test(proof): report bounded Axe findings

[bizzybee90]

What changed

• Preserve only Axe rule ID, severity and affected-node count on the branded in-memory proof error.
• Include that bounded receipt in the existing sanitized route-failure diagnostic.
• Reject oversized finding sets and add adversarial non-echo coverage.

Why

The governed staging proof now reaches authenticated Home but stops at axe_accessibility_failed. The existing log intentionally omits the rule, leaving no safe basis for a source repair. This change reveals the minimum non-sensitive rule metadata needed to make the next repair evidence-based.

Safety

No DOM text, selector, HTML, URL, credential, screenshot or customer data is retained or logged. Unknown shapes and more than 128 findings fail closed. No application runtime, schema, provider, production or credential behavior changes.

Verification

• git diff --check
• Node syntax checks for both changed files
• dependency-free focused diagnostic replay
• CodeRabbit CLI exact-diff review: 0 issues
• post-implementation security audit: 0 findings

Full dependency and CI parity is intentionally delegated to protected cloud checks to keep the Mac light.

Summary by CodeRabbit

• Bug Fixes
  • Accessibility audit failures now include clearer, sanitized diagnostic details in route-failure reports.
  • Network and accessibility failure reports now use an updated schema when diagnostic information is available.
  • Excessive accessibility findings are safely limited to prevent oversized reports.
• Security
  • Diagnostic output is sanitized to avoid exposing sensitive content.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e874a304-9b13-471e-95a5-ebe674ec4167

📥 Commits

Reviewing files that changed from the base of the PR and between 4c2c98f and fa9a602.

📒 Files selected for processing (2)

• scripts/product-proof-cloud-playwright.mjs
• scripts/product-proof-cloud-playwright.test.mjs

---

📝 Walkthrough

Walkthrough

The Playwright runner now preserves normalized Axe failure details, limits excessive findings, and adds sanitized Axe diagnostics to schema version 2 route-failure receipts. Tests verify violation, incomplete-result, sensitive-content, and entry-limit behavior.

Changes

Axe route diagnostics

Layer / File(s)	Summary
Axe capture and normalization scripts/product-proof-cloud-playwright.mjs	Axe results reject more than 128 violations or incomplete findings. Accessibility errors store normalized finding details in route-scoped metadata.
Route-failure receipt integration scripts/product-proof-cloud-playwright.mjs, scripts/product-proof-cloud-playwright.test.mjs	Route-failure receipts include sanitized axe_failure diagnostics and use schema version 2 when network or Axe diagnostics exist. Tests verify normalized fields, sensitive-content exclusion, and excessive-result rejection.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ProductProofRunner
  participant AxeAudit
  participant RouteFailureReceipt
  ProductProofRunner->>AxeAudit: run accessibility audit
  AxeAudit->>ProductProofRunner: return normalized failure details
  ProductProofRunner->>RouteFailureReceipt: include axe_failure diagnostics
  RouteFailureReceipt->>ProductProofRunner: return schema version 2 receipt

Loading

Possibly related PRs

• bizzybee90/bizzybee-app#381: Extends the same product-proof runner and tests with detailed Axe diagnostics.
• bizzybee90/bizzybee-app#424: Adds related route-failure diagnostic and schema-versioning behavior.
• bizzybee90/bizzybee-app#441: Modifies the same route-failure receipt diagnostics for network failures.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: reporting bounded Axe findings in proof diagnostics.
Description check	✅ Passed	The description clearly covers the purpose, scope, exclusions, safety constraints, and verification, but it does not follow all template headings.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/diagnose-home-axe-20260809

---

_{Comment @coderabbitai help to get the list of available commands.}