test: add private-safe ChatGPT authenticated mobile-web capture kit

[safal207]

Summary

Adds a local-only authenticated mobile-web evidence capture kit stacked on public audit PR #106.

The kit attaches to a chatgpt.com tab that the account owner has already opened and signed into. It does not receive credentials, export cookies/storage state, persist raw conversation text, navigate, click, type, submit prompts, upload files, request permissions or call application APIs directly.

Status

PENDING_AUTHORIZED_LOCAL_EVIDENCE

This PR creates the instrument and privacy contract. It does not claim that an authenticated mobile-chat journey has already been tested.

User-driven checkpoints

• long chat in the middle of the thread;
• return to latest;
• multiline composer with a real virtual keyboard;
• active streaming;
• stopped/completed stream recovery;
• attachment tray;
• sidebar/history;
• Search/widget/source panel;
• offline;
• recovered online;
• 200% zoom/text scaling.

Privacy design

Persisted evidence contains geometry, counts, lengths, SHA-256 digests, allowlisted control names, performance signals and first-party status metadata.

It does not persist:

• message text or chat titles;
• account identity or email;
• full conversation URLs or IDs;
• credentials, cookies or tokens;
• request/response bodies.

Screenshots are disabled by default and require two explicit flags. Optional screenshots globally hide text and blur visual media, but still require local human review before sharing.

Execution boundary

The authenticated observer is never executed in GitHub Actions. CI validates only:

• the bounded JSON contract;
• regression tests;
• pinned CDP-client compatibility;
• JavaScript syntax;
• absence of authenticated CI execution.

Deliverables

• .github/workflows/chatgpt-authenticated-mobile-web-contract.yml
• audits/chatgpt/authenticated-mobile-web-capture-v1.json
• scripts/chatgpt_authenticated_mobile_web_capture.mjs
• docs/audits/CHATGPT_AUTHENTICATED_MOBILE_WEB_CAPTURE.md
• tests/test_chatgpt_authenticated_mobile_web_capture.py

Stack

Base: agent/chatgpt-mobile-web-audit-v0-1 / PR #106
Base exact head: 2407be212e19a393fcd0d8dd33d9fe444aea663b

Exact head

b2d78c9a38c913be6424b1fea2cb60ce99fb6ad5

Exact-head validation

• Workflow: ChatGPT Authenticated Mobile-Web Capture Contract
• Run: 29785148022
• Result: success
• Bounded config: success
• Regression tests: success
• Pinned CDP client install: success
• Observer syntax: success
• No-authenticated-CI-execution gate: success

Downstream gate

Only after a locally reviewed manifest and selected checkpoint artifacts exist:

LiminalQA evidence
→ Pythia judgment
→ CML canonical memory
→ LS human-impact scorecard

Authority boundary

HUMAN_REVIEW_REQUIRED. No credential access, private-data submission, external report, security claim, deployment, delivery or merge authority.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d6d89b17-d715-48ae-8250-a774be2271af

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/chatgpt-authenticated-mobile-web-capture-v0-1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}