The methodology, in the open

What we publish, what we reserve

A diagnostic earns trust through methodological transparency. It earns durability through algorithmic protection. We do both deliberately.

The composite passes through a logarithmic curve so foundational gaps weigh more heavily than incremental gains.

What a Diagnostic actually reads

We score ten pillars from what your infrastructure exposes to the public internet, plus what you tell us about your own spend and your own confidence. Nothing is read from inside your accounts. No login, no analytics access, no ad-account access, no tag-manager access — the Diagnostic needs a URL and your self-assessment.

The evidence divides into five classes, and they are not weighted equally:

1. Direct technical evidence — what your pages, headers, DNS records and well-known files actually contain. Machine-verified, and it outranks everything below it.
2. Direct site content — the text on the pages we fetch. First-party evidence of what you say you sell.
3. Verified external signals — public business listings, review aggregates, public video and social metrics, public ad-library activity.
4. Research synthesis — web-search-based market context. Useful for landscape, weak for facts about your site. Where it disagrees with class 1, class 1 wins, and the system is instructed to that effect.
5. Inference — reasoning across gaps, flagged as inference wherever it appears.

That ordering is the methodology. A finding that reads as authoritative is one that came from class 1; a finding that came from class 4 or 5 says so in the report.

How the scoring works

Each pillar carries a detected score from 1 to 10, set against your own self-assessment of the same pillar — the perception gap above. Underneath most pillars sit named sub-scores, each scored on its own and combined by fixed weight. Discoverability separates whether a machine can load your site, whether you rank in organic search, whether your content can be lifted into an AI-generated answer, and whether AI systems name and recommend you off-site: four different failure modes with four different fixes, and a single "SEO score" hides which one you have. Tech Stack separates conventional tool efficiency from whether your systems can be operated by an autonomous agent. Conversion separates the human funnel from whether an agent could complete it.

Some scores are computed, not judged. Where a signal is hard — a DNS record, a measured ladder of tracking maturity, an arithmetic roll-up — the number is produced by code and the language model does not get a vote. Where the question is qualitative — offer clarity, editorial quality, competitive positioning — a model scores it against the evidence and the report says what evidence it used. We separate those two cases deliberately, because a model asked to do arithmetic will drift and a spreadsheet asked to judge a value proposition will not.

The composite score on the front of the report combines pillar performance, how accurate your self-assessment turned out to be, how well adjacent systems reinforce each other, and how your infrastructure quality relates to your stated spend. Those four component weights are published above. The per-pillar importance weights and the curve are not.

What we refuse to infer

This is the part worth reading twice, because it is where a diagnostic earns or loses its standing. Each line below is a constraint the system runs under — some enforced in code, the rest carried in the scoring instructions the model works from.

• We do not treat "not detected" as "absent." A tool loaded through a tag manager, gated behind a login, or fired conditionally is invisible to an external scan. Our findings say "not detected in page source" and mean exactly that. Every report is required to name the analysis's primary limitation in its own executive summary.
• We do not claim a tag fires. We detect that tracking infrastructure exists. Whether a given pixel fires, in what order, and under what consent state is a different measurement, and we do not have it from outside.
• We do not claim to have tested your consent. We report what consent machinery is deployed and whether it renders — a banner that ships but never displays is reported as deployed-not-displayed, and a banner that never appeared for our scanner is reported as that, not as your visitors seeing none. Where load order is visible in the page itself — a chat widget loading ahead of the consent mechanism, say — we score it. Whether every tag then holds until consent is given needs network timing we do not have from outside, and we do not claim it.
• We do not accuse your content of being AI-generated. Text-style AI detection is unreliable enough that a false positive would be an accusation we could not defend. We score AI-content governance only from concrete signals: detected tooling, and whether it is disclosed.
• We do not claim to know a competitor's budget or strategy. Competitive figures are estimates from observable signals and are labelled as such. When we cannot name a genuine comparable, we return an empty list and say why — a padded competitor set is worse than a short one.
• We do not evade your defences. Requests to your site identify themselves as YellowheadBot. The one check that has to send another crawler's user-agent string — the AI-crawler differential under Discoverability — appends a Yellowhead disclosure to it, so your logs name us even while your rules see the token they key on. Our render path is built to an identified-bot posture — no stealth automation, no fingerprint spoofing, no captcha solving — and when a site blocks us, the block is recorded as a block: a challenge page is never stored or scored as though it were your real page. A blocked scan produces a smaller report, not a worse score.
• We do not read anything behind authentication, and we do not act on your site. Every request we make to your domain is an unauthenticated GET. We do not log in, submit a form, or complete a checkout, and we do not crawl your whole site — we request a fixed list of public paths plus the files that public standards put at known locations.

What we cannot see, and say so

Reports carry an Auditor's Notes block: the loose ends we could not confirm, each with the reason it stayed open. An early client told us that section was the most credible block in the document, and the reason is structural — a diagnostic that never says "we could not check this" is not reporting its own coverage.

The standing limits: no view inside tag containers, no analytics or ad-account data, no field performance data from your real users, no visibility into tools your site never mentions, and no observation of runtime behaviour that only a real user session would trigger.

What changes when you pay

Two different things, and they are worth separating.

First, depth inside the Diagnostic itself. The scan runs at full depth on every plan, including the free one — a paid plan does not start a better scan, it opens more of the one you already ran, with no re-scan. Free shows your ten pillar scores, the perception gap, the MIDAS composite, the executive summary, verdict cards and your first blind spot in full. Starter opens every blind spot, the evidence behind the brand-visibility and sentiment scores, the per-pillar budget breakdown, market intelligence with competitor profiles, and PDF export. Pro adds the investment roadmap, comparison of reports over time, action items, a machine-readable markdown export for agents and technical stakeholders, and an org account with team access. Enterprise adds scheduled re-runs, full action-item management, the journey canvas, and access to our MCP agent door on request.

Then, the part automation cannot do. Paid work adds three things: access (with your permission, we go inside the systems the scan could only see from outside), judgement (a human reading the findings against your commercial situation), and depth on one axis (a competitor set analysed properly, or your visibility inside AI answers measured across engines and questions rather than inferred).