Under the plain-English report

The inspection layer recognizes 21 measurement tools across three scored capability tiers plus a behavioral tier that surfaces but doesn't score. It's vendor-neutral on purpose: a shop running Matomo or Plausible scores on what it has, not penalized for not being Google.

Each tool carries its own signatures, and detection distinguishes present from configured, a script tag that loaded versus a tag that's actually wired up. That difference is what makes the rubric's core-analytics score graduated instead of binary.

function _detect(html, tool) {
  const scriptMatch = tool.script ? tool.script.test(html) : false;
  const configMatch = tool.config ? tool.config.test(html) : false;
  const present = scriptMatch || configMatch;

  let id = null;                       // pull the measurement ID if present
  if (present && tool.idExtract) id = (html.match(tool.idExtract) || [])[1] || null;

  return { present, id, scriptTagPresent: scriptMatch, configured: configMatch };
}

This is the decision the whole audit hinges on. Most sites deploy tracking through a tag manager that only fires after the browser runs the page's JavaScript. Read the raw HTML and none of it exists yet, so a plain fetch reports "no tracking" on sites tracking perfectly well. That false negative is the single most common way an audit lies.

So each site loads in headless Chromium, and the fetcher waits for the network to settle before snapshotting, because GTM and the GA4 tag it injects can take a couple seconds after first paint to fire. Only then does inspection run.

const response = await page.goto(target, {
  waitUntil: 'networkidle2',   // wait until the page stops making requests
  timeout: RENDER_TIMEOUT_MS      // 25s — GTM-injected tags fire late
});
// snapshot taken AFTER the page's own code has run and injected its tags

Reviews, rating, hours, and photos come from real Google Places data, not estimates. But Places search can return a different business than the one you asked for. So before any of that data is trusted, the returned name is scored against the requested one: strip corporate suffixes and filler words, tokenize, and measure how much actually overlaps. Below a 0.7 match, the result is thrown out rather than stapled to the wrong site.

function nameMatchScore(requested, returned) {
  const STOPWORDS = new Set(['llc','inc','co','company','the','and', /*...*/]);
  const tokenize = (s) => s.toLowerCase().replace(/[^\w\s]/g,' ')
    .split(/\s+/).filter(t => t.length > 1 && !STOPWORDS.has(t));

  const req = tokenize(requested), ret = new Set(tokenize(returned));
  const matches = req.filter(t => ret.has(t)).length;
  return matches / req.length;   // < 0.7 => rejected upstream
}

This is the core of the whole design. Scoring runs first and is fully deterministic. By the time the language model is called, every number already exists and is frozen. The model's only job is to phrase the analysis. It cannot change, override, or recompute a score, and the prompt makes that its explicit contract.

And the phrasing itself is constrained. The audit writer is given a hard banned-words list and one test for every sentence: could a twelve-year-old read it aloud and understand it? No jargon reaches the client.

// the narrative model's contract, stated up front:
// "Scores are already calculated. Claude's ONLY job is the words.
//  Claude does NOT change, override, or re-calculate any score."

BANNED = ['analytics', 'conversion', 'GA4', 'GTM', 'pixel',
          'schema', 'UTM', 'attribution', 'funnel', 'KPI', /*...*/];
// THE TEST: could a 12-year-old read it aloud and know what it means?

The audit findings also feed a content pipeline that drafts social posts, and it's split into two modules on purpose. The extractor is pure data: it reads the audits and produces a deck of facts, every one a real count or percentage. The generator then phrases that deck in Jon's voice, and it is only allowed to narrate what the deck contains. If a number isn't in the extractor's output, the model is not permitted to say it.

// extractor.js — the source of truth
// "Pure data work. No LLM. If a number isn't here, the
//  generator is NOT allowed to invent it."

const deck = buildAuditWeekDeck(audits);   // facts only, counts & %
const post = await generatePath1Post(deck); // LLM phrases ONLY the deck

Same principle as the audit, drawn again at the content layer: the deterministic part owns the facts, the model owns the wording, and the boundary between them is enforced, not assumed.