Performance / Core Web Vitals baseline logic
Public performance is treated as a recurring quality signal using lightweight pages, static delivery, compressed assets and periodic browser checks.
Technical Evidence
The visible machine room
behind the signal.
This page makes the public technical evidence layer visible without overclaiming formal certification, compliance or security audit status.
Security header baselineSitemap / robots hygieneNo-storage diagnostic toolsKnown limitations
Technical hygiene
Public checks and visible controls.
The items below are public website evidence signals, not guarantees.
Lighthouse / PSI baseline process
Lighthouse and PageSpeed-style checks are used as directional evidence during major implementation waves, with issues documented rather than hidden.
Hosting / CDN / Cloudflare note
The public site is packaged as static files and deployed through Cloudflare Pages/CDN logic for global delivery.
Security header baseline
Conservative headers are present in `_headers`, including nosniff, referrer policy, permissions policy, HSTS and report-only CSP logic.
Sitemap / robots / indexing hygiene
Public routes are listed in `sitemap.xml`, with private client assets excluded and robots referencing the canonical sitemap.
Structured data status
Core pages use conservative JSON-LD such as WebPage, Organization, Service and BreadcrumbList where appropriate. No review or rating schema is invented.
No-storage diagnostic tools
The Execution Signal Assessment™ runs in the browser and does not submit answers, store responses or create a backend record.
Known limitations
No formal penetration test, SOC 2, ISO certification, certified accessibility statement or legal compliance certification is claimed.
Consent-gated optional analytics
The optional Matomo loader requires accepted consent and is configured with Matomo cookies disabled. The current public HTML contains no Matomo URL or site ID.
Range-capable media delivery
Full-length homepage films are served from media.kulicadvisory.com on Cloudflare R2. The public media endpoint supports byte-range delivery for native seeking.
AICTIONBOT™ Signal Guide API
The Signal Guide's optional AI signal read posts to a same-origin /api/signal-guide endpoint handled by a Cloudflare Pages Worker. Requests are POST-only JSON with a 1,200-character limit and a six-turn context cap; responses are no-store. The Anthropic API key stays server-side, prompts are not logged raw, no transcript is stored by the website, and a deterministic offline fallback answers when the provider is unavailable or the feature is disabled.
Durable Executive Intake
Executive Intake submits to the same-origin /api/executive-intake endpoint handled by the Pages Worker. The request is validated before accepted fields are stored first in Cloudflare D1; the browser receives a short KA reference. The Worker uses a field allowlist, honeypot, isolated rate limit, idempotent submission ID and attachment rejection. Email is a secondary notification through a private mailer Worker and cannot decide whether the D1 record exists. Preview and Production use separate databases; records expire after 30 calendar days and scheduled cleanup removes expired rows. Intake fields are not sent to Matomo or written to Analytics Engine, and the Intake record does not store IP address, user agent, cookies or analytics identifiers.
24h implementation response
The three audit focus points
The audits did not show a messaging problem. They showed the next maturity layer.
Prove the machine room
Make performance, headers, TLS, CDN, monitoring and security posture more visible and commercially usable.
Institutionalize trust
Turn founder trust into a broader trust system: method, proof taxonomy, delivery principles, security and data handling.
Operationalize AI visibly
Move from AI narrative to visible diagnostic and productized experience through the Execution Signal Assessment™ and AICTIONBOT™ system logic.