feat(privacy): block Web Audio fingerprinting by default

[seonghobae]

Replaces historical #236 after that stacked branch diverged from its live predecessor. This Draft preserves only the reviewed Web Audio privacy slice on current exact predecessor feat/stealth-profile-coherence@ba364f63a5cfe61270b1b4553102deaf98724382 and has subsequently been hardened on the same canonical branch without force-pushing history.

Buyer-visible boundary

OriginWeave Agent and Crawler privacy profiles default-deny page construction of silent Web Audio graphs used for device re-identification while ordinary <audio> and <video> media playback remains available. The policy remains explicit-origin and fail closed rather than attempting anti-bot/CAPTCHA/access-control evasion.

Current exact stack truth

• live prerequisite/base: feat/stealth-profile-coherence@ba364f63a5cfe61270b1b4553102deaf98724382;
• exact current head: feat/block-web-audio-fingerprinting-v3@a769f484e2c110e0523b3b28cd21573f43867562;
• fresh compare: 14 commits ahead / 0 behind, with merge base exactly the live prerequisite;
• GitHub reports this PR open, Draft, and mergeable;
• current formal review inventory: empty; and
• current inline review-thread inventory: empty.

The original replay head 4456f6cde4d7c74fe5d2e82cf8d8b8992f861be7 and historical #236 head 5abd12495e8c29b60d26c143b0358377acbf0e1e are lineage only and are not promoted as current-head evidence.

Implemented boundary

The current 19-file semantic delta includes:

• Rust WebAudioFingerprintPolicy with an empty default allowlist;
• exact canonical-origin grants only, bounded to 128 unique origins;
• deterministic policy-rendered guard;
• Manifest V3 MAIN-world document_start, all-frame guard;
• blocking for AudioContext, OfflineAudioContext, AudioWorkletNode, and legacy webkit* aliases when present;
• fixed NotAllowedError denial behavior and stable audit reason;
• pinned-Chrome browser fixture covering top-level and child-frame probes;
• bounded in-trial protocol/cleanup handling with causal failure preservation;
• Rust policy contracts plus Python/browser regressions;
• ADR 0114, Web Audio privacy doctoring, CHANGELOG, docs indexes, and product-gap-baseline truth; and
• the OriginWeave-local MV3 workflow integration needed to execute/upload the Web Audio compatibility evidence.

Exact-current native evidence

On unchanged exact head a769f484e2c110e0523b3b28cd21573f43867562:

• CI run 33278168850: success;
• Manifest V3 Compatibility run 33278168852: success;
• the MV3 run identifies this exact head and exact prerequisite in its pull-request payload;
• no predecessor, historical replacement, skipped/cancelled, synthetic, status-only, or model-only result is promoted to current proof; and
• no qualifying independent approval is claimed.

Workflow-authority boundary

This branch currently modifies .github/workflows/mv3-compatibility.yml. Relative to the exact live prerequisite, that patch adds the Web Audio source/fixture paths, executes scripts/ci/run_web_audio_privacy.py, uploads web-audio-privacy.json, and updates the pinned actions/upload-artifact revision. Native GREEN evidence does not authorize that workflow mutation.

Protected-main AGENTS.md forbids this scheduled writer from altering OriginWeave workflows. The exact governance decision has therefore been routed to canonical workflow-authority issue #212 with current base/head and patch evidence. This writer has not removed, rewritten, adopted, approved, or bypassed the workflow delta. The governance owner must independently decide whether to authorize it or rehome/remove the workflow change without losing the product/browser regressions, then obtain fresh exact-head evidence.

Scope / safety

This slice does not bypass access control, CAPTCHA, consent, site policy, browser authority, secret/model authority, origin policy, or release controls and does not claim a signed production browser release. Keep Draft while prerequisite and workflow-authority dependencies remain active. Protected-main AGENTS.md and live GitHub governance remain authoritative; this scheduled writer does not merge, self-approve, force-push, destructively rebase, alter workflows/rulesets/secrets, weaken checks, tag, release, or publish.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head workflow-ownership finding remains valid and is now separated from #43's sandbox-helper repair. Exact head a769f484e2c110e0523b3b28cd21573f43867562 changes .github/workflows/mv3-compatibility.yml relative to live prerequisite feat/stealth-profile-coherence@ba364f63a5cfe61270b1b4553102deaf98724382: it expands trigger paths, executes run_web_audio_privacy.py, uploads web-audio-privacy.json, and changes the immutable actions/upload-artifact pin. Native GREEN on this branch proves the test lane can execute; it does not authorize a scheduled product writer to own workflow semantics.

Do not close or discard the Web Audio product/test delta. Keep this PR Draft and preserve its exact product evidence while the authorized workflow owner chooses the smallest canonical integration: either adopt the Web Audio lane into the reviewed MV3 workflow with an independently justified action pin, or factor a dedicated reusable/thin-caller path without duplicating browser authority. After the owner delta lands, non-destructively restack/adopt it and regenerate exact-head browser/CI/security evidence. No predecessor #43 workflow authorization transfers to this head.