Generated by the Single Page Sales pipeline, unattended autopilot session, 2026-09-05.
Source of truth: ~/Programming/policy-forge/. Full pipeline outputs live in
~/Programming/single-page-sales/pages/line-and-clause/.
Nine blockers and six repo findings. The three human checkpoints the pipeline requires (after stage 03, after stage 06, after stage 11) all passed without a human, because the session was unattended. None of them is satisfied.
policyforge.co is a live commercial AI privacy-policy generator: free tier of
two policies a month, Pro at $15/month, hosted policy pages, REST and MCP endpoints. Verified
by fetching the site on 2026-09-05. Same category, same name.
“Line & Clause” is this session's invention. Tim has not approved it, its availability as a business name or domain has not been checked, and the page uses it throughout. The FAQ discloses the collision because a prospect who searches the name will find the other company; if the name changes, that FAQ entry goes.
No email address, no booking link, no contract, no payment rail, no refund mechanism. All three money CTAs are placeholders: dashed borders, and clicking one reveals a note saying so. This is the single largest conversion problem on the page and the red team's pre-mortem named it as the most likely cause of a 0.1% conversion rate.
$490, $2,400, $3,900, three business days, two weeks, five founding engagements. Not one of these came from Tim. They were chosen by the pipeline to make the page coherent. The page's own footer says so.
The $490 tier is at least anchored to something real: it covers the deterministic half of the system, which works today. The $2,400 tier prices a deliverable nobody has ever received.
The system's own _config/scope-limits.md is well constructed and the
domain-expert persona in the gauntlet could not break it. The residual risk is not the page,
it is the engagement: a human operator sitting with a founder and helping them settle
purpose, legal basis and retention is closer to the line than software producing a document
from the user's own inputs. Tim has taken no advice on this. It could kill the paid tier
without touching the free tool.
“Refunded in full if the Evidence Pass surfaces nothing you did not already know,” buyer as sole judge, 14 days. The 14-day window was invented here. The page also states out loud that the promise is exploitable and that the hole stays open on purpose. That is a real business decision that needs a real yes.
Not a weakness of the writing. A fact about the business. The page substitutes artifact proof (exit codes, commit SHAs, file:line citations, a live tool) and states the absence plainly in “Who this is for.” Ten of ten test personas accepted the substitution; the $2,400 tier still caps at roughly 30% estimated conversion because of it.
No precision, no recall, no labelled fixtures. Every accuracy figure in the literature is from mobile-app research and does not transfer. The page therefore claims only what the repository claims about itself: it finds what questionnaires miss. If anything on the page is ever strengthened past that, it becomes false.
Related: the page states it has not been measured against Django, Rails or Laravel. That remains true.
The CPPA regulations (§7011/§7012/§7025, effective 1 Jan 2026) and the FTC
click-to-cancel vacatur (8 Jul 2025) are stated on the page and were not
independently re-verified in this session. They come from policy-forge/HANDOFF.md.
The third claim, UK PECR reg.6 and Schedule A1, was re-verified during the gauntlet: DUAA 2025 s.112 and Sch.12 amended reg.6 in force 5 February 2026 and inserted Sch.A1, and the statistical-purposes exception does put qualifying analytics on an opt-out footing. Verify the other two the same way before publish, or attribute them.
policy-forge has one commit and no remote. Eight modified files and three
untracked ones are uncommitted, including _config/terms-clauses.md, which stage 07
of the pipeline needs in order to run at all. The page invites people to buy an engagement that
depends on this code.
eu-gdpr-art14 fires against every privacy policyThe regime carries no appliesWhen at either the regime or element level, so
both of its elements are checked against every document regardless of whether the operator
obtains data from the data subject. Article 14 governs data not obtained from the
subject. Two of the ten errors in the page's own worked example are this bug.
Fix: condition the regime on something like
obtainsDataIndirectly == true, and add a tools/test.mjs case, since
the suite already has a shape-test for fully-conditional regimes.
Five of the ten errors against a plain-English, first-person privacy policy were false
absences: recipients requires we share / we disclose /
third party; rights requires the phrase “right to access”
and misses “those rights are formally: access, rectification, erasure”;
withdraw-consent requires “withdraw consent” and misses
“withdrawal of consent”; non-discrimination requires the token
“discriminat”; ep-withdrawal-route requires “cookie
settings” and misses “Cookie choices link in the footer.”
This matters more than a tuning nit: GDPR Art.12(1) requires clear and plain language, and the rule set generates its worst false-alarm rate against exactly the documents that comply with it best. Fix: add first-person and plain-language alternates to the match arrays, and add a first-person fixture to the test suite.
policy-forge/HANDOFF.md (last written 2026-08-13 09:51) still lists “fix
the games-portal ePrivacy exposure” as a next step, but the fix landed at 08:35 the same
day in commit 8486aff. The finding and the fix are both real and same-day. The
page therefore says the exposure was found and fixed; it does not claim the tool caused
the fix, and it must not be edited to.
observe.mjs has never run against a live siteNeither run has runtime cookie evidence. The entire cookie and consent half of the system is undemonstrated. The page quietly does not claim it, and nobody should add a claim later.
vendor-registry.json is marked UNVERIFIED in the repoSo is the record-schema half of consent-record-spec.md. The registry is what
checkRecipients runs on, and it sits on the ERROR channel.
no-passive-update-clause is the rule the page leads with in
“The questions it never asked.” Its forbidden array holds five
patterns, and the first one is written as a regex alternation:
"check (this|the) (page|policy|notice) periodically"
But it has no leading /, so checkRegime takes the non-regex
branch and escapes every metacharacter, including the parentheses and pipes, before matching.
The pattern becomes a literal search for a string containing (this|the) and
therefore matches nothing.
Verified 2026-09-05 against the compiled bundle:
silent "Please check this page periodically for updates." FIRES "Please check back periodically for updates." FIRES "You are encouraged to review this policy from time to time." FIRES "We encourage you to periodically review this policy."
The other four patterns are plain strings and work. So the rule catches most real phrasings and misses the single most common one, which is the one the page quotes.
Fix: wrap it in slashes, as ep-no-implied-consent already does
for its own alternations. Then add a test: nothing currently proves a forbidden
pattern can actually fire, which is how this survived.
Consequence for the page, already applied: the sample policy in the widget uses “check back periodically,” which the rule does catch, so the demo is real. The prose in “The questions it never asked” is still accurate as written (the rule is in the rule set, at error severity, cited to WP260 rev.01), but a reader whose own policy uses the “check this page periodically” phrasing will paste it and see nothing. Fix the rule before this page goes live, or the page's best cold-open lands on a silent result.
node tools/test.mjs → 32/32 passed, exit 0, 2026-09-05.disclosure-elements.json; zero elements missing a citation. The build script
fails if any of those three numbers stops matching the page copy.games-portal/src/legal/privacy.md: 10 errors, 2 warnings.
Each of the ten read individually against the document to produce the 5 / 2 / 3 split the
page reports.games-portal commit 8486aff: 8 files, 611 insertions,
2026-08-13 08:35 -0700.At stage 07 the pipeline replaced a vague line with an invented statistic: “one was missing eleven of the sixteen Art.13 elements and the other was missing four.” It had the right shape and no source, on a page whose entire argument is that unsourced confident sentences are the defect.
It was corrected by making it true rather than deleting it: the gate was run against a real document and the real numbers went on the page, which also surfaced repo finding #1 above. Recorded here rather than quietly fixed, because that is what the source project does with its own mistakes.
| Dimension | Score | Min |
|---|---|---|
| Persuasion Power | 4.2 | 4.0 |
| Voice Authenticity | 4.6 | 4.0 |
| Structural Completeness | 4.3 | 3.5 |
| Proof Density | 4.0 | 3.5 |
| AI Invisibility | 4.5 | 4.0 |
| Composite | 4.32 | 4.0 |
Adversarial gauntlet: two cycles, ten hostile personas. Page average 3.83 → 4.22. Sections scoring below 3.5: five → zero. Skimmer audit: 4 of 7 checks → 7 of 7. Would-buy: 8 of 10 → 10 of 10. Voice metrics: 14 of 14 pass, with the scorer recalibrated against the brand's own prose at stage 04.
7,202 words. Zero em dashes. Zero testimonials, because there are none.