones. Every table and image renders.

Not verified

• The Serving Mermaid block renders in light and shows "Unable to render rich display" in dark, in two headless captures. The source is unchanged apart from two unused classDef lines, and renders in light, so the source is valid. main shows the same failure in dark on its Triage block, so the cause is likely GitHub's Mermaid viewer under headless Chromium. Check it in a real browser in dark mode.

🤖 Generated with Claude Code