Service catalog and project discovery verification

Requirements: REQ-PRODUCT-SERVICE-CATALOG, REQ-PRODUCT-SERVICE-DETECTION.

The version-1 catalog preview provides bounded normalization, reference search, an explicit ordinary-service draft plus detached selection snapshot, an offline seed, and static Node project discovery. Shared public directory rendering now uses the declared inventory. CLI/admin selection now supplies explicit actual-use review and private setup-report pins. Optional browser resource, storage-name, own-global and fixed DOM-marker rules now supply bounded exact, prefix, single-wildcard and combined candidates. Automated legal-release provenance archival and broad language/infrastructure coverage remain incomplete. Arbitrary regex and executable rules are deliberately unsupported.

The seed imports a pinned Apache-2.0 CSV with preserved source/license hashes. Its 2,279 rows produce 2,278 storage hints; one row lacks a named platform/controller. Original backend/provider references bring the seed to 363 provider identities and 402 product/reference entries. All entries remain unreviewed. Backend homepages are reference-only with no asserted source verification date. A driver/SDK match can represent self-hosted software or an unused dependency.

Tests cover source/count/provenance preservation, detached results, missing actual site-use fields, malformed closed-schema data, unknown references and identities, accessor/cyclic input rejection without executing getters, safe text/link input, candidate search filters and ordinary browser graphs excluding the catalog and Node scanner. Source normalization is separate from legal validity and verified vendor facts.

Temporary project fixtures exercise npm/development dependencies, source imports, Python requirements and Terraform names. Findings retain file/rule/known-identifier references and omit source lines, dependency values, resource names and test secret sentinels. Secret-named files, generated/dependency directories, symlinks, oversized files and prefix confusers are checked. A Git fixture verifies ignored-file selection and configures a filesystem-monitor script whose marker remains absent after scanning. Project scripts are not invoked. A project-controlled PATH shim cannot replace the canonical system Git. Invalid package-name controls are rejected, prefix evidence retains only the known rule prefix, and array-valued enums/references cannot broaden matching or bypass normalization.

CLI fixtures search the offline seed and scan a directory without a site config. Private output is exclusive, includes its own ignore file, and repeated/mixed arguments are rejected. Packed installation checks include the optional seed, schema, attribution/license files, CLI operation, subpath imports and strict consumer declarations.

Project selection is limited to 5,000 files, 256 KiB per file, 32 MiB of read data and 20,000 unique observed identifier tokens; coverage is reported explicitly. JSON catalogs have byte, node, depth, text, array and reference limits. Paths and names remain private project metadata. Stable project files and ordinary Git behavior are assumed; this is not a sandbox or a comprehensive audit of adversarial concurrent filesystem changes.

Static text scanning can find commented/unused imports and miss dynamic code, additional languages, unsupported deployment formats or provider settings. It does not prove deployment, data transfers, necessity, exemption, lawful basis, provider identity, DPA scope or no tracking. No network/provider probe, browser scan, project-code execution, automatic config update, consent grant or CI policy is supplied by project discovery.

The directory has six focused cases for detached selected-only projections and privacy-provider agreement, pinned inventory independence, literal bounded/purpose filtering, escaped script-free details, production/preview and empty/missing-fact behavior, exact React server markup, local filtering/count announcements, preservation of keyboard focus and pre-opened native details, teardown/remount and invalid-input preservation. Actual browser bundling excludes catalog/Node/backend inputs. Packed tests compile the Astro directory in an isolated consumer and exercise exported types/styles. Site tests verify both themes, the exact directory fragment, selected public config, narrow search-route CSP, script-free related policies and no DO allocation. These engineering checks do not verify provider facts or legal completeness. The directory is not a separately archived fourth legal document; retained config provides the historical inventory. Full assistive-technology/browser coverage and localization remain open.

Chromium acceptance on 19 October 2026 checked provider search, purpose filtering, count changes and native data/storage expansion. At 390 and 320 CSS-pixel viewports, document widths were 375 and 305 px after the scrollbar (no horizontal overflow); search/select heights met 44 px. Both light and midnight themes were inspected. The optional model/render/search bundle measures 10.68 KiB gzip and its independent CSS 1.73 KiB; compiled consent JS/CSS remain 12.18/2.21 KiB.

Catalog selection tests cover preserved settings and private/public separation, detached service facts, exact reference pins and unreviewed source status, missing confirmation/actual facts, conflicting IDs and executable/coerced inputs, stale/mismatched report/config pairs and bounded entry counts. Complete selected purpose definitions are pinned: changing meaning or collection facts under the same ID rejects both pending picker proposals and resumed reports. Picker tests cover explicit callbacks, host-callback uncertainty, lazy retry/destroy, local setup integration, enclosing-form Enter handling and preserving unrelated same-ID inventory during removal. A noninteractive CLI test resumes exact private pins with matching config and rejects mismatches before creating output. Purpose authoring tests cover a fresh setup declaring a purpose before provider selection, stale notes after purpose changes and preservation of changed inventory when removing a note. Site checks keep the seed lazy and outside the normal consent graph, with matching attribution/license assets. Local Chromium checks exercised catalog loading, search, actual-use selection and recommendation preparation; a real terminal exercised interactive selection and split config/private-report output. Browser download completion remains unverified. Automatic DO/release archival of these notes remains open.

Pinned browser recognition preview

Seven original rules cover six products using nine recorded official technical references. New fixtures check positive paths/types, shared-host confusion, lookalike domains, schemes/ports/credentials, encoded-path confusers, same-resource correlation, distinct observation channels, partial marker hints, descriptor-only globals, no getter/SDK calls, channel rollback, work/size bounds and secret sentinels. Historical reports retain complete evaluated snapshots; same-revision metadata changes fail an explicit expected-snapshot comparison. Version-1 captures remain unchanged and cannot invent missing paths/globals/markers.

Workflow tests execute the real CLI with rich and legacy captures, exclusive 0700/0600 private output, no overwrite, symlink/oversize rejection and mismatch-before-write. UI tests check explicit single capture, detached reports, text-only rendering, partial/matched filters, source pins, four exports and revocation on edit/reset/failure/destruction. Browser/manual verification is recorded separately; tests do not establish complete network visibility, legal/provider review or authenticity of imported client reports.

The complete milestone check passed 501 package and 62 site tests, catalog/source regeneration and a Worker deployment dry run. Real Chrome checks covered the light desktop review, midnight 390px/320px wrapping, local search, native condition/source disclosure and marker removal on recapture. No external script reference was added by the marker example. Browser-extension warnings were separate from the example. The derived consent-only CSS stayed byte-identical and measured visitor graphs exclude browser rules and the catalog seed. A reviewer-reproduced named-pipe CLI hang was fixed with preflight ordinary-file inspection plus nonblocking/no-follow open and descriptor recheck; bounded capture/rule FIFO regressions cover it. Manual browser download readback and broader cross-platform/assistive-technology checks remain open.

Project-aware wizard

wizard --project DIRECTORY [--catalog FILE] now connects the offline scanner to the existing actual-use prompt, after purpose review. Project findings and coverage stay in a separate private file; selected services use the same source/purpose pins as manual search. Tests verify explicit confirmation, skipped/invalid candidates, no invented purposes, bounded candidate pagination, custom-catalog manual search and preservation of previous pins across a later catalog revision. Noninteractive runs preserve existing inventory/runtime settings and do not select services from detection.

Subprocess checks cover private/ignored scan output, invalid flag combinations, invalid answers before scanning, strict bounded ordinary UTF-8 inputs, no overwrite and named pipes in setup/catalog inputs or a tracked source file. The offline-installed tarball executes the new wizard command. The full milestone check passed 510 package and 62 site tests, regulatory/catalog regeneration and a Worker dry run. Source evidence remains unverified and incomplete; browser/admin setup still cannot inspect local project files, and automatic legal-release provenance archival remains open.

Product documentation profiles

The optional profile model now connects selected documentation notes and review questions to exact product/source pins and retained release comparisons. Initial coverage and focused checks are recorded in catalog-profiles.md. Existing statements above about open automated release archival are historical milestone notes: explicit release attachment and separately authorized CF inspection are now implemented; automatic publication and independent provider-practice verification are not implied.