fix(proof): bound accessibility attestation size

[bizzybee90]

Purpose

Repair the governed product-proof accessibility privacy attestation for policy-valid large accessibility trees.

Included scope

• Preserve every sanitized accessibility node and its exact order.
• Attest each already-sanitized node independently, then attest the ordered list of fixed node digests.
• Add a proof-first 1,000-node regression that failed on exact base and passes after the repair.

Explicit exclusions

• No accessibility acceptance, screenshot sanitization, redaction, route, timeout, database, provider, or application change.
• No increase to the generic canonical JSON limit or the existing 5,000-node accessibility policy.
• No truncation, sampling, or omission of accessibility evidence.

Architecture placement

Current owner / directory: existing product-proof screenshot privacy sanitizer and its tests under scripts/.

Dependencies and duplicate-system check: reuses the existing HMAC and canonicalization primitives; no new evidence subsystem.

Security and tenancy impact

• Authentication / authorization: none.
• Tenant isolation: unchanged.
• Service-role impact: none.
• Provider / webhook impact: none.
• Secrets impact: none; raw node IDs, names, descriptions, values and forbidden values remain excluded.

Data impact

• Schema / migration / RLS / grant impact: none.
• Backfill, retention, or rollback: none; code rollback only.

Verification

• Behavioural tests: screenshot privacy, cloud Playwright and cloud-suite contracts pass; proof-first large-tree test failed before source change and passes after.
• CI / security review: scoped ESLint, TypeScript, syntax and diff checks pass. Fresh hosted exact-head gates and CodeRabbit are mandatory.

Release safety

• Deployment scope: no deployment in this PR; protected merge then private no-index preview and separately authorized governed proof.
• Monitoring / stop conditions: stop on any sanitization, HMAC, canonicalization, privacy, cleanup, writer/readback or final-gate failure.
• Rollback or containment: revert this commit; predecessor exact source fd99746c9fc4c50fab5b21952a8bccb890edea40, manifest 29257b0d0ce5b447d61195a526dc52ee4272dc092ccbf3ac84dd81e841327b58.

Documentation and generated files

• Docs / diagrams / ADR updates: none.
• Generated-file or lockfile justification: none.

Completion check

• Starts from current origin/main.
• No valuable work remains only in a dirty worktree, stash, or local-only branch.
• Source branch will be retired under branch policy after merge.
• No PR-size or branch-retention exception applies.

Policy exceptions (leave blank when none apply)

PR-size exception rationale:

Retained branch reason / owner / review date / maximum retention date:

Summary by CodeRabbit

• Security & Privacy

  • Strengthened accessibility-tree evidence with per-node integrity verification.
  • Added evidence metadata and node counts to improve attestation reliability.
  • Continued excluding node identifiers and restricted values from serialized accessibility data.

• Bug Fixes

  • Improved validation and handling of large accessibility trees, including trees with 1,000 nodes.
  • Improved detection of changes to node order and accessibility-tree contents.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ead68c1f-e571-4754-b8e4-1f1cbdd39f42

📥 Commits

Reviewing files that changed from the base of the PR and between d7bfa6b and 0d5c6ce.

📒 Files selected for processing (1)

• scripts/product-proof-screenshot-privacy.test.mjs

---

📝 Walkthrough

Walkthrough

The accessibility-tree sanitization flow now uses v2 node-based HMAC attestations. A regression test covers a 1,000-node tree, attestation validity, node retention, and privacy-safe serialization.

Changes

Accessibility tree attestation

Layer / File(s)	Summary
Node-based attestation flow scripts/product-proof-screenshot-privacy.mjs	Adds accessibilityTreeAttestation for per-node HMACs and changes sanitized-tree output to use the v2 attestation payload.
Large-tree regression coverage scripts/product-proof-screenshot-privacy.test.mjs	Tests sanitization of a 1,000-node tree, including node count, HMAC validity, order sensitivity, and exclusion of node IDs and forbidden values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• bizzybee90/bizzybee-app#381: Modifies the accessibility-tree sanitization and attestation behavior.
• bizzybee90/bizzybee-app#510: Shares the accessibility-tree capture, sanitization, and attestation flow.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: limiting accessibility attestation size.
Description check	✅ Passed	The description follows the required template and clearly documents scope, security, data impact, verification, release safety, and completion status.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-product-proof-accessibility-attestation-size-20260812

Note

This review was completed with usage-based billing: files reviewed beyond your plan's included limits are billed at $0.25/file. Track spend and usage in your billing settings.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/product-proof-screenshot-privacy.test.mjs`:
- Around line 375-378: Strengthen the assertions around the v2 attestation in
the tree test: recompute the expected aggregate from differentiated tree.nodes
and compare it with tree.attestation_hmac_sha256, then verify that reordering
the input nodes changes the attestation while sanitized node indexes retain the
original input order. Preserve the existing retention, digest-format, and
secret-redaction checks.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ecf2ad4a-f30a-4f55-8b62-43108c894fb4

📥 Commits

Reviewing files that changed from the base of the PR and between fd99746 and 1c53dd2.

📒 Files selected for processing (2)

• scripts/product-proof-screenshot-privacy.mjs
• scripts/product-proof-screenshot-privacy.test.mjs

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/product-proof-screenshot-privacy.test.mjs`:
- Around line 375-403: Strengthen the assertions around
sanitizeProductProofAccessibilityTree by deriving each expected node_hmac_sha256
from the raw nodes, then compare the complete ordered node sequence for both the
normal and reversed inputs. Build the v2 aggregate using the fixed raw-node
digests in reverse order and assert it differs from expectedAttestation,
ensuring node retention, per-node digest correctness, and digest-list ordering
are independently verified.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 817da1b9-4b72-49da-ad08-fbc7eeb0a3fb

📥 Commits

Reviewing files that changed from the base of the PR and between 1c53dd2 and d7bfa6b.

📒 Files selected for processing (1)

• scripts/product-proof-screenshot-privacy.test.mjs