- runs the five static gates in Pattern-4 order; --live adds the KV-expiry
and asset-header probes; the no-flag skip prints '(pass --live)' and is
never silently green
- exit 0 CLEAN / 1 FAILED (violations counted across gates) / 2 NOT RUN
(credentials or build or deployment drift — never mistaken for a pass)
- header states the maintainer-time-tool law, the GPL fork-reuse contract,
and D-02's zero-telemetry prove-the-absence posture
- AU1-3 CLI vectors green: CLEAN exit 0 on this tree, FAILED exit 1 via the
PRIVACY_AUDIT_ROOT fixture, NOT RUN exit 2 for --live without credentials
- runBundleTelemetryGate: PRODUCTION web/dist ONLY (dist-harness forbidden,
BA5); analytics/beacon token set (sendBeacon explicit form); positive
host allowlist with the host inventory printed, never assumed (A4);
deep-link crypto (D-11) and storage tokens JS-assets-only; a missing
build is notRun, never a silent pass
- runKvExpiryProbe: npx wrangler kv key list (current syntax, deprecated
colon form forbidden), namespace id read from bot/wrangler.jsonc at
runtime; parses name/expiration/metadata + list_complete/cursor and
follows the cursor; unexpected families REPORTED (A5); oldest/newest
expiry reported; raw key names never printed (category-only evidence)
- runAssetHeaderProbe: curl -sSI cache-control/cf-cache-status reported
VERBATIM (probabilistic — printed, never interpreted)
- documented adjudications: MapLibre static-text hosts, W3C namespace
identifiers, bare-array = CLI's internally-paginated complete set
- SA1-5: each source gate returns {id, pass, evidence}, passes the current
tree, and FAILS a synthetic violation via injected fixture roots
- BG1-2: production web/dist only; missing build is notRun (never a pass)
- CP1-2: probeUnavailable exact shape + credentials-absent degradation
- AU1-3: CLI exit 0/1/2 — CLEAN on this tree, FAILED on a fixture root
(PRIVACY_AUDIT_ROOT), NOT RUN for --live without credentials
araharah-executor