Why slop happens

AI writes plausible code fast. Left unchecked, it also writes slop: a page that pulls in a framework to render a heading, ships hundreds of kilobytes of JavaScript to move some text around, and needs a build step before a browser can see a word of it. It works in the demo and rots in production. This guide is about the opposite discipline — building fast, secure, long-lived sites with AI and no slop — and it starts by being concrete, because the word lightweight is worthless until it is a number a machine can check.

Mocha, the engine that renders this guide, holds three budgets, each wired to a gate so the claim cannot drift.

Fifteen production dependencies, maximum. The deps:check gate counts the dependencies block in package.json and fails the build above fifteen. The engine currently runs on ten. Every dependency is a supply-chain surface and a thing that can break on upgrade; capping the count keeps that surface small on purpose, not by accident.

Zero bytes of client JavaScript. Not a little — zero. The render layer emits no <script> at all, so the guarantee is structural, not a target you approach. A reader on a slow phone downloads HTML and CSS and nothing that has to boot before the page is usable.

Sixty kilobytes per page, maximum. The home page's rendered weight is asserted under 60,000 bytes in test/render.test.js, and that test runs in CI on every push. A page that fits in one round trip is fast on a real network, not just on the developer's laptop.

And no build step. A seed directory of content and a hand-written CSS file are the source; the process renders HTML directly. There is nothing to compile, so there is nothing to wait for and nothing to misconfigure.

What do those budgets buy? Speed that survives contact with a real device and a real network. A security surface small enough to actually audit — you cannot review a thousand transitive dependencies, but you can review ten. And longevity: code with no build toolchain and almost no dependencies still runs in five years, because there is almost nothing to go stale. Lightweight is not an aesthetic. It is the set of constraints that make the rest of this guide — the laws, the process, the security audit — enforceable rather than aspirational.