Methodology
How the index works
The rules that decide what appears on /readable, written down so they can be held against us.
Disclosures
ARS measures format and retrievability. It does not measure whether the facts are true, or whether any assistant cites this page.
ARS is authored by Rebilder, which sells content-negotiation middleware. Two ARS checks (D2.1 content negotiation, D5 structured data) can be satisfied by Rebilder's free gateway, and reaching an A requires both. The full ruleset, thresholds, and conformance corpus are published so this bias is auditable rather than hidden.
Verification
How a domain gets named
Publication about a named third party requires verified domain-owner opt-in. There is no other route in.
DNS TXT record
Publish a TXT record containing rebilder-verify=<token> on the registrable domain. We resolve it, and the entry becomes eligible for named publication only after that resolution succeeds.
DNS is the method because it proves control of the domain rather than control of one page. A meta tag on a single URL is satisfiable by anyone who can publish one file to a subpath.
Or: the gateway, observed live
If we observe an X-Rebilder-Path response header served from the origin itself, that is equivalent proof for the same reason: it requires control of the response, not of a document.
Neither method involves an account, a plan, or a payment. Verification is about who controls the domain and nothing else.
What is eligible to be published at all
Only scans taken from a third-party vantage — the public scanner and the index crawler. Nothing derived from an authenticated, merchant-sourced, or locally-run scan is ever published, whatever its score.
That means a merchant previewing an unlaunched page in Console, a developer running the CLI against staging, and an MCP scan on somebody's laptop are all structurally ineligible. It is a constraint in the schema, not a convention in the code.
Removal
How a domain gets out
Removal is free, self-serve, permanent, and never purchasable.
Free, self-serve, permanent, never purchasable
Removing an entry costs nothing and requires no conversation with us. It is also not something anyone can buy, which matters more than it sounds: the moment removal has a price, the index is a shakedown with a methodology page.
We never make outbound sales contact on the basis of a score. Not a cold email, not a "we noticed your site scored a D" sequence, not a partner doing it on our behalf.
Unverified requests fail toward suppression
A removal request that cannot prove DNS control still triggers suppression pending review. A natural person exercising erasure against a domain that is their own name cannot reasonably be made to demonstrate DNS control first, and the cost of wrongly suppressing an entry is far below the cost of wrongly keeping one.
Suppression is keyed by registrable domain and is consulted on the read path, the write path, and the badge endpoint — so a later crawl cannot quietly re-list a suppressed domain and a stale badge cannot outlive the suppression.
Appeal outcomes are not published
If an owner disputes an entry and the entry stands, we publish nothing about the dispute — no log, no "reviewed and upheld" marker, no count.
"They complained and lost" is a worse public fact about the appellant than the original entry was, and an appeals process that creates one is a process nobody should use.
Aggregates
What we publish about nobody in particular
The floor is 25 and it is not a tunable
No aggregate is published about a group unless the bucket contains at least 25 independent domains. The same number appears in the spec (§7.6.3), in CLAUDE.md, and once in the code.
Buckets under the floor are not merged into a catch-all to reach it, and they are not published at a coarser granularity that happens to clear it. They are withheld, and the page says how many were withheld.
One domain, one row
Distributions are computed over the latest scan per domain per page kind, so a heavily rescanned site cannot weight its own bucket. Suppressed domains are excluded from the aggregates as well as from the named list — a suppression is an erasure, not a delisting.
Shares are published; underlying counts per grade are not, beyond the bucket size itself.
Versions
Rescoring and comparability
A MINOR bump re-probes the opted-in set
ARS scores are comparable only within an identical spec version and ruleset hash, which is why both are printed on every row. We do not retain third-party response bodies, so a stored result cannot be rescored under a new ruleset from the stored numbers alone.
When a MINOR lands we re-probe the opted-in set and publish new scores under the new ruleset hash. The opted-in set is bounded and consenting, so this is cheap and it keeps the time series comparable — the alternative, declaring the series segmented and non-comparable across every MINOR, was considered and rejected.
What the number is made of
ARS 0.1.0 allocates 64 of 100 points to measured checks and 36 to heuristic ones. A measured check reports a property of the bytes and headers we received; a heuristic check reports an inference about them.
Every check declares its basis in every result, and a heuristic value is never rendered without its label. The spec caps total heuristic weight at 40 — a future ruleset that exceeds it is out of conformance with its own standard.