| 1 | # Nibbler's History |
| 2 | |
| 3 | ## Core Context |
| 4 | - **Project:** SquadScope (https://github.com/jmservera/SquadScope) — weekly editorial trend analysis, public site at https://jmservera.github.io/SquadScope/ |
| 5 | - **User:** jmservera |
| 6 | - **Created:** 2026-05-25 |
| 7 | - **Hired because:** the team narrowly avoided shipping a "double S" logo that risked Nazi-SS-rune resemblance. The miss was caught by the human user, not by any agent. Nibbler exists so that class of failure-mode catch becomes the team's job, not the user's. |
| 8 | |
| 9 | ## Why I'm here (in one sentence) |
| 10 | **Catch what the makers miss. Before users do.** |
| 11 | |
| 12 | ## What's currently in flight or recently merged that I should sweep |
| 13 | - **Design proposal** (PR #178 merged): `docs/design/redesign-proposal-2026-05.md` — color palette, tokens, layout direction |
| 14 | - **Icon spec** (PR #178 merged, REPLACEMENT in flight via PR #186): `docs/design/icon-spec.md` — robot-with-binoculars replaces the rejected double-S design |
| 15 | - **Phase 1: tokens + typography** (PR #181 merged): `assets/css/tokens.css`, font stacks |
| 16 | - **Phase 2: header + footer + nav** (PR #185 merged): includes GitHub icon button in header |
| 17 | - **Cookie banner + privacy policy** (in flight as #183, Hermes drafting): EU compliance, UX consent flow |
| 18 | - **GA4 analytics** (in flight as #182): consent-gated tracking |
| 19 | - **Distribution strategy** (in flight as #184, Morbo): announcement channel mix |
| 20 | - **Pipeline prompts:** `prompts/analyze-weekly.md`, `prompts/analyze-topic.md`, `prompts/reskill.md` — the AI analysis loop |
| 21 | |
| 22 | ## Team I work with |
| 23 | - Hermes (Security) — code/secrets; I cover content/UX harms |
| 24 | - Calculon (Design) — aesthetics; I sanity-check against hate-symbols |
| 25 | - Amy (Frontend) — implementation; I review accessibility floor + dark-pattern surface |
| 26 | - Farnsworth (Analyst) — editorial content; I review for bias, hallucination, harmful framing |
| 27 | - Leela (Lead) — final approval; I'm a reviewer gate, not the final word |
| 28 | |
| 29 | ## Learnings |
| 30 | |
| 31 | ### 2026-05-25 — First Sweep |
| 32 | |
| 33 | **References that paid off:** |
| 34 | - **MS RAI Fairness + Transparency** — gave immediate traction for the prompt injection finding (AI output transparency) and the GA4 fork-safety finding (privacy). These two principles map cleanly to concrete SquadScope artifacts. |
| 35 | - **OWASP LLM01 (Prompt Injection)** — directly applicable to Farnsworth's `{{RAW_JSON_CONTENT}}` injection surface. The OWASP framing gave a precise vocabulary for the finding. |
| 36 | - **GDPR Articles 6(1)(a) + 5(1)(a)** — Hermes had already done the heavy lifting on consent; my job was to verify the planned implementation didn't introduce dark patterns. The three-button consent modal passed all checks except one: button visual weight parity was not explicitly constrained. Low finding, but exactly the kind of implementation drift that turns a spec pass into a shipped dark pattern. |
| 37 | - **ADL Hate on Display** — verified the current radar sweep icon is clean. The silhouette test (16px, rotation, inversion) revealed no ambiguity. The main lesson from the SS-icon incident: the failure mode hides at small sizes and under transformation. Always test at 16px first. |
| 38 | |
| 39 | **Artifact types and where they hide failure modes:** |
| 40 | - **Icons/logos:** Failure hides at 16px (favicon size) and under rotation/inversion. The craft-focused designer never tests this. |
| 41 | - **Consent UX:** Failure hides in implementation drift from spec — spec says "equal prominence," implementation gives primary/ghost button treatment. Check CSS, not just copy. |
| 42 | - **Prompts:** Failure hides in the injection surface — the `description` field from crawled repos is attacker-controlled. The instructions look safe in isolation; the danger is what happens when malicious repo descriptions reach the model. |
| 43 | - **Articles:** Failure hides in AI authorship transparency (readers can't tell it's AI-generated) and in characterization claims (repo called "spam" without evidence citation). |
| 44 | - **Analytics:** Failure hides in fork behavior — the GA4 tag silently reports to the repo owner's property from all forks. |
| 45 | |
| 46 | **Silhouette-test workflow developed:** |
| 47 | 1. Render SVG at 16px, 32px, 64px, 128px, 512px |
| 48 | 2. Convert to grayscale |
| 49 | 3. Rotate 90°, 180°, 270° |
| 50 | 4. Invert colors (negative space check) |
| 51 | 5. Mirror horizontally and vertically |
| 52 | 6. Look for: letterforms (especially double letters), rune shapes, spoke patterns, hand gestures |
| 53 | 7. Cross-reference ambiguous shapes against ADL Hate on Display database |
| 54 | 8. Document findings in the icon spec as "Silhouette Safety Check ✓" |