test: add bounded ChatGPT mobile-web public audit

[safal207]

Summary

Adds a passive, signed-out audit of https://chatgpt.com/ focused specifically on mobile web rather than Android or iOS native applications.

Final verdict

ONE_P3_DIAGNOSTIC_ONLY

The public signed-out mobile baseline passes:

• route availability across five controlled user-agent/viewport profiles;
• horizontal layout;
• compact-height composer visibility;
• critical mobile-control geometry;
• mobile login layout;
• layout stability in the observation window;
• mobile event delivery.

One finding remains:

• P3-diagnostic — one repeated opaque first-party console.error on the public mobile login page, with no visible login failure, uncaught page error, security impact or user impact established.

Controlled matrix

• desktop UA + desktop viewport;
• desktop UA + mobile viewport;
• Android mobile UA + desktop viewport;
• Android mobile UA + mobile viewport;
• Android mobile UA + compact-height mobile viewport.

Each bounded state runs twice, separating user-agent routing from viewport-driven responsive behaviour.

Focused adjudication

The initial generic detector grouped /unauth-mweb/events/ POSTs as aborted. The focused diagnostic proved that every endpoint returned HTTP 200 or 204 before the CDP loading-aborted signal. This is retained as REJECTED_FALSE_NETWORK_FAILURE, not a product defect.

Other rejected signals:

• composer overlap — ancestor-container false positive;
• duplicate visible heading — rejected by browser matrix;
• raw small-target count — insufficient for an accessibility defect.

Deliverables

• .github/workflows/chatgpt-mobile-web-public.yml
• .github/workflows/chatgpt-mobile-web-diagnostics.yml
• audits/chatgpt/mobile-web-public.json
• audits/chatgpt/mobile-web-public-result.json
• audits/chatgpt/mobile-web-diagnostics-result.json
• scripts/chatgpt_mobile_web_public_observer.mjs
• scripts/chatgpt_mobile_web_diagnostics.mjs
• docs/audits/CHATGPT_MOBILE_WEB_PUBLIC_AUDIT.md
• tests/test_chatgpt_mobile_web_public_audit.py

Exact evidence

Baseline:

• run 29783360123
• artifact SHA-256 1be5ceda6b73ff4a92ff13fc793c22366a05c97069392ad2ac0ec4a3c5ae7316

Focused diagnostic:

• run 29783766882
• artifact SHA-256 dc76eadf08f34a03273f95aee2ff3a7256b39c1a600af5cef91c0c0fd799056c

Authenticated boundary

Long chat, streaming, virtual keyboard, attachments, sidebar history, Search/widgets, Projects/Work, settings/workspace, offline recovery and accessibility remain NEEDS_AUTHENTICATED_MOBILE_EVIDENCE.

Exact head

2407be212e19a393fcd0d8dd33d9fe444aea663b

Authority boundary

Public audit only. No prompt submission, login submission, account access, private chat, file upload, permission request, direct application API testing, access-control bypass, external report, security claim, deployment, delivery or merge authority.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a2a28ca7-b719-4212-b4aa-d8e2be9fad52

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/chatgpt-mobile-web-audit-v0-1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}