feat: add ChatApp outside-in audit v0.1

.github/workflows/chatapp-outside-in-audit-v0-1.yml

@@ -0,0 +1,129 @@
+name: ChatApp Outside-In Audit v0.1
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - agent/chatapp-outside-in-audit-v0-1
+    paths:
+      - .github/workflows/chatapp-outside-in-audit-v0-1.yml
+      - .github/workflows/chatapp-rendered-audit-v0-2.yml
+      - audits/chatapp/public-audit-v0.1/contract.json
+      - scripts/chatapp_public_audit_probe.py
+      - tests/test_chatapp_public_audit_probe.py
+      - docs/audits/CHATAPP_OUTSIDE_IN_AUDIT_V0_1.md
+      - docs/audits/CHATAPP_COLLABORATION_BRIEF.md
+  pull_request:
+    branches:
+      - main
+    paths:
+      - .github/workflows/chatapp-outside-in-audit-v0-1.yml
+      - .github/workflows/chatapp-rendered-audit-v0-2.yml
+      - audits/chatapp/public-audit-v0.1/contract.json
+      - scripts/chatapp_public_audit_probe.py
+      - tests/test_chatapp_public_audit_probe.py
+      - docs/audits/CHATAPP_OUTSIDE_IN_AUDIT_V0_1.md
+      - docs/audits/CHATAPP_COLLABORATION_BRIEF.md
+
+permissions:
+  contents: read
+
+concurrency:
+  group: chatapp-outside-in-audit-v0-1-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  contract:
+    name: Validate ChatApp audit contract
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout exact workflow revision
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Validate syntax and fail-closed contract
+        run: |
+          set -euo pipefail
+          python3 -m json.tool audits/chatapp/public-audit-v0.1/contract.json >/dev/null
+          python3 -m py_compile scripts/chatapp_public_audit_probe.py
+          python3 scripts/chatapp_public_audit_probe.py --validate-only
+
+      - name: Run regression tests
+        run: |
+          set -euo pipefail
+          python3 -m unittest tests/test_chatapp_public_audit_probe.py -v
+
+  observe:
+    name: Recheck allowlisted ChatApp public content
+    needs: contract
+    runs-on: ubuntu-latest
+    timeout-minutes: 12
+    env:
+      GITHUB_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+      GITHUB_BASE_SHA: ${{ github.event.pull_request.base.sha || '' }}
+    steps:
+      - name: Checkout exact workflow revision
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Run passive sequential audit
+        run: |
+          set -euo pipefail
+          rm -rf reports/chatapp/public-audit-v0.1
+          python3 scripts/chatapp_public_audit_probe.py \
+            --contract audits/chatapp/public-audit-v0.1/contract.json \
+            --output-dir reports/chatapp/public-audit-v0.1
+          cat reports/chatapp/public-audit-v0.1/summary.md >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Validate evidence and authority boundary
+        run: |
+          set -euo pipefail
+          jq -e '
+            .schema_version == "liminalqa-chatapp-public-audit-result-v1" and
+            .target.canonical_origin == "https://chatapp.online" and
+            .boundaries.public_pages_only == true and
+            .boundaries.authentication == false and
+            .boundaries.form_submission == false and
+            .boundaries.button_clicks == false and
+            .boundaries.email_or_external_contact == false and
+            .boundaries.active_security_testing == false and
+            .boundaries.external_submission_authorized == false and
+            .boundaries.merge_authorized == false and
+            .authority.mode == "evidence_only" and
+            .authority.grants.external_submission == false and
+            .authority.grants.merge == false and
+            .aggregate.expected_target_count == 6 and
+            (.aggregate.findings | length) == 4
+          ' reports/chatapp/public-audit-v0.1/result.json >/dev/null
+
+      - name: Record exact attempt and verify checksums
+        run: |
+          set -euo pipefail
+          OUT=reports/chatapp/public-audit-v0.1
+          jq -n \
+            --arg run_id "$GITHUB_RUN_ID" \
+            --arg run_attempt "$GITHUB_RUN_ATTEMPT" \
+            --arg source_head_sha "$GITHUB_HEAD_SHA" \
+            --arg workflow_sha "$GITHUB_SHA" \
+            --arg base_sha "$GITHUB_BASE_SHA" \
+            --arg event_name "$GITHUB_EVENT_NAME" \
+            '{run_id:$run_id,run_attempt:$run_attempt,source_head_sha:$source_head_sha,workflow_sha:$workflow_sha,base_sha:$base_sha,event_name:$event_name,tested_revision_kind:(if $event_name == "pull_request" then "pull_request_merge_ref_with_separate_source_head" else "branch_head" end)}' \
+            > "$OUT/exact-attempt.json"
+          (
+            cd "$OUT"
+            find . -maxdepth 1 -type f ! -name 'ARTIFACT_SHA256SUMS.txt' -printf '%P\0' \
+              | sort -z \
+              | xargs -0 sha256sum > ARTIFACT_SHA256SUMS.txt
+            sha256sum -c ARTIFACT_SHA256SUMS.txt
+          )
+
+      - name: Upload exact-attempt evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chatapp-outside-in-v0-1-${{ github.run_id }}-${{ github.run_attempt }}
+          path: reports/chatapp/public-audit-v0.1/
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/chatapp-rendered-audit-v0-2.yml

@@ -0,0 +1,124 @@
+name: ChatApp Rendered Audit v0.2
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - agent/chatapp-outside-in-audit-v0-1
+    paths:
+      - .github/workflows/chatapp-rendered-audit-v0-2.yml
+      - .github/workflows/chatapp-outside-in-audit-v0-1.yml
+      - audits/browser/chatapp/public-rendered-matrix-v0.2.json
+      - audits/chatapp/public-audit-v0.1/contract.json
+      - scripts/chatapp_rendered_audit_probe.mjs
+      - docs/audits/CHATAPP_OUTSIDE_IN_AUDIT_V0_1.md
+      - docs/audits/CHATAPP_COLLABORATION_BRIEF.md
+  pull_request:
+    branches:
+      - main
+    paths:
+      - .github/workflows/chatapp-rendered-audit-v0-2.yml
+      - .github/workflows/chatapp-outside-in-audit-v0-1.yml
+      - audits/browser/chatapp/public-rendered-matrix-v0.2.json
+      - audits/chatapp/public-audit-v0.1/contract.json
+      - scripts/chatapp_rendered_audit_probe.mjs
+      - docs/audits/CHATAPP_OUTSIDE_IN_AUDIT_V0_1.md
+      - docs/audits/CHATAPP_COLLABORATION_BRIEF.md
+
+permissions:
+  contents: read
+
+concurrency:
+  group: chatapp-rendered-audit-v0-2-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rendered:
+    name: Confirm ChatApp signals in desktop and mobile browsers
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      GITHUB_HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+      GITHUB_BASE_SHA: ${{ github.event.pull_request.base.sha || '' }}
+    steps:
+      - name: Checkout exact workflow revision
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Validate bounded configuration
+        run: |
+          set -euo pipefail
+          python3 -m json.tool audits/browser/chatapp/public-rendered-matrix-v0.2.json >/dev/null
+          python3 -m json.tool audits/chatapp/public-audit-v0.1/contract.json >/dev/null
+          node --check scripts/chatapp_rendered_audit_probe.mjs
+
+      - name: Install pinned browser driver
+        run: |
+          set -euo pipefail
+          npm install --no-save --ignore-scripts puppeteer-core@24.15.0
+
+      - name: Validate runtime and locate Chrome
+        run: |
+          set -euo pipefail
+          node --version
+          npm --version
+          CHROME_PATH="$(command -v google-chrome || command -v chromium || command -v chromium-browser)"
+          test -n "$CHROME_PATH"
+          echo "CHROME_PATH=$CHROME_PATH" >> "$GITHUB_ENV"
+          "$CHROME_PATH" --version
+
+      - name: Run bounded rendered matrix
+        run: |
+          set -euo pipefail
+          rm -rf reports/chatapp/rendered-audit-v0.2
+          node scripts/chatapp_rendered_audit_probe.mjs \
+            --config audits/browser/chatapp/public-rendered-matrix-v0.2.json \
+            --contract audits/chatapp/public-audit-v0.1/contract.json \
+            --chrome "$CHROME_PATH" \
+            --output-dir reports/chatapp/rendered-audit-v0.2
+          cat reports/chatapp/rendered-audit-v0.2/chatapp-rendered-summary.md >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Validate evidence and authority boundary
+        run: |
+          set -euo pipefail
+          jq -e '
+            .schema_version == "liminalqa-chatapp-public-rendered-result-v1" and
+            .aggregate.expected_observation_count == 12 and
+            .aggregate.observed_route_profile_count == 12 and
+            (.aggregate.findings | length) == 4 and
+            .authority.mode == "evidence_only" and
+            .authority.grants.external_submission == false and
+            .authority.grants.deployment == false and
+            .authority.grants.merge == false
+          ' reports/chatapp/rendered-audit-v0.2/chatapp-rendered-result.json >/dev/null
+
+      - name: Record exact attempt and verify checksums
+        run: |
+          set -euo pipefail
+          OUT=reports/chatapp/rendered-audit-v0.2
+          jq -n \
+            --arg run_id "$GITHUB_RUN_ID" \
+            --arg run_attempt "$GITHUB_RUN_ATTEMPT" \
+            --arg source_head_sha "$GITHUB_HEAD_SHA" \
+            --arg workflow_sha "$GITHUB_SHA" \
+            --arg base_sha "$GITHUB_BASE_SHA" \
+            --arg event_name "$GITHUB_EVENT_NAME" \
+            '{run_id:$run_id,run_attempt:$run_attempt,source_head_sha:$source_head_sha,workflow_sha:$workflow_sha,base_sha:$base_sha,event_name:$event_name,tested_revision_kind:(if $event_name == "pull_request" then "pull_request_merge_ref_with_separate_source_head" else "branch_head" end)}' \
+            > "$OUT/exact-attempt.json"
+          (
+            cd "$OUT"
+            find . -type f ! -name 'ARTIFACT_SHA256SUMS.txt' -printf '%P\0' \
+              | sort -z \
+              | xargs -0 sha256sum > ARTIFACT_SHA256SUMS.txt
+            sha256sum -c ARTIFACT_SHA256SUMS.txt
+          )
+
+      - name: Upload exact rendered evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chatapp-rendered-v0-2-${{ github.run_id }}-${{ github.run_attempt }}
+          path: reports/chatapp/rendered-audit-v0.2/
+          if-no-files-found: error
+          retention-days: 30

audits/browser/chatapp/public-rendered-matrix-v0.2.json

@@ -0,0 +1,51 @@
+{
+  "schema_version": "liminalqa-chatapp-public-rendered-v1",
+  "audit_id": "CHATAPP-OUTSIDE-IN-2026-07-23-V0.2",
+  "canonical_origin": "https://chatapp.online",
+  "navigation_timeout_ms": 45000,
+  "settle_ms": 3500,
+  "keyboard_tab_steps": 20,
+  "max_console_entries": 100,
+  "max_failed_requests": 100,
+  "max_response_entries": 300,
+  "max_visible_links": 250,
+  "max_body_sample_chars": 6000,
+  "profiles": [
+    {
+      "id": "desktop",
+      "viewport": {"width": 1440, "height": 1000, "deviceScaleFactor": 1},
+      "user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/140.0 Safari/537.36 LiminalQA-Desktop/0.2"
+    },
+    {
+      "id": "mobile",
+      "viewport": {"width": 412, "height": 915, "deviceScaleFactor": 1, "isMobile": true, "hasTouch": true},
+      "user_agent": "Mozilla/5.0 (Linux; Android 16) AppleWebKit/537.36 Chrome/140.0 Mobile Safari/537.36 LiminalQA-Mobile/0.2"
+    }
+  ],
+  "boundaries": {
+    "public_pages_only": true,
+    "natural_navigation_only": true,
+    "passive_browser_observation": true,
+    "keyboard_navigation_only": true,
+    "authentication": false,
+    "account_access": false,
+    "form_submission": false,
+    "button_clicks": false,
+    "direct_api_testing": false,
+    "email_or_external_contact": false,
+    "enumeration": false,
+    "fuzzing": false,
+    "load_testing": false,
+    "active_security_testing": false,
+    "server_state_change": false,
+    "external_submission_authorized": false,
+    "deployment_authorized": false,
+    "merge_authorized": false
+  },
+  "limitations": [
+    "A rendered marker confirms visible public copy, not internal root cause.",
+    "Screenshots and DOM state do not quantify conversion or revenue impact.",
+    "Keyboard traces sample the first twenty Tab transitions and are not a complete WCAG audit.",
+    "No CTA, form, account, payment, or application control is activated."
+  ]
+}