# Executive Summary — personal-site ("The Construct") Codebase Analysis Date: 2026-07-01 · Synthesizer roll-up of four `codebase-*` skill reports --- ## What this repo IS `personal-site` is Boden Fuller's public site **bodenfuller.com ("The Construct")** — a Next.js 16 App Router marketing/proof/writing property with a filesystem-backed MDX blog, a per-request strict CSP, and a bespoke "phosphor-terminal" design system. It is a **content-as-code hybrid**: ~9,451 LOC of code (`src/`, `middleware.ts`, `scripts/`, `e2e/`) wrapped around a much larger ~728-file markdown knowledge/career workspace (`career/`, `.agents/`, `docs/`, root canon docs). Only the code surface plus the 25 rendered MDX essays are software; the rest is architecture context, deliberately excluded from code audit. The whole architecture pivots on one deliberate constraint: rendering is server-default (RSC), a nonce-based strict CSP is minted per request in `middleware.ts`, and `style-src` is intentionally left `'self' 'unsafe-inline'` (`src/lib/constants.ts:22`) because the design system styles via React inline `style={{}}` attributes — which nonces do not cover. That single decision shapes rendering, deployment, and half the findings below. ## Architecture-health verdict **Healthy and unusually deliberate for a personal site — no critical defects, but carrying one real security exposure and a cluster of DRY/consistency debt.** The security scaffolding (strict `script-src`, documented `style-src` rationale, path-traversal guards, XSS-escaping JSON-LD serializer) and accessibility scaffolding (skip link, reduced-motion kill-switch, focus-visible, labeled hero, axe e2e) are genuinely strong and verified, not assumed. The two soft spots: the pinned Next.js version sits on an XSS advisory that targets this app's own nonce model, and the home page's JSON-LD bypasses both the nonce path and the escaper. Neither is catastrophic; both are cheap to close. --- ## The four reports **01 — Archaeology** (`01-archaeology.md`): Maps the layer model — `middleware.ts` (nonce+CSP) → `layout.tsx` (`await connection()` forces dynamic render, wires fonts to CSS vars) → RSC pages with surgical client islands → `src/lib`/`src/data` → filesystem (no DB, no external API in request paths). Identifies three sources of truth (`src/content/writing/*.mdx`, `src/data/builds.ts`, `src/lib/mission.ts`) and nine maintenance gotchas. Establishes that `getAllPosts()` (`src/lib/blog.ts:31-114`) is the single content pipeline feeding pages, `/api/posts`, `sitemap.ts`, and `/llms.txt`. **02 — Architecture Report** (`02-architecture-report.md`): The handoff-grade technical writeup of the same seam, centered on the CSP. Notably **corrects the scout map**: `.github/workflows/ci.yml:13-105` DOES exist and runs `validate` → e2e + vibe-check on push/PR to main — CI is a real enforcement layer, not absent. Also flags Node version drift (`package.json:74` pins `24.x`; CI `ci.yml:23` and `Dockerfile:5` use `node:20-alpine`, Dockerfile self-labeled "Next.js 15") and the hand-maintained `sitemap.ts:8-17 SITEMAP_SOURCE_PATHS` route list. **03 — Audit** (`03-audit.md`): 17 findings across security/perf/ux-a11y/api — **Critical 0 · High 1 · Medium 6 · Low 10**. The one High is the outdated Next.js on the CSP-nonce XSS advisory (GHSA-ffhc-5mcf-pf4q). Mediums cluster around the home JSON-LD, per-request MDX recompilation, the blocking `git log` sitemap spawn, mobile-nav focus order, and low-contrast accent text. Confirms the CSP/a11y scaffolding is genuinely solid. **04 — Pattern Extraction** (`04-pattern-extraction.md`): 9 recurring un-extracted patterns. Highest-value: 7 copy-paste OG images where the DRY helper (`src/lib/proof-og.tsx:10-63`) already exists and is proven by `src/app/work/*`; ~100 hardcoded neutral-ramp hex literals that block the amber "Drawing Set" reskin; and the home nonce-less JSON-LD (same defect as audit M1, cross-confirmed). Notes which three extractions (OG renderer, color ramp as per-skin CSS vars, `.mjs` script harness) pay off twice across Bo's green/amber skins. --- ## Prioritized action list ### P0 — do first (security correctness) 1. **[SECURITY/High] Update Next.js off the CSP-nonce XSS advisory.** `package.json` `"next": "^16.1.7"` resolves to **16.2.4**; `npm audit` flags GHSA-ffhc-5mcf-pf4q ("XSS in App Router apps using CSP nonces") plus middleware-bypass and image-DoS advisories across `16.0.0–16.2.5`. This targets the app's entire nonce-based security model. Fix: `npm install next@latest` (≥16.2.6), re-run `npm audit`, add a CI audit gate. — *Audit H1 / `package.json:74`* 2. **[SECURITY/Correctness] Migrate home JSON-LD to `JsonLdScript`.** `src/app/page.tsx:33-36` emits structured data via raw `