anti-slop: fail delivery on low-contrast normal text

The Stack

Steps

1. 1

   Pin the release and prove the local normal-text gate

   Fetch the immutable v3.2.9 commit archive with a strict size cap, verify its exact byte size and SHA-256 digest, reject traversal and every member type except regular files and directories, then extract it into the disposable CI directory. Audit the checker boundary as source, run the repository's 11 structural guardrails and eight-row self-test, and independently compare six color pairs with the WCAG 2.2 formula while proving exit 0 for normal-text passes, exit 1 for contrast failures, and exit 2 for invalid input. No Agent Skill, installer, MCP server, model, browser, project, or credential is invoked.

   set -eu
   curl --proto '=https' --tlsv1.2 --retry 3 --max-filesize 2097152 -fsSL   https://codeload.github.com/miqdadbadjuber/anti-slop/tar.gz/6eb854fb82c2b5eb9ed970669e59da037627c433   -o anti-slop.tar.gz
   node <<'NODE'
   const crypto = require("crypto");
   const fs = require("fs");
   const { execFileSync } = require("child_process");
   
   function bad(message) {
     console.error("BAD: " + message);
     process.exit(1);
   }
   const archive = fs.readFileSync("anti-slop.tar.gz");
   if (archive.length !== 920495) bad("source archive size changed");
   const digest = crypto.createHash("sha256").update(archive).digest("hex");
   if (digest !== "3f210c3b661b04e76d153bc12ba2e366c73b5aebf55d1e2677617f46e3903eb8") {
     bad("source archive digest changed");
   }
   const root = "anti-slop-6eb854fb82c2b5eb9ed970669e59da037627c433/";
   const names = execFileSync("tar", ["-tzf", "anti-slop.tar.gz"], { encoding: "utf8" })
     .trim()
     .split("\n");
   if (names.length !== 71) bad("source archive member count changed");
   if (names.some((name) => !name.startsWith(root) || name.startsWith("/") || name.split("/").includes(".."))) {
     bad("source archive contains an unsafe path");
   }
   const verbose = execFileSync("tar", ["-tvzf", "anti-slop.tar.gz"], { encoding: "utf8" })
     .trim()
     .split("\n");
   if (verbose.some((line) => !["-", "d"].includes(line[0]))) {
     bad("source archive contains a non-file/directory member");
   }
   console.log("anti-slop source pinned OK: v3.2.9 at 6eb854f, 71 members, sha256 " + digest);
   NODE
   mkdir source
   tar -xzf anti-slop.tar.gz -C source --strip-components=1
   cd source
   node <<'NODE'
   const fs = require("fs");
   function bad(message) { console.error("BAD: " + message); process.exit(1); }
   function has(text, value, message) { if (!text.includes(value)) bad(message); }
   
   const license = fs.readFileSync("LICENSE", "utf8");
   const checker = fs.readFileSync("skills/antislop-human/contrast-check.py", "utf8");
   const manifest = JSON.parse(fs.readFileSync(".codex-plugin/plugin.json", "utf8"));
   has(license, "MIT License", "MIT license missing");
   has(license, "Copyright (c) 2026 Miqdad Badjuber", "copyright holder changed");
   if (manifest.name !== "antislop" || manifest.version !== "3.2.9" || manifest.license !== "MIT") {
     bad("plugin identity changed");
   }
   const skillDirs = fs.readdirSync("skills", { withFileTypes: true })
     .filter((entry) => entry.isDirectory())
     .map((entry) => entry.name)
     .sort();
   if (skillDirs.length !== 6 || !skillDirs.includes("antislop-human")) bad("skill set changed");
   for (const forbidden of ["subprocess", "socket", "requests", "urllib", "http.client", "ftplib", "os.system", "os.popen"]) {
     if (checker.includes(forbidden)) bad("checker gained a forbidden capability: " + forbidden);
   }
   has(checker, "return 0 if normal and large else 1", "normal-text exit gate changed");
   has(checker, "return 2", "invalid-input exit gate changed");
   console.log("checker boundary OK: MIT; six skills; contrast-check.py local, keyless, and normal-text fail-closed");
   NODE
   node scripts/check-repo.mjs > ../repo-check.txt
   python3 skills/antislop-human/contrast-check.py --selftest > ../selftest.txt
   node <<'NODE'
   const fs = require("fs");
   function bad(message) { console.error("BAD: " + message); process.exit(1); }
   const repo = fs.readFileSync("../repo-check.txt", "utf8");
   const selftest = fs.readFileSync("../selftest.txt", "utf8");
   if ((repo.match(/^ok\s+/gm) || []).length !== 11 || !repo.includes("all 11 checks passed")) {
     bad("repository guardrails did not all pass");
   }
   if (!selftest.includes("selftest: 8 reference pairs OK")) bad("upstream contrast table self-test failed");
   console.log("repository guardrails OK: 11/11");
   console.log("upstream contrast selftest OK: 8 reference pairs");
   NODE
   python3 <<'PY'
   import importlib.util
   import math
   from pathlib import Path
   import subprocess
   import sys
   
   checker_path = Path("skills/antislop-human/contrast-check.py")
   spec = importlib.util.spec_from_file_location("antislop_contrast", checker_path)
   checker = importlib.util.module_from_spec(spec)
   spec.loader.exec_module(checker)
   
   def reference(hex_color):
       value = hex_color.lstrip("#")
       if len(value) == 3:
           value = "".join(ch * 2 for ch in value)
       rgb = [int(value[i:i + 2], 16) / 255 for i in (0, 2, 4)]
       linear = [c / 12.92 if c <= 0.04045 else ((c + 0.055) / 1.055) ** 2.4 for c in rgb]
       return 0.2126 * linear[0] + 0.7152 * linear[1] + 0.0722 * linear[2]
   
   def ratio(a, b):
       l1, l2 = sorted((reference(a), reference(b)), reverse=True)
       return (l1 + 0.05) / (l2 + 0.05)
   
   cases = [
       ("#000000", "#FFFFFF", 0),
       ("#FFFFFF", "#000000", 0),
       ("#767676", "#FFFFFF", 0),
       ("#777777", "#FFFFFF", 1),
       ("#949494", "#FFFFFF", 1),
       ("#FFFFFF", "#FFFFFF", 1),
   ]
   for foreground, background, expected_exit in cases:
       expected_ratio = ratio(foreground, background)
       actual_ratio = checker.contrast_ratio(checker.parse_hex(foreground), checker.parse_hex(background))
       if not math.isclose(actual_ratio, expected_ratio, rel_tol=0, abs_tol=1e-12):
           raise SystemExit(f"formula mismatch for {foreground} on {background}")
       run = subprocess.run(
           [sys.executable, str(checker_path), foreground, background],
           text=True,
           stdout=subprocess.PIPE,
           stderr=subprocess.STDOUT,
           check=False,
       )
       if run.returncode != expected_exit:
           raise SystemExit(f"wrong exit for {foreground} on {background}: {run.returncode}")
       expected_normal = "PASS" if expected_ratio >= 4.5 else "FAIL"
       if f"normal text (4.5:1): {expected_normal}" not in run.stdout:
           raise SystemExit(f"wrong normal-text verdict for {foreground} on {background}")
   
   invalid = subprocess.run(
       [sys.executable, str(checker_path), "#GGGGGG", "#FFFFFF"],
       text=True,
       stdout=subprocess.PIPE,
       stderr=subprocess.STDOUT,
       check=False,
   )
   if invalid.returncode != 2 or "expected a hex color" not in invalid.stdout:
       raise SystemExit("invalid input did not fail with exit 2")
   print("contrast boundary OK: 6 independent WCAG 2.2 pairs; normal-text exit 0/1 and invalid exit 2")
   PY

2. 2

   Build or revise the UI, then identify every actual color pair

   Use the pinned anti-slop rules as review guidance in During or After mode, with explicit user approval before installing or changing files. Inspect the rendered UI in every supported state and theme. Record the opaque sRGB foreground and background hex values for each normal-text treatment; do not substitute design tokens without proving their resolved values, and do not reduce a gradient, image, transparency, or blended background to a guessed single color.

3. 3

   Run the local checker for every normal-text pair and stop on failure

   Invoke the pinned skills/antislop-human/contrast-check.py with Python 3 once per recorded pair. Exit 0 means that pair clears the normal-text 4.5:1 gate; exit 1 means delivery stops until the color is corrected and rechecked; exit 2 means the input or invocation is invalid. Preserve the checker output in the review evidence, then separately complete keyboard, focus, semantics, state, responsive-layout, content, and human visual checks. Do not describe the result as whole-page WCAG certification.