# The origin-verification method

The audit's central point is that "no third-party code" is a claim about the **wire**, not about the
repository. This is the method that proved it.

## What the probes showed

| Probe | Beacon references |
|---|---|
| `curl` with a default user agent | 0 |
| `curl` with a Chrome user agent | 0 |
| `Accept-Encoding: identity` or `gzip` | 0 |
| the local server | 0 |
| Playwright, **raw response body** | 0 |
| Playwright, **rendered DOM** | **1** |
| Playwright, **origins contacted** | `metatronmind.com`, `static.cloudflareinsights.com` |
| `navigator.serviceWorker.getRegistrations()` | `[]` (no service worker) |

The beacon was injected by Cloudflare at the edge, into browser sessions only.

## The checks after the fix

| Check on the deployed host | Result |
|---|---|
| injected elements (`script[src]`, `img[src]`, `link[href]` matching the beacon) | none |
| `[data-cf-beacon]` anywhere in the DOM | false |
| beacon entries in `performance.getEntriesByType('resource')` | none |
| beacon request events | none |
| third-party origins contacted | none (was one) |
| console errors | 0 (was exactly 1, the CSP refusal) |

Run on `shop.metatronmind.com/`, `shop.metatronmind.com/about` and the legacy
`metatronmind.com/store`.

## How to re-run it

Open the page in Chromium with a request listener and a DOM check, not with `curl`:

```js
const origins = new Set();
page.on("request", (r) => { try { origins.add(new URL(r.url()).origin); } catch {} });
await page.goto(url, { waitUntil: "networkidle" });
const beacon = await page.evaluate(() => ({
  elements: [...document.querySelectorAll('script[src*="cloudflareinsights"], img[src*="cloudflareinsights"], link[href*="cloudflareinsights"]')].length,
  attr: document.querySelector("[data-cf-beacon]") !== null,
  resources: performance.getEntriesByType("resource").filter((e) => e.name.includes("cloudflareinsights")).length,
}));
```

The allowed set is the page's own origin plus `https://js.stripe.com` on the checkout page only.
Anything else fails the audit and the claim comes off the page until it is true.