VALUE.md - "The Web Quality Discipline" canonical reference
Date: 2026-06-19 Type: Research brief, written as a VALUE.md per the Keep a Value discipline (see https://www.keepavalue.com/). Addressed to: A research LLM with web-research, code-reading, and long-form-writing capability. The brief is self-contained; no prior conversation context is required.
This brief is itself a contract: a working VALUE.md for the research project. The reader's job is to read it once, produce the deliverable described below, and pass the gate at the bottom of this page.
Q0 - Grounding observation
On 2026-06-18 the author of Keep a Value spent a single working session moving the live site at https://www.keepavalue.com/ from "audit-clean" to "Lighthouse 100/100/100/100 with 0 failed audits, 46 of 77 audit findings shipped, 6 strengths confirmed, 7 obsoleted by a clean architectural refactor, 8 accepted as design-intent, 7 documented as vendor-blocked, 2 awaiting external action, 1 documented as a permanent-URL commitment, 0 still open." The workflow used:
- A multi-agent audit produced a register of 77 findings across 7 axes (Lighthouse, HTTP, SEO, Content/IA, URL/Canonicals, Sitemap/Crawler-Signals, Code/HTML-Quality).
- Each finding carried fields: severity, evidence, recommendation, sources, effort, how-to-verify-the-fix.
- Findings were re-rated by IMPACT = (user-visible + security + discoverability) x effort-multiplier, so that severity calibration didn't hide a real CVE under a "medium" label.
- Sub-agents were dispatched in parallel batches by axis-cluster to ship the fixes, with deterministic verification of each shipped fix.
- A final closure pass triaged the remaining items into shipped / obsoleted / strength / accepted / vendor-blocked / external-pending / documented.
The work was completable in one session because the author already had a mental model of the axes, the best practices on each, and the verification recipes for each finding. Most web developers, including the senior ones who care about their craft, do not have this mental model written down anywhere. They have fragments: a Lighthouse run from their CI, a Google Search Central article they bookmarked, a Twitter thread on HTTP/3, a vague sense that "I should be doing SRI." When they want to hold their site to a high standard, they have to assemble this model from first principles every time, and they have no operational artifact that converts the assembled model into shippable work.
The build trap here is specific: the senior web developer builds another performance pass, another a11y pass, another SEO pass - each pass produces a list of opinions, none produces a discipline. The recipient experiences the result as "my site is good according to what I checked, but I don't know what I didn't check, and I have no way to know if I regressed last week."
Q1 - Who it's for
The senior web developer who holds their public-facing work to the highest standard available in 2026, and who personally owns the one domain in question. They run a personal site, a docs site, a startup landing page, an open-source project page, or a small SaaS marketing surface. They have shipped real production code. They have read Lighthouse reports and run them in CI. They know what Brotli is and have opinions about HTTP/3. They are not the audience for "5 SEO tips for beginners."
One named example (per Keep a Value's recipient-naming rule): the author of an open-source library who launches a new docs site, runs Lighthouse on it, sees 99/100/100/100, and is told by the report "DOM size could be smaller." They want to know: which other axes did Lighthouse not check, and how do I bring every axis to the same 100? They have a Monday afternoon, a Cursor session open, and the energy to do the work. They do not have the canonical reference.
Scope discipline (whom this document is NOT for, and why): this document is for the operator of a single domain who controls the CDN, the DNS, the build, and the content. It is not the agency taxonomy for a 60-person shop shipping 40 client stacks across Next.js / Astro / Sanity / Vercel / Cloudflare. The agency taxonomy needs additional standalone axes (accessibility-as-legal-exposure, consent-mode / cookie governance, internationalization / hreflang, security-headers as a lane separate from HTTP versioning, performance-budgets as RUM/CrUX separate from Lighthouse lab scores) that this document covers but does not promote to top-level axes. Agencies and platform teams should treat this document as an input to their internal QA taxonomy, not a replacement for it. The brief names this scope explicitly so that a senior agency lead reading the deliverable does not assume the absence of an axis means it doesn't matter; it means it is out of scope for the solo-operator framing.
Q2 - What changes for them
Before: A senior web developer holding their site to a high standard has the following operational reality:
- They know that Lighthouse exists and gives them 4 scores. They do not know that Agentic Browsing is an emerging 5th category in Lighthouse 13, or what passes its checks.
- They have heard of HSTS preload but have never read the actual technical requirements. When they do try to submit their domain, they get a vague "errors below" response and have to guess what to fix.
- They know that sitemaps exist. They do not know that Google ignores
<priority>and<changefreq>, that Bing partially honors<changefreq>, that<lastmod>is Google's primary freshness signal, and that the canonical sitemap shape includes an Images extension viaxmlns:image. - They know about CSP. They have probably written a CSP that includes
'unsafe-inline'. They do not have a mental model for hash-based CSP, the per-script-block hash recomputation discipline, or what the four CSP-relevant inline-script types in HTML5 actually are. - They are aware that AVIF and WebP exist. They have not converted their OG image to AVIF and they could not tell you the AVIF encoder flags they would use.
- They know that robots.txt exists. They have probably never declared posture for GPTBot, ClaudeBot, CCBot, and Google-Extended.
- They know that "soft 404s" are bad in Google Search Console. They cannot describe a single-line mitigation that uses a meta tag injected by an SPA error handler.
- They have heard of microdata and JSON-LD. They cannot tell you which schema types a documentation site benefits from beyond WebSite and Article.
- They know what a Cool URI is, but have never written down which URLs they commit to keeping forever.
The cumulative effect: they ship a "good enough" site, periodically panic about what they might have missed, and have no way to measure regression or improvement except by re-running Lighthouse and trusting the score.
After: Reading the document this research project produces, the same senior web developer can do all of the following without further reading:
- Enumerate every quality axis a 2026 public-facing site is judged on (the 7 audited here plus any the research discovers, e.g. PWA-readiness, Web Vitals real-user vs. lab, structured data depth, internationalization, accessibility beyond the automated tools).
- Cite the canonical authoritative source for each best practice on each axis (W3C spec, MDN reference, Google Search Central article, RFC, browser vendor blog post, accessibility WCAG SC). Not blog posts.
- Run a single recipe per axis to capture a baseline number on their own site. The recipes are concrete:
curl ...,lighthouse ...,openssl s_client ..., browser DevTools paths, vendor-specific API endpoints. - Identify which findings are vendor-blocked vs. their own to fix, so they don't waste energy chasing things their CDN can't do.
- Convert the baseline into a register of findings, prioritize the register by IMPACT not severity, ship fixes in dependency order, and verify each fix with a one-line recipe.
- Iterate weekly or monthly against the same register and observe regression or improvement as a delta, not as a vibe.
The change is operational. The recipient stops assembling the discipline from first principles every quarter and instead operates against a written reference that survives across projects, browsers, CDN vendors, and the next 18 months of web platform churn.
Recipient-defined verification: when this document lands, the same senior web developer should be able to:
- Read it in a single sitting and identify every axis they were not auditing before.
- Run the baseline-capture recipes against their own site within 90 minutes.
- Produce their own audit register with no fewer than 50 findings (their site won't be perfect) and no fewer than 5 strengths.
- Ship at least 3 trivial-effort fixes within the same week.
- Re-run the baseline 90 days later and observe a measurable delta.
If a sample of three such developers can each do steps 1-5 against their own site, the document delivered. If they bounce off because the document is too abstract, too tied to one CDN, too anecdotal, too academic, too breezy, or too long, the document failed.
Q3 - How will you know the change happened for them?
A stranger (defined here as: a senior web developer who has never read Keep a Value, has never spoken to the author, and only sees the published document) can do the following without asking for help:
Verification recipe 1: Visit the document URL. Run Ctrl-F for any of the following terms. Each must appear as a heading or a definitional block, not a passing mention:
LCP,CLS,INP,HSTS preload,CSP hash,CSP nonce,SRI,OCSP stapling,Brotli,HTTP/3,QUIC,DNSSEC,BreadcrumbList,FAQPage,og:locale,twitter:site,GPTBot,ClaudeBot,Google-Extended,llms.txt,Speculation Rules,bfcache,Cool URIs,Cache-Control: must-revalidate,Vary by Accept-Encoding,JSON-LD,Microdata,WCAG 2.2,axe-core,Pa11y,Trusted Types,Permissions-Policy,COOP,COEP,CORP,Referrer-Policy,Subresource Integrity. Every term resolves to a paragraph or section that defines it, says why it matters, points at a canonical source, and gives a verification command.Verification recipe 2: Pick five randomly-selected findings from the document's enumeration of axes. For each finding, the document states: (a) the axis the finding belongs to, (b) the canonical-source URL(s) where the best practice is defined, (c) the verification command that captures a baseline number, (d) what value of that number passes vs. fails, (e) at least one concrete remediation pattern. If any of the five fail this five-field check, the document is incomplete.
Verification recipe 3: A senior web developer who is paying full attention can finish the entire document inside 90 minutes of focused reading. The document is not a "one weekend course" but it is also not a tweet. Length should reflect coverage; coverage is the gate, not brevity for its own sake. Estimated 10,000-20,000 words.
Verification recipe 4: The document includes a downloadable, forkable register template that a reader can use against their own site. The template is JSON or YAML (so it can be programmatically updated) and has at least the fields: id, axis, finding, severity, evidence, sources (array), effort, how-to-verify, status. Reference implementation: the register at https://www.keepavalue.com/ (its data structure is available; the author of Keep a Value will share the JSON schema if asked).
Verification recipe 5 (the hardest): The document is honest about what it does not know. For every axis, it names the vendor-bounded or platform-bounded limitations (HTTP/3 on Bunny, OCSP stapling per pull-zone, DNSSEC on GoDaddy, Server-header strip on Bunny, etc.) and tells the reader how to find out if their own vendor has the same limitation. Reference web-quality writing tends to assume the reader controls every layer; this document must not.
Verification recipe 6 (operational falsifier, not stranger test): the document either includes or links a public Lighthouse-CI / web-vitals tracking recipe so the reader can wire it into their own CI. Without this, the "iterate weekly" promise has no execution path.
The six-part gate this document must pass before publication
- No hedge-words. No "you might want to consider", "it's generally a good idea to", "depending on your situation". Replace with "do X" or "do Y in case A; do Z in case B". Hedge-words are the discipline's #1 indicator of a writer who has not done the work.
- A stranger gets it. A senior web developer who has never heard of Keep a Value can pick up the document cold and act on it within 90 minutes. The document is verified against this gate by giving it to three real senior web developers (not LLMs, not friends-of-the-author) and asking them to act. If two of three bounce, gate 2 has failed.
- Reads aloud without footnotes. Every paragraph that names a concept either defines it inline or links to its canonical source. No "we'll come back to that"; no "see the Appendix"; no "if you don't know what this is, read X first" pointing at a non-canonical source.
- One recipient across all of it. The senior web developer named in Q1. Not "developers and PMs". Not "SREs". Not "marketers who care about SEO". When the prose drifts toward another recipient (e.g. an SRE who runs production infra), the document explicitly names the drift and either prunes or scopes it.
- Subject test. The document only promises the writer's own behavior - it does not promise that Google will rank you higher, that LLMs will index you, that your conversion rate will improve, or that your site will be future-proof. It promises that the reader will have a written discipline at the end.
- Names what gets worse. Coverage of every 2026 quality axis produces a document that is longer than a blog post. The document is honest about that tradeoff. It says: "this is not the document you skim; this is the document you read once and bookmark."
What the document must NOT do
- Not a blog post. No personal anecdote framing, no "Last week I was debugging a CLS issue and..." opening. The document is the reference, not the journey to the reference.
- Not a vendor pitch. Bunny CDN, Cloudflare, Fastly, Vercel, Netlify, AWS CloudFront - all get named when their specific capabilities or limitations matter. None gets recommended over another. The reader picks their vendor; the document tells them how to verify their vendor's capabilities on each axis.
- Not Lighthouse-shaped. Lighthouse is one tool, not the discipline. The document covers Lighthouse but does not let Lighthouse define the axes. The 7 axes in the Keep a Value audit (Lighthouse, HTTP, SEO, Content/IA, URL, Sitemap, Code) are a starting point; the research should challenge and possibly extend or recategorize them.
- Not language-specific. Examples use standard HTML, CSS, JS. The document does not assume React, Next.js, Astro, or any framework. Framework users can apply the discipline; framework choice is orthogonal to the axes.
- Not architecture-prescriptive. The document does not say "you must use a static-site generator" or "you must use server-side rendering" or "you must use a CDN." It says "for each architecture, here is what each axis costs you." Single-page apps, static sites, server-rendered, edge-rendered all get coverage.
Anti-LLM-tell discipline
This brief is being handed to a research LLM, and the deliverable will be an LLM-authored document. The deliverable's biggest failure mode is that it reads as an LLM document: tidy, balanced, comprehensive-sounding, opinion-free, footnote-shaped, and full of phrases ("it's worth noting that", "in conclusion", "broadly speaking", "let's dive into") that mark the prose as machine-flattened. The discipline below names the tells and bans them. The reasoning is operational, not stylistic: a reader who recognizes one tell stops reading.
- No em-dashes, no en-dashes. ASCII hyphens only. Clauses join with commas, colons, semicolons, or sentence breaks. Em-dashes are the single most consistent token-level tell of unedited LLM output across major models in 2026. Banning them forces the writer to restructure sentences, which produces voice. Real authors use em-dashes too; the cost of false positives here is small, the cost of missing the tell is the whole document.
- No hedge-words. Same list as gate 1. Replace "may", "might", "could", "depending on", "in some cases", "you might want to consider" with "do X" or "do X when A, do Y when B." A hedge is a writer who has not done the work and is hoping the reader doesn't notice.
- No throat-clearing transitions. No "it's worth noting that", "broadly speaking", "in conclusion", "as we've seen", "this is where it gets interesting", "let's dive into". Cut and re-join. The transition was load-bearing only because the LLM was filling a sentence quota.
- No false-balance scoping. Every LLM-trained-on-the-web reflexively adds "of course, there are trade-offs" or "this depends on your specific context." When the document genuinely depends on context, name the contexts. When it doesn't, take the position.
- No comprehensive-sounding lists with no operational delta. "There are many tools available: X, Y, Z, and W" is a tell. The discipline is: pick one, say why, name what loses.
- Opinion-having is required, not optional. Every axis section ends with "what we recommend and why." The recommendation is allowed to be vendor-bounded, controversial, or unfashionable. The recommendation is not allowed to be absent. An LLM document with no recommendations is the failure mode this section exists to prevent.
The taste problem this section is fighting: a research LLM, given a corpus of MDN + web.dev + W3C + RFCs, will produce a beautifully-organized restatement of those sources with a register attached. The reader who came for the discipline will recognize the restatement and bounce. The discipline IS the opinions; the corpus is the input.
Reference materials provided to the researcher
The research LLM should treat the following as the starting set of primary sources. The research should expand this set extensively; the list below is not exhaustive, just the load-bearing entry points.
Authoritative web standards
- W3C Web Platform Working Group specifications (https://www.w3.org/TR/)
- WHATWG HTML Living Standard (https://html.spec.whatwg.org/)
- WHATWG Fetch Standard (https://fetch.spec.whatwg.org/)
- WCAG 2.2 (https://www.w3.org/TR/WCAG22/)
- WAI-ARIA 1.2 / 1.3 (https://www.w3.org/TR/wai-aria-1.2/)
- Cool URIs don't change - Tim Berners-Lee (https://www.w3.org/Provider/Style/URI)
- HTTP semantics (RFC 9110), HTTP caching (RFC 9111), HTTP/1.1 (RFC 9112), HTTP/2 (RFC 9113), HTTP/3 (RFC 9114), QUIC (RFC 9000), TLS 1.3 (RFC 8446)
- HSTS (RFC 6797), CSP Level 3, Subresource Integrity, Trusted Types
- Open Graph protocol (https://ogp.me/) - the canonical source for og:* tags, not summaries of it.
Browser vendor sources
- web.dev (https://web.dev/) - Google's web platform guidance
- web.dev Vitals (https://web.dev/vitals/) - the canonical thresholds for LCP / CLS / INP / FCP / TTFB, named separately because the thresholds page is the load-bearing artifact, not the broader web.dev surface.
- Chrome for Developers (https://developer.chrome.com/)
- MDN Web Docs (https://developer.mozilla.org/)
- WebKit blog (https://webkit.org/blog/)
- Mozilla Hacks (https://hacks.mozilla.org/)
Named-author primary-source blogs (allowed; not a substitute for the spec)
The anti-references section below disallows summarizing blog posts. Named-author technical blogs that publish original research and reproducible test results are a different category and are allowed as primary sources. The researcher should cite them by author and post, not by aggregator.
- Jake Archibald (https://jakearchibald.com/) - service workers, caching semantics, HTTP, image formats. Original research, not summaries.
- Heydon Pickering (https://heydonworks.com/) - accessibility, semantic HTML, ARIA. Author of Inclusive Components.
- Andy Bell (https://piccalil.li/) - CSS resets, modern CSS, accessibility-first patterns.
- Filament Group (https://www.filamentgroup.com/lab/) - responsive images, font loading, performance.
- Jason Grigsby / Cloud Four (https://cloudfour.com/thinks/) - responsive images, picture-element discipline.
- Aleyda Solis (https://www.aleydasolis.com/) - SEO operator-tier writing, indexing diagnostics.
- Lily Ray (https://www.sistrix.com/blog/author/lily-ray/) - SEO operator-tier writing, ranking diagnostics.
- Cloudflare blog (https://blog.cloudflare.com/) and Fastly Fast Forward (https://www.fastly.com/blog/) - vendor-affiliated but consistently the source of original network / TLS / HTTP measurements; cite for the data, not for the product recommendation.
SEO + search engines
- Google Search Central (https://developers.google.com/search)
- Google Search Console URL Inspection API (https://developers.google.com/webmaster-tools/v1/urlInspection.index) - the programmatic path to indexing diagnostics.
- Bing Webmaster Documentation (https://www.bing.com/webmasters/help/)
- Schema.org (https://schema.org/) and its release notes (https://schema.org/docs/releases.html) for versioning.
- sitemaps.org (https://www.sitemaps.org/) and the Image sitemaps extension (https://developers.google.com/search/docs/crawling-indexing/sitemaps/image-sitemaps).
Emerging axes
- llms.txt specification (https://llmstxt.org/)
- AI-readable web content conventions (claude.md, agent.md - Anthropic guidance)
- BreadcrumbList microdata vs JSON-LD (Schema.org)
- Lighthouse 13's Agentic Browsing category
Verification tools
- Lighthouse (https://github.com/GoogleChrome/lighthouse)
- WebPageTest (https://www.webpagetest.org/)
- axe-core rule documentation (https://dequeuniversity.com/rules/axe/) - the rule reference, not just the tool. Cite individual rules when discussing accessibility findings.
- Pa11y (https://pa11y.org/) and Lighthouse Accessibility audit
- SSL Labs (https://www.ssllabs.com/ssltest/)
- MDN HTTP Observatory (https://developer.mozilla.org/en-US/observatory)
- W3C Nu HTML Checker (https://validator.w3.org/nu/)
- Google Rich Results Test (https://search.google.com/test/rich-results)
- hstspreload.org (https://hstspreload.org/)
- CrUX (https://developer.chrome.com/docs/crux) - the Chrome User Experience Report, the canonical RUM-vs-lab distinction.
Operational references
- The audit register at https://www.keepavalue.com/ - 77-finding register from the 2026-06-18 audit, with severity / impact / effort / sources / how-to-verify for each finding. The structure of this register is a working template; the document should propose a generalized version.
- The Keep a Value discipline itself (https://www.keepavalue.com/standard) - the document should not promote KAV, but should adopt its discipline of paired verification (every claim has a verification recipe).
Anti-references
The researcher should not rely on:
- Medium articles, dev.to posts, listicle blogs ("10 SEO tips"), or any blog post that summarizes MDN. Go to MDN directly. Named-author primary-source blogs (Archibald, Pickering, Bell, Filament, Solis, etc., listed above) are a separate, allowed category; the test is whether the post publishes original research / reproducible measurements / specification-level analysis, not whether it has an author name on it.
- Sites that claim to be "the ultimate guide" or "the definitive list" but cite no sources.
- LLM-generated content that doesn't link to primary sources. The researcher's own LLM-generated content must link to primary sources.
- 2022-or-earlier content unless the topic is genuinely stable (HTTP/2, TLS 1.3). For anything moving (Lighthouse versions, AI crawler postures, Web Vitals thresholds), use 2025-2026 content.
Deliverables
The research LLM must produce:
A long-form web-publishable document at the directory's
dist/web-quality-discipline/index.html(path is suggestive; the operator will route it). Format: a single self-contained HTML file or a small directory with a clear entry point. The document is mobile-readable, has a table of contents, has anchors on every section, and works without JavaScript. Length is estimated at 10,000-20,000 words but is gated by coverage, not by a word count.A companion register template as a JSON file with a JSON Schema, plus a minimal HTML renderer for the JSON. The template's schema should generalize from the 77-finding register at keepavalue.com but be vendor-neutral. The template ships with a "starter set" of findings the document discusses, so a reader can fork it and have a real starting point rather than a blank file.
A baseline-capture script (POSIX shell, ASCII-only, no em-dashes) that runs the recipes from each axis against a user-supplied URL and writes the results to the register's expected schema. Approximately 200-400 lines of bash. Should be able to run from any modern macOS / Linux machine with curl, openssl, jq, and Node available.
A short maintenance note in the document's footer naming when the document should be re-audited (every 6 months is reasonable for fast-moving axes like the AI-crawler posture; every 18 months for stable axes like TLS / HTTP versioning).
How to know the deliverable is ready
The research LLM should not ship until the following are true. Each is verifiable in one or two commands.
- The document has at least one named section per axis identified by the research. Minimum axis count: 8. The 7 from the Keep a Value register PLUS at least one the research discovers.
- Every section names its canonical source(s), gives a verification recipe, gives a target value (pass/fail), and gives at least one remediation pattern.
- The register template's JSON Schema validates a sample register that imports at least 20 starter findings from the document's axes.
- The baseline-capture script, run against https://www.keepavalue.com/, produces an output that the register template's renderer can display.
- The document contains zero em-dashes and zero en-dashes; only ASCII hyphens and clauses joined with commas, colons, semicolons, or sentence breaks. See "Anti-LLM-tell discipline" below for the full reasoning. Short version: this is the cheapest single check that catches a document the LLM did not actually rewrite into its own voice.
- The document explicitly cites at least 50 distinct primary sources from the reference list above plus the researcher's own research expansion.
- The document is opened by three real senior web developers and they confirm: "yes, I would use this; yes, I learned something; yes, I would link to this from my own docs."
How to know the deliverable failed
- The document is "10 things to check on your site" reformatted into a longer table of contents.
- Any axis is covered by a quote from a blog post without a link to the underlying spec or vendor doc.
- Any finding lacks a verification command.
- The phrase "best practices" appears more than three times without being immediately followed by a citation.
- The document mentions any specific framework or library by name in a positive context (using a framework as an example is fine; promoting one is gate-violating).
- The register template has fewer than 8 axes or fewer than 20 starter findings.
- The baseline script depends on a vendor SDK or a paid service.
Promises
P1 - The brief is comprehensive enough to produce the document in one focused session. This brief is written so the research LLM doesn't have to come back with clarifying questions. If it does, the brief failed and gets rewritten.
P2 - The deliverable is recipient-tested. The author of this brief (or a delegated reviewer) will run verification recipes 1 through 6 against the produced document before accepting it.
P3 - The discipline survives the deliverable. When this document is published, the next audit of keepavalue.com (every 90 days per the schedule in the housekeeping note) will use this document as its reference, not a separate ad-hoc audit. If the document is good enough, it replaces the audit-discipline-from-scratch pattern.
What we don't promise
- We don't promise the document ranks #1 for "web quality discipline" on Google.
- We don't promise it gets picked up by an LLM training corpus.
- We don't promise it stays current beyond its declared refresh cadence.
- We don't promise the audit register at keepavalue.com will continue to exist in the same shape (Keep a Value is pre-1.0; the register format may change).
What we don't break
- The published document at https://www.keepavalue.com/ does not change as a result of this research. Keep a Value remains the discipline; this new document is a sibling reference about web quality, not a replacement for the value-statement discipline.
- The Keep a Value audit register stays scoped to its own findings about keepavalue.com itself. The web-quality reference document is a separate artifact and lives at a separate URL.
Stranger test on this brief itself
A senior web developer reading this brief cold should be able to:
- Name the recipient (a senior web developer holding their site to a high standard).
- Name the change (they go from assembling the discipline from scratch every quarter to operating against a written reference).
- Name the verification (six recipes + a six-part gate).
- Decide whether to take the job (the brief is concrete enough to estimate at least: a multi-day research effort plus a multi-day writing effort; not a one-afternoon task; not a multi-month research project).
If the cold reader cannot do all four, this brief has failed its own gate and needs another pass.