- source-side runtime-hosts gate gains DOC_POINTER_STATIC_TEXT_HOSTS (the
MapLibre-attribution precedent): the published repo origin may appear
ONLY as a bare URL literal in bot copy (D-08/D-09), never fetched
- class is NARROW and pinned by SA6: a fetch( target naming the same
host is still a violation
- Rule 1 (found by SA6's RED): the fetch( handler's declaration
heuristic misclassified any quoted absolute URL as a TS declaration —
quoted strings are targets; they now reach the host check
- docs/PRIVACY-AUDIT.md: adjudication documented + dated re-run addendum
- deferred-items.md #1 closed: npm run privacy-audit exits 0 again
(PRIVACY AUDIT CLEAN — 5 gate(s) passed, 0 violations; suite 13/13)
- Findings table carries the ACTUAL printed evidence from the audited run
(commit 9c55e9a): 5 static gates PASS, 0 violations; live legs recorded
honestly as NOT RUN with the launch-gate re-run protocol
- Storage inventory: the four TTL-only KV families; Log vocabulary: the
category-only surfaces; Runtime network: the printed host inventory
(allowlist + documented static-text class) and D-02's zero-telemetry posture
- human signature block left blank for the launch gate (D-09)
araharah-executor