Every practice site talks to outside services — booking widgets, payment plans, fonts, trackers. This is the machine that decides who stays: the services you manage stay, the ones a real feature depends on stay, and every stranger gets flagged for a human — automatically, with the reason on record, decided once and remembered forever.
Draft for Robert’s annotation · four calls to make · nothing builds until you rule
Keep if sanctioned OR functional — your rule, verbatim. Everything else is a stranger.
Strangers never get silently kept or stripped — they park in a review queue for a human.
Additive only — it never deletes or edits an entry a human already attested; settled hosts are never re-litigated.
Born from real cases — JotForm and the Cloudflare email-decoder are permanent regression fixtures.
The journey — one stranger host walks the line
Follow a single unknown host — say pixel.somevendor.example, spotted in a fresh
capture — through the five checkpoints. Every outside host on every future site takes this
exact walk.
It shows up in the capture. The classifier reads the same request
list our existing gates already trust — no new crawling, no new instruments. Every host that
isn’t the practice’s own domain gets in line.
↘ go deeper — what the builder reads
Host discovery = the capture/HAR manifest, the identical source live-services-registry.ts and the self-contained gate consume. No bespoke enumeration.
Have we already ruled on it? If this host is in the registry —
fleet-wide or for this practice — the old decision stands and the walk ends here. Settled means settled.
↘ go deeper
Stage 0 short-circuit against config/live-services-registry.json. Also the idempotency gate: a second run on the same site writes exactly zero new entries.
Is it ours? If it’s part of the toolset Digital Empathy already
manages for that account — we set up their forms, we run their analytics — it’s sanctioned.
It stays, and the registry remembers why.
↘ go deeper
Stage 1 lookup surface is deliberately open (builder investigates first): Neuron/CRM service inventory via de-brain, or a seeded per-account list if no live API exists yet. A seed list files a follow-up to wire the real lookup.
Does something real break without it? (the load-bearing test)
Not “it tracks something” — a booking widget that won’t open, a payment button gone dead.
This is a real experiment, never a guess: render the page with the host blocked, and compare what the
page can actually do against the untouched render. A real difference → it stays, on evidence.
↘ go deeper
Stage 2 render-diff: Playwright request-blocking + DOM/behavior diff, reusing the rendered-outcome harness (capture-rendered-outcome.ts / assert-rendered-outcome-parity.ts) rather than a bespoke tool. Material difference = element fails to render, an interactive control stops working, or a 4xx cascade from the missing dependency.
Do we already handle it a better way? Some hosts aren’t a
keep-or-strip question at all. The Cloudflare email-decoder taught us this: we decode the email
ourselves at build time, so the outside script never needs to exist in the replica. A short, named
list — never inferred, always explicit.
↘ go deeper
Stage 3 HANDLED-ELSEWHERE: a closed, hand-maintained list starting with cfemail-decode. Logged for audit; writes nothing to the registry — a truly handled host shouldn’t appear in replica requests at all.
Otherwise: flagged, parked, remembered. Our stranger
pixel.somevendor.example reaches the end with no sponsor and no job — so it goes to the review
queue with everything we know about it, for a human to make the actual call. Once. Forever on record.
↘ go deeper
Stage 4 default → config/third-party-review-queue.json: hostPattern, siteId, first-observed, raw evidence (request path, initiator, response snippet), and the stage outcomes that led here. The queue is never consulted as an allow-list by the self-contained gate — flagged is not a decision.
Your four calls — the red-pen targets
Each of these changes what gets built. Tap the ✎ on any card, or just tell me in chat — a
number and a word is enough.
1 · Is the rule right?
“Keep if sanctioned OR functional; everything else flags for a human.” This one sentence is
the whole machine — if it’s off, everything downstream is off.
2 · Who owns the flagged queue — and how often is it read?
Without an owner and a rhythm, “flag and proceed” quietly becomes “keep everything.”
Name a person (you? Alie? rotation?) and a cadence (weekly? per-site-launch?).
3 · What counts as “ours”?
Only services visible in Neuron/CRM for that account — or also the things everyone knows are fine
(Google Fonts, map tiles) that already live in the fleet-wide registry? Draft assumes the latter,
since those are already attested.
4 · Does a flagged host ship, or block? — the biggest one
While a stranger waits for its human review, does the replica go live carrying it, or does the site wait?
Draft says ship-while-flagged (your “flag-and-proceed” wording), which favors launch speed and
accepts the risk window. “Block” favors safety and slows launches. Real judgment call.
What could go wrong (honest)
False “keep.” The classifier waves through a host that’s neither ours nor load-bearing
— and every future replica ships someone’s tracking pixel. Countered by the say-no gate below: it must
demonstrably refuse a known-bad host before we trust it anywhere.
False “strip.” It removes something that actually mattered and silently breaks a feature the
practice pays for. Countered by making “functional” an experiment against the real captured behavior, never a guess.
The queue becomes a graveyard. If nobody reads it, ship-while-flagged decays into keep-everything
by default. This is exactly why call #2 asks for an owner and a rhythm before this gets built.
The proof gates (all must pass before it touches a real site)
The two teachers. JotForm classifies as ours-and-load-bearing; the email-decoder as handled-by-us. Permanent fixtures — it can never regress on the cases we solved by hand.
It must be able to say no. A fake tracking pixel — no CRM record, no render impact — must flag. If it ever passes as anything else, the build fails.
Settled is settled. Second run on the same site writes exactly zero new entries.
Malformed writes die loudly. Every entry it writes validates against the registry’s existing closed schema, or the write throws. No silent corruption.
One home per host. A flagged host is never simultaneously a registry entry — the two files are disjoint by construction.
Undo is trivial. It only ever adds entries — rollback is a clean revert. It cannot edit or delete anything a human attested.
The classifier must be able to say no. A stranger that classifies as anything but
FLAGGED is a failed build — this floor is what stops the guest list from becoming a rubber stamp.
What happens on your word
You rule on the four calls → I fold your rulings into the spec → an independent reviewer red-teams
it (never the author) → only then does anyone write code. The two specimens become its first tests, the
say-no fixture keeps it honest forever, and the registry stays the single paper trail. Nothing is built from
this draft alone.