feat: add ChatApp outside-in audit v0.1

[safal207]

Summary

Introduces an independent, evidence-first ChatApp public audit across three lenses:

• QA and content integrity;
• system and content-model consistency;
• business, buyer, developer, and partner-conversion impact.

The branch starts from exact main SHA 19d1cd72472666df21350c6f2b2e54591eb3f462.

What changed

• added a bounded machine-readable audit contract;
• added a sequential public-content probe using Python standard library only;
• added a desktop/mobile Chromium matrix with screenshots, keyboard traces, and console/network summaries;
• added fail-closed regression tests for origin and authority boundaries;
• added read-only GitHub Actions workflows with exact-attempt artifacts and checksum verification;
• bound raw and rendered workflows to the same final source head;
• documented source-to-rendered adjudication and limitations;
• added a collaboration brief containing only confirmed observations.

Confirmed candidates

1. CHAT-001 — legal disclosure contains conflicting correct and incorrect company-name grammar — MEDIUM;
2. CHAT-003 — the developer partner page labels two materially different models as Integrator — MEDIUM;
3. CHAT-004 — commercial and developer pages contain visible language-quality defects — LOW.

All three were reproduced in settled desktop and mobile profiles on exact source head 8a7de729f8a0d6ecd48832cde09c98ccfa9d42af.

Needs evidence

CHAT-002 — a search-indexed pricing article contains an October 2025 publication date, a May 2025 future-tense change, and an April 2025 deadline. However, the exact raw and Chromium audits received HTTP 404 for the live route, so this item remains NEEDS_EVIDENCE and is excluded from the collaboration brief as a confirmed visible defect.

Source-to-rendered adjudication

The audit harness corrected two of its own assumptions before final judgment:

• a mistaken canonical-path hypothesis was rejected after the exact run;
• the pricing finding was decoupled from interactive calculator state because no button activation is authorized.

Search-index visibility is not treated as equivalent to a live rendered page.

Decision model

search or cached observation
→ NEEDS_EVIDENCE

current public response marker reproduced
→ PRODUCT_SIGNAL

settled desktop + mobile reproduction
→ CONFIRMED_PRODUCT_DEFECT_CANDIDATE

human semantic and impact review
→ final severity / collaboration decision

No public marker is treated as proof of internal root cause, legal impact, or measured commercial loss.

Safety boundary

Public allowlisted HTTPS pages and natural navigation only.

No authentication, registration, control activation, form submission, demo booking, checkout, direct application API testing, enumeration, fuzzing, load testing, active security testing, vulnerability claim, external contact, remediation, deployment, delivery, or merge is performed or authorized.

Exact validation

On source head 8a7de729f8a0d6ecd48832cde09c98ccfa9d42af:

• raw audit: success, 6/6 route attempts, 3/4 PRODUCT_SIGNAL, one route-level NEEDS_EVIDENCE due HTTP 404;
• rendered audit: success, 12/12 desktop/mobile observations, 3/4 CONFIRMED_PRODUCT_DEFECT_CANDIDATE;
• all rendered final origins remained bounded;
• authority-boundary and checksum verification passed;
• exact-attempt artifacts were uploaded for both layers.

Accessibility and runtime telemetry were collected but are not promoted to findings without a dedicated contract.

This PR remains draft pending the human collaboration and reporting decision.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a8e04d61-f078-4bf2-9748-c4f976cbe9fb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/chatapp-outside-in-audit-v0-1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[safal207]

Initial audit status

The bounded ChatApp audit package is committed on source head eb35bb982586a691ac1c72a2a8f2ae0d922dde97.

Current public observations define four claims under test:

1. conflicting legal-entity grammar on /about/;
2. an October 2025 pricing article using future tense and an April 2025 deadline;
3. two materially different partner models presented under the Integrator label;
4. language-quality markers on the home and developer acquisition surfaces.

No finding is promoted beyond the initial claim state yet. GitHub has not instantiated pull-request workflow runs for either newly added workflow on the source head or PR merge ref. This is recorded as an evidence-infrastructure blocker, not as audit success or failure.

Safety boundary remains unchanged: no authentication, button activation, forms, checkout, direct API testing, security testing, external contact, deployment, or merge.