# Beauty Design Compiler Public Evidence Audit V2
Audit date: July 27, 2026
Historical V1 public surface audited:
<https://cauldron-beauty-compiler.leightonrephoto.chatgpt.site/>
## Current V2 evidence note
The current V2 evidence is publicly reachable at:
<https://cauldron-beauty-compiler.leightonrephoto.chatgpt.site/completion/>
On July 27, 2026, all 17 completion routes were checked with unauthenticated HTTP requests and
then opened sequentially in the user-selected Chrome browser. Every friendly route returned
HTTP 200 with `text/html`, loaded without authentication, carried
`noindex, nofollow, noarchive` HTML metadata, rendered a non-empty heading and body, loaded its
fonts, and reported zero broken rendered images or console errors. Some friendly HTML routes use
an intentional client-side canonical handoff to the sanitized underlying evidence page; those
final Chrome URLs were also same-origin and loaded successfully.
The first audited V2 public handoff was committed as
`e2bb9f4ec1ee58d63acdbb1e314961ab36630370`. The application source `HEAD` inspected by this
audit was `fe56e1a66b9f320ba3543f705be98583e299146a`, but that source worktree contained preserved
uncommitted and untracked implementation evidence. This document therefore does not claim that
the application source is reproducible from that `HEAD` alone. The public handoff is a separate,
sanitized, committed artifact.
### Required six-resource map
| Public resource | Public URL | Local source | Publishing command | Build identifier | Verification | Problems found | Corrective action |
| --- | --- | --- | --- | --- | --- | --- | --- |
| QA gallery | <https://cauldron-beauty-compiler.leightonrephoto.chatgpt.site/qa-gallery/> | `artifacts/beauty-design-compiler-v2/qa-site/index.html` | `pnpm beauty:qa:finalize:v2`, then `tools/repackage-beauty-v2-public-handoff.ps1` | Public handoff base `e2bb9f4e…` | HTTP 200; public; fictional fixtures only; Chrome loaded | Friendly route canonically hands off to `/` | Retained friendly permanent URL and verified same-origin final page |
| Architecture document | <https://cauldron-beauty-compiler.leightonrephoto.chatgpt.site/architecture/> | `docs/templates/beauty-design-compiler.md` | `tools/repackage-beauty-v2-public-handoff.ps1` | Public handoff base `e2bb9f4e…` | HTTP 200; public; sanitized rendered source | Friendly route canonically hands off to `/evidence/docs/beauty-design-compiler.md` | Retained readable wrapper and verified final page |
| Visual fidelity ledger | <https://cauldron-beauty-compiler.leightonrephoto.chatgpt.site/fidelity-ledger/> | `docs/templates/beauty-design-compiler-fidelity-ledger.md` | `tools/repackage-beauty-v2-public-handoff.ps1` | Public handoff base `e2bb9f4e…` | HTTP 200; public; sanitized rendered source | Friendly route canonically hands off to `/evidence/docs/beauty-design-compiler-fidelity-ledger.md` | Retained readable wrapper and verified final page |
| Database migration | <https://cauldron-beauty-compiler.leightonrephoto.chatgpt.site/migration/> | `migrations/0046_beauty_aesthetic_convergence_v2.sql` | `tools/repackage-beauty-v2-public-handoff.ps1` | Public handoff base `e2bb9f4e…` | HTTP 200; public; schema only; no row data or secrets | Public schema is an intentional security disclosure | Kept only the reviewed migration and wrapped it as escaped text |
| Generator Lab source | <https://cauldron-beauty-compiler.leightonrephoto.chatgpt.site/generator-lab/> | `apps/operator-dashboard/src/pages/BeautyGeneratorLabPage.tsx` | `tools/repackage-beauty-v2-public-handoff.ps1` | Public handoff base `e2bb9f4e…` | HTTP 200; public; sanitized source only | Public component source does not publish the protected running Lab | Kept the protected product route private and published only the reviewed source view |
| Machine-readable QA summary | <https://cauldron-beauty-compiler.leightonrephoto.chatgpt.site/machine-qa-summary/> | `artifacts/beauty-design-compiler-v2/qa-site/qa-summary-v2-final.json` | `pnpm beauty:qa:finalize:v2`, then `tools/repackage-beauty-v2-public-handoff.ps1` | Public handoff base `e2bb9f4e…` | HTTP 200; public; sanitized aggregate evidence | Friendly route canonically hands off to `/qa-summary-v2-final` | Retained permanent friendly URL and verified final report |
The current V2 evidence contains 128 accepted fictional-fixture pages, 512 exact-viewport Chrome
screenshots and browser records, both intended self-hosted font faces loaded in every record,
zero failed resource requests, 52/52 planned direct inspections passing, and 256/256
mobile/desktop axe-core runs passing the finalizer.
The controlled Chrome performance set has 32 runs across all 16 capsules at mobile and desktop.
It is not Lighthouse, does not establish field Core Web Vitals, and does not measure LCP or INP.
The optional Responses screenshot critic produced no accepted result because the configured
account controls blocked the optional path; seven staged calls were discarded atomically. No
human-participant result or customer production deployment is claimed.
Everything below the executive verdict is retained as the historical audit of the earlier
64-page V1 public snapshot. It must not be read as the current V2 result.
## Executive verdict
At the time of the historical V1 audit, the public evidence site was anonymously reachable and
internally coherent enough to support a
useful preproduction review. The index and all 64 linked render pages returned HTTP 200, every
render page carried `noindex, nofollow, noarchive`, all tested fragment targets resolved, and the
five requested evidence resources were byte-for-byte identical to their current local
counterparts.
It is not yet a release-grade, commit-verifiable evidence bundle.
The highest-impact gaps are:
1. The published evidence is not bound to a Git commit. At audit time, all four published
implementation/documentation counterparts were untracked, the QA summary was ignored, and the
current `HEAD` contained none of the Beauty compiler paths.
2. Raw Markdown, JSON, SQL, and TSX evidence has no response-level `X-Robots-Tag`; the HTML
`noindex` metadata does not protect those non-HTML resources.
3. The host does not apply the renderer's expected response headers, and all four published WebP
assets are served as `application/octet-stream`.
4. The index does not link to the architecture, fidelity ledger, migration, Generator Lab source,
or QA summary, so the public artifact is not self-explaining.
5. The 64-page set proves route health and categorical manifest variation, but it does not prove
all advertised visual systems. In particular, every manifest selects a gallery layout while
none of the 64 published pages renders a gallery section.
This audit made no implementation, deployment, DNS, crawling, outreach, billing, or production
gate changes.
## Audit scope and method
The audit used clean, unauthenticated HTTP requests and new Chrome page loads. It did not reuse an
application login, browser storage, or a privileged route.
The following public resources were inspected:
- `/`
- `/docs/architecture.md`
- `/docs/fidelity-ledger.md`
- `/sources/0045_beauty_design_compiler.sql`
- `/sources/BeautyGeneratorLabPage.tsx`
- `/qa-summary.json`
- all 64 `pages/*.html` links exposed by the index
- all four same-origin fixture WebP assets referenced by those pages
- common sensitive-path and directory-listing probes
Checks included:
- HTTP status, MIME type, cache policy, and security headers;
- SHA-256 comparison against current local files;
- index-to-page traversal;
- fragment-target validation;
- source and evidence sanitization patterns;
- public-source comparison with the current working tree and `HEAD`;
- direct visual capture of the index plus one balanced desktop and mobile render per principal
variant.
The browser captures used in the companion aesthetic audit are under
`artifacts/beauty-public-audit-v2/`.
## 1. Public resource integrity
All five requested evidence files matched the working tree byte-for-byte:
| Public resource | Status | MIME type | Bytes | SHA-256 | Local counterpart | Exact |
| ------------------------------------------ | -----: | -------------------------- | -----: | ------------------------------------------------------------------ | -------------------------------------------------------------- | ----- |
| `/docs/architecture.md` | 200 | `text/markdown` | 43,441 | `654bf398adee2d83ee58a5550495531b3c38b80d8e9337b0141947e4edad4c33` | `docs/templates/beauty-design-compiler.md` | Yes |
| `/docs/fidelity-ledger.md` | 200 | `text/markdown` | 10,719 | `ea5e1775772f1139ffac10c5a3498a91b38c69340bb2e1a12788bbdd5f15876b` | `docs/templates/beauty-design-compiler-fidelity-ledger.md` | Yes |
| `/sources/0045_beauty_design_compiler.sql` | 200 | `application/octet-stream` | 30,346 | `05837a5b2356492f80d451003dc09a083dfa5acc6ffa76c2a0c964b3040aef19` | `migrations/0045_beauty_design_compiler.sql` | Yes |
| `/sources/BeautyGeneratorLabPage.tsx` | 200 | `application/octet-stream` | 21,952 | `5f3b6dd38ad8eeffd819f51f115d81a14df9e26545d52467cc2649e622599f07` | `apps/operator-dashboard/src/pages/BeautyGeneratorLabPage.tsx` | Yes |
| `/qa-summary.json` | 200 | `application/json` | 44,345 | `639d13fc78fcd74fe82d9507ec67c3507778e8ff06c54c8e887fde6839220b33` | `artifacts/beauty-design-compiler/qa-summary.json` | Yes |
The root HTML is modified at response time by the hosting layer's bot-management script, so its
wire bytes are not a stable source-artifact hash. That makes a separately published release
manifest more important.
## 2. Route and link health
### Confirmed healthy
- The index returned HTTP 200 with title `Beauty Design Compiler — 64-page QA set`.
- The index carried `noindex, nofollow, noarchive`.
- The index exposed 64 unique complete-page links.
- All 64 page links returned HTTP 200.
- All 64 page responses carried `noindex, nofollow, noarchive`.
- The pages contained 304 fragment-link occurrences across four unique targets:
`#main-content`, `#priority-services-2`, `#team-5`, and `#visit-9`.
- Zero fragment links pointed to a missing target.
- The pages contained 64 same-origin home links and 64 same-origin image references.
- The four unique image references all returned HTTP 200.
### Correct evidence boundary
The 64 pages contain 404 external HTTPS link occurrences across 15 unique `.example.test` fixture
targets. They also contain reserved `+1 555` telephone/SMS links and `.example.test` email
addresses. These are deliberately non-production fixture values.
Accordingly, the published claim that there is “no dead primary action” should be read as a
renderer assertion that a syntactically populated action exists. It is not proof that the public
fixture completes a real booking, call, SMS, email, review-source, or directions handoff.
For a public evidence viewer, those controls should either:
- be visibly labeled as fixture-only;
- open an explanatory fixture panel; or
- be inert while retaining their rendered-action QA metadata.
Allowing reserved fixture actions to look operational creates unnecessary ambiguity.
### Negative probes
The following returned 404:
- `/docs/`
- `/sources/`
- `/pages/`
- `/.git/config`
- `/.env`
- `/package.json`
- `/manifest.json`
- `/robots.txt`
- `/sitemap.xml`
- a random nonexistent path
This is positive evidence against directory listing, broad SPA fallback leakage, and several
common accidental-source exposures. The explicitly published SQL and TSX files remain intentional
source disclosures and should be treated as such.
## 3. Sanitization and source review
The five local counterparts were scanned for common sensitive patterns. The scan found zero
matches for:
- Stripe live or test secret keys;
- Resend-style API keys;
- bearer tokens;
- private-key blocks;
- credential assignments;
- local `C:\Users\...` paths;
- non-fixture email addresses;
- `localhost` or `127.0.0.1`.
The public QA summary contains only aggregate fields and per-render design descriptors:
- top-level counts and timestamps;
- fixture ID;
- variant;
- recipe;
- full and first-viewport fingerprints;
- hero;
- typography pairing;
- palette;
- page rhythm;
- scenario;
- coverage status.
It does not publish seeds, exact prompts, addresses, telephone numbers, email addresses, or
customer facts. Its four fixture IDs are visibly fictional:
- `morrow-and-muse`
- `northline-studio`
- `orbit-nail-room`
- `stillwater-skin-and-ritual`
The published Generator Lab source does not contain credentials. Its seed generator uses Web
Crypto, and its two preview frames use `sandbox="allow-same-origin"` without script permission.
The surrounding repository places `/design-lab` behind the operator dashboard's anonymous-user
login boundary. Publishing the page component alone does not publish the running protected Lab.
The SQL resource contains schema, trigger, and guard implementation details but no row data or
credentials. This is useful review evidence, but it also gives an attacker a concise map of table,
trigger, and lifecycle names. Keep it public only as a deliberate product-security decision.
## 4. Response-level security and privacy
The root, a representative render page, the raw documentation, and the fixture assets were checked
for common response controls.
The tested responses did not include:
- `Content-Security-Policy`;
- `X-Content-Type-Options`;
- `X-Frame-Options`;
- a CSP `frame-ancestors` equivalent;
- `Referrer-Policy`;
- `Permissions-Policy`;
- `X-Robots-Tag`;
- `Cross-Origin-Opener-Policy`.
The HTML pages do include robots metadata, but the raw Markdown, JSON, SQL, TSX, and WebP responses
cannot inherit that metadata. If the evidence site is meant to remain unindexed, response-level
`X-Robots-Tag: noindex, nofollow, noarchive` is required on every evidence route.
The hosting layer injects one inline bot-management script into the root and render pages and may
set a Secure, HttpOnly, SameSite=None `__cf_bm` cookie on the parent `chatgpt.site` domain. The
application does not otherwise ship runtime JavaScript in the inspected static pages; the other
page script is JSON-LD. A CSP must therefore be designed with the host's required bot-management
behavior rather than pasted blindly.
All four fixture assets currently return:
```text
Content-Type: application/octet-stream
```
They should return:
```text
Content-Type: image/webp
X-Content-Type-Options: nosniff
```
The current browser render succeeds because browsers sniff the payload. Enabling `nosniff` before
fixing the asset MIME type would break the images.
## 5. Provenance and reproducibility
The repository snapshot observed during this audit was:
```text
HEAD: fe56e1a66b9f320ba3543f705be98583e299146a
Commit time: 2026-07-27T05:17:23-05:00
Subject: docs: record controlled provider release evidence
```
At that moment:
| Local evidence counterpart | Tracked by `HEAD` | Ignored |
| -------------------------------------------------------------- | ----------------- | ------- |
| `docs/templates/beauty-design-compiler.md` | No | No |
| `docs/templates/beauty-design-compiler-fidelity-ledger.md` | No | No |
| `migrations/0045_beauty_design_compiler.sql` | No | No |
| `apps/operator-dashboard/src/pages/BeautyGeneratorLabPage.tsx` | No | No |
| `artifacts/beauty-design-compiler/qa-summary.json` | No | Yes |
`git ls-tree` found no Beauty compiler implementation or evidence path under the current `HEAD`.
The public bundle therefore proves equality with the current working tree, not equality with a
reviewable Git revision.
The working tree also contains opt-in V2 modules such as
`semantic-fingerprint-v2.ts`, `tournament-v2.ts`, and `quality-diversity.ts`. The public QA
summary and architecture evidence identify the rendered system as
`beauty-design-generator-v1`. V2 code presence must not be presented as V2 public execution
evidence.
Before presenting this as durable release evidence:
1. Commit the intended source, migration, tests, and documentation.
2. Generate the QA artifact from that exact clean commit.
3. Publish a signed or checksum-protected `release-evidence.json` containing:
- commit SHA;
- dirty-worktree flag;
- build command;
- generator, grammar, renderer, and fingerprint versions;
- artifact creation time;
- file hashes;
- test command/result summary;
- deployment/version ID.
4. Make the root index link to that manifest and every published evidence resource.
5. Refuse evidence publication when the source worktree is dirty unless the manifest explicitly
labels it as a non-release snapshot.
## 6. Public evidence versus implementation claims
### What the public artifact proves
- 64 HTML pages were published and anonymously load.
- Four variants and sixteen recipe IDs are represented.
- The published QA summary contains 64 distinct full fingerprints and 64 distinct
first-viewport fingerprints.
- All 64 summary records report complete information coverage with zero invalid records.
- Hero, typography, palette, and page-rhythm selections vary across the set.
- Static render pages remain usable when loaded without application JavaScript.
### What it does not prove
- That the exact source is committed or reproducible from `HEAD`.
- That V2 selection or semantic-tournament behavior ran.
- That categorical fingerprint uniqueness equals perceptual uniqueness.
- That every component layout was visibly exercised.
- That fixture action targets complete real workflows.
- That the published host applies the response headers documented by the renderer.
- That local accessibility, timing, or screenshot reports were independently reproduced on the
public host.
The most material coverage contradiction is gallery rendering:
- all 64 manifests select a non-omitted gallery composition;
- those selections include all six gallery layout families;
- zero of the 64 published HTML files contains a rendered gallery section.
The Generator Lab intentionally simulates a rich image count for recipe eligibility while
retaining only documentary evidence in gallery bindings. The renderer then correctly omits the
gallery when there is no eligible real or decorative asset. That is an evidence-fixture problem,
not evidence that the production omission rule is wrong. It means the public matrix does not
visually validate the gallery recipes it claims to cover.
## 7. Prioritized findings
| ID | Priority | Finding | Consequence | Required correction |
| ----- | -------- | ------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| PE-01 | High | Public evidence is not bound to a commit; key counterparts are untracked and QA JSON is ignored. | Reviewers cannot reproduce or attest the published implementation. | Commit intended files and publish a build/deployment provenance manifest. |
| PE-02 | High | Non-HTML evidence has no `X-Robots-Tag`. | Raw docs, schema, source, and QA data can be indexed if discovered. | Apply response-level noindex policy to the entire evidence site. |
| PE-03 | High | Gallery recipes are selected in 64 manifests but rendered in zero public pages. | The bundle overstates visible recipe/component coverage. | Add documentary-safe fictional gallery fixtures and assert visible layout coverage, or explicitly mark gallery visual QA as absent. |
| PE-04 | Medium | CSP, clickjacking, referrer, permissions, MIME-sniffing, and opener policies are absent. | The public evidence host does not match the documented renderer security posture. | Apply a host-compatible security-header policy and verify it over HTTP. |
| PE-05 | Medium | WebP files are served as `application/octet-stream`. | Rendering depends on browser sniffing and will conflict with `nosniff`. | Serve each asset as `image/webp`, then enable `nosniff`. |
| PE-06 | Medium | The root index does not link the five evidence resources or a release manifest. | Review evidence is undiscoverable and cannot be followed as a coherent chain. | Add an “Evidence and provenance” section with hashes and direct links. |
| PE-07 | Medium | Reserved fixture actions look operational. | Reviewers can mistake structural CTA checks for live workflow proof. | Mark, intercept, or disable fixture-only actions on the public evidence surface. |
| PE-08 | Low | The host injects bot-management script/cookie behavior without an evidence-site disclosure. | Reviewers cannot distinguish application code from hosting-layer behavior. | Document the hosting-layer injection in the evidence manifest and privacy notice. |
## 8. Recommended publication gate
The next evidence deployment should fail unless all of the following are true:
- source worktree is clean;
- `release-evidence.json` names the exact commit and deployment version;
- every linked evidence file hash matches the manifest;
- all 64 recipe/scenario pages return 200;
- all HTML and non-HTML routes receive the intended robots policy;
- security headers match the documented public-evidence policy;
- WebP responses use `image/webp`;
- every component family claimed as visually covered appears in at least one rendered page;
- fixture-only links are visibly distinguished from working production links;
- the root provides direct navigation to architecture, QA, fidelity, source, hashes, and limits.
## Evidence limits
- This was a public artifact and source-evidence audit, not a penetration test.
- No authentication bypass, mutation, load, malware, or destructive test was attempted.
- No live Generator Lab session was opened because the running Lab is intentionally protected.
- The audit did not independently rerun the V1 unit, integration, accessibility, or Lighthouse
commands; it distinguishes the public report's claims from checks repeated in this audit.
- Public screenshots support visual and responsive observations only. They do not establish full
WCAG 2.2 AA conformance, assistive-technology behavior, production Core Web Vitals, or real
booking completion.