The setup
We publish the Agent Site Manifest, a build spec and scoring framework for making websites legible to AI agents, and we sell audits against it. Our own site had already been through the full treatment once, so we were not starting from nothing: an initial audit in February 2026 scored it 72 out of 100 at grade C, remediation took it to 91 at grade A, and we published both reports rather than summarizing them.
So when we finished building an automated ASM validator and put it behind a free public scanner, we expected our own site to come back clean, and it did not.
What the validator actually does
The validator is a crawler rather than a single-page linter, which matters because most of what it eventually found on our site was not on the homepage. It fetches robots.txt, the sitemap, and the homepage in parallel, extracts internal links, and then crawls up to five subpages at a concurrency of three, respecting robots.txt disallows and stopping at a deadline circuit breaker so a slow site cannot hang the scan. On each page it runs roughly two dozen checks covering content survivability, discovery directives, structured data, link semantics, heading hierarchy, form labeling, and meta description quality. Issues are aggregated as worst case across every page it reaches, so one rough template cannot hide behind a polished front door.
Before we trusted any of its output we spent a pass hardening the heuristics against false positives, because a scanner that cries wolf is worse than no scanner at all. That pass covered ten separate fixes, including word-boundary matching on alt-text checks, scoping schema.org detection to actual JSON-LD blocks, skipping breadcrumb checks on root paths, gating the noscript check on thin content, and detecting placeholder href="#" links. Only then did we point it at clocktowerassoc.com.
What it found
The most uncomfortable finding came first. Our agent discovery directives, which are the layer of ASM we talk about most, did not match our own published build spec. We were shipping rel="agent-manifest" where Section 3 of the spec says agents-manifest, and an Agent-manifest: directive in robots.txt where the spec says Agents:. We wrote that spec, and we still got it wrong on our own site.
The rest were the same class of issue we flag in client audits every week:
- Generic "Learn More" link text on the homepage hero and on every showcase card, which tells an agent nothing about where the link goes, and tells a screen reader user nothing either.
- Copy buttons with no accessible label.
- A title template that injected a framework comment node into the
<title>element, which breaks naive parsers. Our own scanner's regex was one of them. - Missing JSON-LD structured data and missing breadcrumb navigation on the tools pages.
- A page template with no
<footer>element, and a content-to-markup ratio thin enough to trip our own threshold.
What we changed
Every issue was fixed the same morning the scan ran, and the commit history records each one. Generic link text became descriptive ("Explore Charlotte" in place of "Learn More"), the copy buttons got accessible labels, the tools layout got a real footer element, a WebApplication and BreadcrumbList JSON-LD block, and breadcrumb navigation, and breadcrumbs went in across /services, /about, /showcase, and /specs. The two spec violations were corrected in robots.txt and in the document head, which is the fix that took the least code and cost the most pride.
The whole sequence, from the heuristics pass through the discovery-directive correction to the last of the eight fixes, is three commits spanning about forty minutes of the same morning.
Verification status
We have now run that scan. A fresh production check of clocktowerassoc.com, made after all eight fixes were deployed, comes back Strong, the top readiness band, and the badge at the top of this page reads straight from that saved result rather than a number we typed in. You can open the snapshot behind it to see the full check. The two manual audits still carry the before and after in numbers, 72 at grade C and then 91 at grade A, and this automated scan is the standing check that those gains have held.
What we take from it
Compliance drifts, and it drifts for the people who wrote the spec too. Our site had passed a manual audit at grade A only weeks earlier, and the automated scan still found eight things, which is a reasonable argument for repeated scanning over point-in-time review.
It also matters that most of what it found lived in shared templates and on subpages rather than on the homepage, which is exactly why the scanner crawls past the front door. A homepage-only check would have reported us clean.
The last one is about the tool rather than the site. We spent as much effort making the validator's heuristics honest as making them strict, because when it flags something on your site we want the finding to survive scrutiny by your own developers. You can run the same scan we ran on ourselves, free, from the assessment page.