site-health-auditlisted

# Site health audit ## Config Read `config.yml` beside this file unless the caller names one. Every site-, host-, and plugin-specific step comes from it: URLs, cache steps and signals, dashboards, header owners, email baseline, `leave_as_is`, `report_only`. An empty or `none` key marks its check `n/a` and the run continues. When the site moves, swap the `host:`, `security_layer:`, and `cache_steps:` blocks. ## Run frame Unattended: finish the run; the only stops are sending real email, changing DNS, or any write to the live site. Cache flushes in `cache_steps` are part of the run. Admin checks use the existing session; logging in is off-limits, so an expired session records "not readable this run" and the run continues. Narrate once before the first tool call and on a regression. ## State on disk Before check 1, create the dated report in `report.dir` with one empty heading per check, and `.state/<date>.json` beside it: each check's status (`pending`, `done`, `n/a`, `not-read`), evidence pointers, SSL Labs start time, previous report path. Append each check's section and flip its status as it completes. Context gets compacted mid-run: on resume, read the JSON and continue at the first check not `done`. A compaction summary keeps the date, config path, previous report path, cache results, every recorded number with its source, and the open checks. ## Evidence Every number cites the tool output it came from: URL or command plus the field read. Scores come from page text