fix(proof): run Axe with CSP enforced

[bizzybee90]

Purpose

Restore the governed staging accessibility audit after the launch CSP correctly blocked the proof harness's inline Axe script tag.

Included scope

• Execute the lock-pinned axe-core source through Playwright's trusted evaluation channel.
• Keep the application CSP active and unchanged during the audit.
• Pin the exact two-step Axe install/audit sequence and prove the legacy inline tag path is never used.

Explicit exclusions

• No application UI, accessibility rule, route, CSP, network policy, timeout, acceptance threshold, evidence schema, credential, database, provider, or production change.
• No relaxation of Axe violations or incomplete findings.

Architecture placement

Current owner / directory:

• scripts/product-proof-cloud-playwright.mjs
• scripts/product-proof-cloud-playwright.test.mjs

Dependencies and duplicate-system check:

• Reuses the existing Playwright evaluator and the existing lock-pinned axe-core source. No new dependency or audit system.

Security and tenancy impact

• Authentication / authorization: unchanged.
• Tenant isolation: unchanged; the proof still uses its fixed two-context policy.
• Service-role impact: none.
• Provider / webhook impact: none.
• Secrets impact: none. Existing bounded Axe result normalization and redaction remain unchanged.

Data impact

• Schema / migration / RLS / grant impact: none.
• Backfill, retention, or rollback: none; rollback is a one-commit revert.

Verification

• Behavioural tests: proof-first regression failed on the old inline tag; focused Axe regression passes; complete cloud Playwright suite 232/232; full product-proof cloud suite 1,207 passed with one expected disposable-database skip.
• CI / security review: scoped ESLint, Node syntax checks, Prettier, git diff --check, and npm audit (zero vulnerabilities) passed. Fresh hosted protected checks and exact-head CodeRabbit review are required before merge.

Release safety

• Deployment scope: proof harness only. A protected merge must be followed by an exact successor preview and one governed staging proof rerun.
• Monitoring / stop conditions: stop on any head/base drift, failed protected check, unresolved review, failed isolation/cleanup, Axe finding, or evidence writer/readback failure.
• Rollback or containment: revert this commit; the failed proof already completed exact cleanup/recovery and published zero evidence artifacts.

Documentation and generated files

• Docs / diagrams / ADR updates: none; this restores the existing documented proof architecture.
• Generated-file or lockfile justification: none.

Completion check

• Starts from current origin/main.
• No valuable work remains only in a dirty worktree, stash, or local-only branch.
• Source branch will be retired under the branch policy after merge.
• Any PR-size or branch-retention exception is documented below, or neither applies.

Policy exceptions (leave blank when none apply)

PR-size exception rationale:

Retained branch reason / owner / review date / maximum retention date:

Summary by CodeRabbit

• Bug Fixes
  • Improved accessibility audit execution while preserving existing validation and result reporting.
  • Removed the need for script-tag injection permissions during audits.
  • Maintained surface-label forwarding and consistent audit failure handling.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5cc062cf-d60c-466c-b092-80326e7a0a45

📥 Commits

Reviewing files that changed from the base of the PR and between 98cc2b5 and 0a82f08.

📒 Files selected for processing (2)

• scripts/product-proof-cloud-playwright.mjs
• scripts/product-proof-cloud-playwright.test.mjs

---

📝 Walkthrough

Walkthrough

The Axe audit now injects and executes its pinned source through page.evaluate. Tests verify the two-stage evaluation flow and preserve surface-label forwarding and failure normalization.

Changes

Axe evaluation flow

Layer / File(s)	Summary
Evaluation-based Axe injection and validation scripts/product-proof-cloud-playwright.mjs, scripts/product-proof-cloud-playwright.test.mjs	The audit replaces addScriptTag with two page.evaluate calls. Tests verify source installation, audit execution, evaluation counts, surface-label forwarding, and failure normalization.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to 0a82f

This PR changes only the staging accessibility proof harness to run Axe under the existing CSP without altering application behavior or production configuration; no actionable merge-blocking risk remains after normal checks and review.

Possibly related PRs

• bizzybee90/bizzybee-app#381: Introduced the runProductProofAxeAudit implementation and its tests.
• bizzybee90/bizzybee-app#445: Also modifies the Axe audit implementation and tests.
• bizzybee90/bizzybee-app#481: Also modifies runProductProofAxeAudit and its tests.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CSP-related Axe execution fix in the proof harness.
Description check	✅ Passed	The description follows the repository template and provides complete scope, impact, verification, safety, and completion details.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-product-proof-axe-csp-20260813

---

_{Comment @coderabbitai help to get the list of available commands.}