test: run fourth exact-time Tradernet causal audit

[safal207]

Purpose

Runs a fourth independent public Tradernet audit through the causal deep-audit skill family from PR #112.

Historical findings re-tested

1. PR test: add Tradernet chart, candle and mobile-route causal audit #58 — mobile user-agent chart routing for /charts/MICEXINDEXCF;
2. PR feat: add Tradernet cross-domain causal performance audit #54 — mobile homepage Lighthouse performance;
3. PR test: add Tradernet terminal loading and hidden-asset causal audit #60 — loaded but invisible onboarding.light.2x.png;
4. PR test: add Tradernet terminal loading and hidden-asset causal audit #60 — missing first-party onboarding.png.

First complete evidence run

Run 29960168638 completed successfully and produced artifact 8545714276:

• artifact: tradernet-fourth-exact-rerun-29960168638-1;
• artifact digest: sha256:e44cc8dd0432c37ccc2894296fba01919871ced45aba1471b7402e6533b92ef2;
• all probe, packet validation, and artifact-upload steps passed.

Current classifications from that run:

Finding	Status	Fresh evidence
Mobile UA chart routing	STILL_REPRODUCED	desktop UA returns 200 with chart in both viewports; mobile UA returns 404 with no chart in both viewports
Mobile homepage performance	STILL_REPRODUCED	Performance 54; LCP 9,774.6 ms; FCP 1,719.3 ms; TBT 575 ms; CLS 0.131; 55 scripts; 1,569,438 script bytes
Invisible mobile onboarding asset	STILL_REPRODUCED	onboarding.light.2x.png, 346,798 bytes, natural 870×870, rendered 0×0, outside viewport
Missing onboarding asset	STILL_REPRODUCED	onboarding.png returns HTTP 404 in desktop and mobile profiles

Gate: ALLOW_REPORT.

Exact-head governance correction

The first run executed and preserved valid public evidence, but the packet recorded the GitHub pull-request merge ref as the source SHA. The workflow was corrected to:

• checkout ${{ github.event.pull_request.head.sha }} explicitly;
• fail if git rev-parse HEAD differs from that exact head;
• bind the causal packet to the PR head SHA.

Corrected run 29960420103 is the authoritative provenance attempt for head 15869ae337f6e427a64efde0094b096c85c9b5eb.

Evidence contract

The workflow produces:

• four-way user-agent × viewport screenshots and route evidence;
• fresh Lighthouse evidence;
• fresh desktop/mobile terminal loading evidence;
• fresh image visibility and transfer evidence;
• schema-valid causal deep-audit packet;
• comparison JSON, Markdown summary, and SHA-256 manifest.

Boundary

Public passive navigation only. No authentication, account or portfolio access, order entry, market-depth subscription, direct application API testing, fuzzing, load testing, active security testing, external submission, deployment, delivery, or merge authority.

This PR remains draft until the corrected exact-head run and artifact are reviewed.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9d0df58f-36cb-45f0-9a3a-a2058d436138

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/tradernet-fourth-exact-rerun-v1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}