Research and field notes

Dated studies, technical investigations and build notes from turva.dev. Each article explains what was observed, how it was checked and what the result does not establish.

RSS feed

Start with the research

Browse all articles

33 articles

HTML and Markdown can disagree2026-09-12Build notesA Markdown version can leave out part of a page or send a reader to a different link. I built markdown-parity-check to compare what the two versions contain. I rebuilt turva.dev around the report2026-09-07Build notesThe updated site puts sample reports beside the services they describe, with evidence, correction owners and acceptance checks visible before purchase. What 19 identity vendors publish for agents2026-09-05ResearchA dated scan of 19 identity vendors examines what their public sites expose for agents, and what the results cannot say about the products behind them. Two files called auth.md, and they disagree on the field names2026-09-04Protocol notesTwo auth.md conventions use similar language and different field names. This comparison records the mismatch and the limited role of turva.dev's own file. Thirty-day follow-up: 201 comparable readings from 210 sites2026-09-03ResearchA 210-site follow-up cohort produced 201 comparable readings. Four changed level. The observations do not establish an effect from the unsolicited briefs. What four AI assistants call an agent readiness audit2026-09-03ResearchFifty buyer questions produced 193 answers across four assistants. The study shows how the same audit term can refer to websites or organisational AI adoption. Website agent readiness, measured on 567 company sites2026-09-03ResearchOne scanner measured 567 selected company websites over ten weeks. The results describe that prospecting sample, and the changing check set is a stated limit. TRACE signs how an agent ran, not what it was allowed to reach2026-08-30Protocol notesThis article examines what a TRACE Trust Record attests to, and why runtime evidence does not itself establish the right permissions or correct decisions. I scanned fourteen code hosts. Not one served an MCP server card.2026-08-22ResearchFourteen code-host surfaces were scanned on one day. The findings concern public discovery paths, not the full capabilities of each hosting service. It would be cheating to keep the old price2026-08-21Build notesA dated account of pricing changes and the work behind them. Historical prices remain in the article, with the current service prices linked separately. I thought it was a small job2026-08-16Build notesA seven-day review of the author's own workspace found 367 issues across nine packages. The article records the effort, findings and limits of that work. My gate could not see a sixth2026-08-04Build notesA passing validation gate missed elements it never expected. The investigation shows why checking required members differs from checking the complete set. A red reading that measured my own client2026-07-30Build notesAn MCP request seemed to expose a server regression but selected the wrong compatibility path. The article records how request and response were told apart. The checks that pass for the wrong reason2026-07-29Build notesA link can resolve successfully and still point to the wrong version. This investigation examines checks that pass while validating the wrong target. Finishing the optional commerce checks2026-07-20Build notesA dated implementation note separates discoverable payment declarations from settlement. The scanner checks changed, the settlement boundary did not. The twin is the page2026-07-19Build notesTwo separately maintained versions of the same content drifted apart. This build note explains the move to shared content and the limits of the checks on it. Every response promised a rate limit2026-07-18Build notesA response header advertised a request limit that no code enforced. The investigation separates a published policy, the code and what a probe can show. Microsoft said the patches would get bigger. I measured how much bigger.2026-07-15ResearchA comparison of selected Microsoft security-update datasets examines changes in reported vulnerability counts and severity, with the comparison limits stated. Reducing secret exposure in coding-agent workflows2026-07-12Build notesWays to reduce secret exposure when coding agents work with a repository, including credential storage and the permissions around runtime access. How agent-ready are Finnish B2B sites? I scanned sixteen2026-07-07ResearchA scan of sixteen selected Finnish B2B sites records gaps in agent-readiness. This historical sample leads into the later study of 567 sites. When honesty and the checker disagree2026-07-06Build notesAn optional credential was both declared and denied in the same metadata. The repair made the description consistent without claiming access it did not grant. Four AI agents re-checked the guides2026-07-04Build notesA dated review of the guides found that source specifications and local claims had moved. The article records corrections and the limits of automated checks. The page grew, the agent bill did not2026-07-04Build notesA July measurement compared the token counts of the homepage's HTML and Markdown representations. The result describes that page and measurement date. Moving the source from GitHub to Codeberg2026-07-04Build notesThe source moved to Codeberg and later returned to GitHub. This dated incident log preserves the sequence and links readers to the current public source. A free llms.txt validator2026-07-02Build notesThe launch note for turva.dev's llms.txt validator explains its original checks. The live tool page carries the current interface and supported checks. Agent access is now a setting2026-07-02Protocol notesA July product update illustrates how crawler access, discovery and payment controls can sit at the network edge, before the site's content is reached. Publishing an ai-catalog.json for agentic discovery2026-06-29Build notesA dated implementation log records adding an AI Catalog discovery manifest. Later ARD conventions are explained in the current resource-discovery guide. What the Open Knowledge Format is, and what it is not2026-06-27Protocol notesAn early reading of Open Knowledge Format version 0.1 separates the file structure it defines from the semantic promises it leaves open. What an agent pays to read your site2026-06-26Build notesThis article examines the publisher's influence on the content a text-based client receives, using a dated HTML-versus-Markdown comparison. When an agent can prove it is Claude2026-06-25Protocol notesSigned requests can give evidence of a sender's identity. This dated article separates that evidence from trusting a user-agent string or granting an action. What makes an AI agent's decisions reliable2026-06-22Protocol notesUsable inputs and explicit operating limits matter for agent decisions, alongside model uncertainty. The article asks where control and verification belong. Owning your fediverse identity2026-06-21Build notesA build note on separating a public identity domain from the server that hosts the account, and the dependencies that still remain. Moving turva.dev off prerender.io2026-06-20Build notesA dated account of moving the homepage rendering into a Cloudflare Worker and serving HTML or Markdown from the same public site.