NeuralMind v3.3.0 — the surfaces people judge you on

Two of NeuralMind’s outward-facing surfaces were quietly producing wrong output. The marketing site rendered every heading in the browser’s default serif because the fonts it declared were never actually loaded. The compliance scanner reported 147 SOC 2 controls on this repository, of which 129 were version strings and SVG path data. v3.3.0 is the release that fixes both — the page a prospect evaluates you on, and the evidence an auditor would be handed.

Neither was a regression. Both had been wrong since the code was written.

What’s in this release

1. The marketing site had no webfonts

tailwind.config.ts mapped font-display and font-mono to Inter Tight and JetBrains Mono. Nothing ever imported them. Next.js only emits @font-face rules for fonts loaded through next/font, so the browser fell through the entire stack to its default serif — 113 font-display headings across 25 files, every one of them rendering in Times New Roman on a page that had been designed around a geometric sans.

The fix is site/src/lib/fonts.ts, which loads all three families through next/font/google and exports the CSS variables the Tailwind config was already pointing at. Because next/font self-hosts, the built site makes no runtime request to fonts.gstatic.com — the fonts ship in the static export.

Landing alongside it:

• A real icon set. Twenty SVG icons on a 24×24 grid, stroke 1.5, currentColor, replacing the emoji the pages had been using as iconography. Emoji render differently on every platform and carry a vendor’s visual language, not yours.
• Contrast fixed to WCAG AA. Nine pages carried body text below the 4.5:1 floor. The token set was repointed — a neutral ramp for surfaces, one accent reserved for interactive elements and one for measured evidence — with an AA-safe muted tone added rather than dimming the existing one further.
• Mobile overflow. A CSS grid child defaults to min-width: auto, which refuses to shrink below its content and pushed the page wider than the viewport. Fixed where it occurred.
• An undefined Tailwind class used in three places, internal footer links opening in new tabs, and a timer in the animated command line that stacked rather than reset.

2. SOC 2 annotations: 96 matched, 7 were real

The SOC 2 pattern treated its framework marker as optional. What remained was “one to three letters, digits, a dot, digits” — a shape that matches far more than a Trust Services Criterion.

Run both matchers over the same corpus (the v3.2.1 tree, across the file types the scanner reads):

                                        before   after
  total SOC 2 matches                       96       7

  genuine — docs/compliance/*.md             7       7
  version strings — v0.13, v2.0             55       0
  eval milestone ids — E1.4                 17       0
  SVG path data — M13.5, A1.5                5       0
  python3.10, TLSv1.2, llama3.1              5       0
  control ids in prose tables, unmarked      7       0

M, L, C, A and S are SVG path verbs, so any inline icon in the codebase read as a control reference. Eighty-two of the ninety-six were noise of that kind, and all of it flowed into neuralmind export --controls, which users submit as compliance evidence.

The last row is the one worth reading twice: seven matches were genuine control ids (CC6.1, CC7.1, PI1.4) sitting in prose tables in docs/COMPLIANCE-SUMMARY.md and docs/SECURITY-GUIDE.md with no marker on their line. Those no longer match, deliberately — a bare CC6.1 in running text is not distinguishable from a version string. If you keep annotations in that shape, add a marker to the line.

The marker is now required, and anchored on word boundaries — without the boundary, noncompliance: CC6.1 matches on the tail of “noncompliance”, a word that appears constantly in compliance prose. Intervening words are still allowed, so the documented form **SOC 2 Control:** CC6.1 keeps working. NIST had required its prefix for exactly this reason since it was written; SOC 2 and ISO 27001 now match that standard.

3. Document-only projects build

neuralmind build . on a repository containing only prose refused to produce a graph. A book, a policy set, or a docs-only repo is a legitimate target for the document ingestion path added in v1.11.0, and now builds.

4. content_category survives a re-embed

The category assigned at ingestion was dropped when a node was re-embedded, which meant the N-13 type filter silently stopped matching nodes it had matched on the previous build. The category is now preserved through re-embed and included in node metadata, so --type filtering is stable across rebuilds.

What the agent actually sees post-install

Nothing in this release changes a command signature, adds an env var, or alters the graph format. A rebuild is worthwhile for the content_category fix but is not required.

Honest scope

• The SOC 2 fix is a tightening, and tightening loses things. An annotation written without a SOC 2 or Compliance: marker on the same line no longer matches. That is the intended behavior — the previous match was indistinguishable from a version string — but if you had unmarked annotations, they are now invisible and need the marker added.
• Compliance: is a SOC 2 / ISO 27001 marker, not a universal one. NIST, CMMC, SOX and HIPAA each require their own prefix. # Compliance: AC-1: … matches nothing.
• The site work is visual and structural, not a claims change. No performance number on the site moved; site/claims.json is unchanged.
• This release does not fix the compliance scan scope. On this repository neuralmind compliance . still reported zero annotations after v3.3.0, because the CLI and MCP entry points could not read markdown files at all. That is fixed in v3.3.1.

Upgrade

pip install --upgrade neuralmind
neuralmind build .    # optional — picks up the content_category fix