Chrome Extension
Edge Add-on
QA Audit Passed (31/31 Gates)
Official technical audit, permission scope verification, and 31-gate functional test matrix for Who Is Watching.
This technical docket documents the architectural boundaries, permission scope audit, and functional QA test cases verified for Who Is Watching.
Live vendor detection on the current page
Surfaces tracking IDs from requests and cookies
Activity timeline and identity graph
100% Local Browser Storage (chrome.storage.local / IndexedDB). MV3 Least-Privilege Verified · Zero External Telemetry (0 Outbound Calls).
See who is tracking you on any page — analytics, ad-tech, and identity vendors, with the IDs they set. 100% local. No account.
| Attribute | Specification | Verification Standard |
|---|---|---|
| Host Surface / OS | Google Chrome & Microsoft Edge (Manifest V3) | Platform Manifest & Surface Gate |
| Runtime Execution | Chromium MV3 Service Worker + Side Panel / Local Storage Sandbox | Sovereign Execution Sandbox |
| Data Residency | 100% Local Browser Storage (chrome.storage.local / IndexedDB) | Zero Unintended Outbound Data Transit |
| Permissions / Scopes | sidePanel, tabs, activeTab, scripting, storage, webRequest |
Strict Least-Privilege Manifest Audit |
| Security Classification | MV3 Least-Privilege Verified · Zero External Telemetry (0 Outbound Calls) | 864zeros Radical Transparency Standard |
| QA Test Pass Rate | 31 / 31 Gates Passed (100%) | Deterministic Pre-Release QA Checklist |
The following 31-gate verification suite was executed against the production artifact (who-is-watching/QA_CHECKLIST.md):
| Test ID | Assertion & Verification Objective | Verification Gate | Result |
|---|---|---|---|
| QA-0.1 | Manifest MV3 Compliance: manifest.json is strictly MV3, declares sidePanel, tabs, activeTab, scripting, storage, webRequest. |
§0 — Pre-Flight Package & Asset Integrity Gate | PASS |
| QA-0.2 | Zero Collisions / Forbidden Keys: No update_url, no developer key, author set to "864zeros LLC". |
§0 — Pre-Flight Package & Asset Integrity Gate | PASS |
| QA-0.3 | Graphic Asset Preservation (Rule 2): Production-grade icons present at icons/icon16.png, icons/icon48.png, icons/icon128.png. |
§0 — Pre-Flight Package & Asset Integrity Gate | PASS |
| QA-0.4 | Clean Repository Tree: Zero .crx, .pem, node_modules, or temporary files. |
§0 — Pre-Flight Package & Asset Integrity Gate | PASS |
| QA-1.1 | Chrome Unpacked Load: Open chrome://extensions → Developer mode ON → **Load unpacked** → select LLC-DIV-3-FACTORY/extensions/who-is-watching. — Loads with 0 errors in Chrome; background webRequest listener active. |
§1 — Dual Browser Load & Surface Gate (Chrome & Edge) | PASS |
| QA-1.2 | Edge Unpacked Load: Open edge://extensions → Developer mode ON → **Load unpacked** → select LLC-DIV-3-FACTORY/extensions-edge/who-is-watching. — Loads cleanly without manifest warnings. |
§1 — Dual Browser Load & Surface Gate (Chrome & Edge) | PASS |
| QA-1.3 | Side Panel Invocation: Click toolbar action button on Chrome and Edge. — Side panel (sidepanel/index.html) opens immediately. Header shows [OIA] Who Is Watching. |
§1 — Dual Browser Load & Surface Gate (Chrome & Edge) | PASS |
| QA-1.4 | UI Brand Hierarchy: Radar/surveillance audit theme, vendor category badges, zero console errors. | §1 — Dual Browser Load & Surface Gate (Chrome & Edge) | PASS |
| QA-2.1 | Options Page Launch: Open options via cog or context menu (options/options.html). |
§2 — Command & Control (RULE-001 Options & Settings Gate) | PASS |
| QA-2.2 | Verified Platform Pill: On Edge: Displays Microsoft Edge Add-on · Verified header pill with Edge Wave emblem. — On Chrome: Displays on-brand OIA verification header. |
§2 — Command & Control (RULE-001 Options & Settings Gate) | PASS |
| QA-2.3 | RULE-001 Mandatory Sections Present: Section 1: How to Use (4 numbered steps: Browse Normally, Open Inspector, View Vendor Fingerprints, Export Audit). — Section 2: Features & On-Device Vendor Signature Catalog. — Section 3: Data Management (detected trackers count + clear log button). — Section 4: Platform Craftsmanship Footer (Designed for Microsoft Edge / Chrome Extension). |
§2 — Command & Control (RULE-001 Options & Settings Gate) | PASS |
| QA-2.4 | Store Review Link Routing: Re-routes to Chrome Web Store on Chrome, Edge Add-ons on Edge. | §2 — Command & Control (RULE-001 Options & Settings Gate) | PASS |
| QA-2.5 | Canonical Cross-Link: Platform footer links back to canonical landing page: https://864zeros.com/products/who-is-watching.html. |
§2 — Command & Control (RULE-001 Options & Settings Gate) | PASS |
| QA-3.1 | Tracker Detection: Navigate to an ad-heavy website (e.g. major news portal). — Side panel dynamically detects tracking domains (analytics, ad-tech, data brokers, telemetry). | §3 — Core Product Workflow & Dogfood Execution | PASS |
| QA-3.2 | Vendor Categorization: Inspect vendor breakdown cards. — Vendors properly categorized (Advertising, Site Analytics, Identity Resolution, Social Tracking). | §3 — Core Product Workflow & Dogfood Execution | PASS |
| QA-3.3 | Tracking ID Extraction: Inspect vendor details accordion. — Surfaces concrete cookie values, query parameter IDs (e.g. gclid, fbclid, user sync IDs) without redacting them from the operator. |
§3 — Core Product Workflow & Dogfood Execution | PASS |
| QA-3.4 | Live Activity Timeline: Browse across 3 pages on the site. — Network requests update in real-time; vendor frequency counter increments. | §3 — Core Product Workflow & Dogfood Execution | PASS |
| QA-3.5 | Markdown Audit Report: Click **Export Privacy Audit (.md)**. — Formatted audit report downloads with domain name, timestamp, complete vendor table, and tracking payload details. | §3 — Core Product Workflow & Dogfood Execution | PASS |
| QA-4.1 | Network Tab Audit: Open DevTools → Network tab while inspecting tracker traffic. — Exactly **0** outbound calls to 864zeros servers. The tracker catalog is 100% packaged inside the extension. | §4 — Sovereign Local-First & Zero-Cloud Boundary Gate | PASS |
| QA-4.2 | Offline Operation: Disconnect network; inspect previously saved vendor logs and export reports. — Operates 100% offline. | §4 — Sovereign Local-First & Zero-Cloud Boundary Gate | PASS |
| QA-4.3 | Local Storage Scope: Audit history persisted strictly in chrome.storage.local. |
§4 — Sovereign Local-First & Zero-Cloud Boundary Gate | PASS |
| QA-5.1 | Build-Kit Execution: Run node 864z-build-kit/tools/extension/transform-edge.cjs who-is-watching. — Returns exit code 0; produces all required Edge Add-on artifacts. |
§5 — Cross-Platform Transformation & Store Artifacts Gate | PASS |
| QA-5.2 | Promo Asset Render: Verify dist/edge/who-is-watching-edge-promo-440x280.png exists and renders clean 440×280 visual. |
§5 — Cross-Platform Transformation & Store Artifacts Gate | PASS |
| QA-5.3 | Submission ZIP: Verify dist/edge/who-is-watching-edge-v1.0.0.zip exists (≤ 200 KB). |
§5 — Cross-Platform Transformation & Store Artifacts Gate | PASS |
| QA-5.4 | Partner Center Docket: Inspect dist/edge/who-is-watching-edge-listing.md. Short description is strictly ≤ 132 characters. |
§5 — Cross-Platform Transformation & Store Artifacts Gate | PASS |
| QA-6.1 | Product Page Top Hero: Visit https://864zeros.com/products/who-is-watching.html. — Top hero displays both [Chrome Extension] and [Edge Add-on] badges. |
§6 — Web Presence, Dual Badges & SEO/GEO Gate | PASS |
| QA-6.2 | Dual Store CTAs: Top hero renders both [Add to Chrome] and [Get for Edge] action buttons. |
§6 — Web Presence, Dual Badges & SEO/GEO Gate | PASS |
| QA-6.3 | Catalog Grid Card: Visit https://864zeros.com/products/. — Who Is Watching tile displays dual platform badges ([Chrome Extension] + [Edge Add-on]). |
§6 — Web Presence, Dual Badges & SEO/GEO Gate | PASS |
| QA-6.4 | Schema.org JSON-LD: Structured data declares "operatingSystem": "Google Chrome, Microsoft Edge". |
§6 — Web Presence, Dual Badges & SEO/GEO Gate | PASS |
| QA-7.1 | Demand-of-One Test: Does the operator inspect suspect sites using Who Is Watching? | §7 — Dogfood & Radical Transparency Verdict | PASS |
| QA-7.2 | Zero Known Defects: All tests passed with 0 unhandled exceptions. | §7 — Dogfood & Radical Transparency Verdict | PASS |
To verify that Who Is Watching cannot exfiltrate user content or exceed its declared operational boundary, the production package is locked to the following manifest and runtime constraints:
// Verified Manifest & Runtime Boundary (who-is-watching v2.1.6)
{
"product": "Who Is Watching",
"surface": "Google Chrome & Microsoft Edge (Manifest V3)",
"runtime": "Chromium MV3 Service Worker + Side Panel / Local Storage Sandbox",
"dataResidency": "100% Local Browser Storage (chrome.storage.local / IndexedDB)",
"declaredPermissions": ["sidePanel","tabs","activeTab","scripting","storage","webRequest"],
"externalTelemetryEndpoints": 0,
"thirdPartyAnalyticsSdks": 0
}Our Market Gap Intelligence engine analyzed verified 1-star and 2-star reviews across Opaque Ad-Blockers & Telemetry-Heavy Privacy Extensions and re-engineered Who Is Watching from first principles so your workflow never hits those walls again.
"Several famous tracker-blocker extensions were caught phoning home user clickstreams to marketing analytics subsidiaries."
100% local on-device tracker & vendor inspection—Who Is Watching has zero backend servers and makes zero outbound network calls.
"Standard blockers show a meaningless number on the icon without telling me which ad-tech vendor set a persistent ID cookie or pixel on the page."
Exposes the exact analytics, ad-tech, and identity-resolution vendors active on the current tab alongside the concrete tracking IDs and cookies they set.
"When auditing a vendor site for GDPR/FERPA compliance, I have to screenshot DevTools manually to prove third-party tracker firing."
One-click structured HTML and Markdown forensic audit report export documenting every detected vendor, request timeline, and identifier.
Visual and content assets are powered by custom-trained LoRA models and on-device training pipelines, and founders can trigger full product builds via cli2voip voice or Telegram directly into cli2cli.
Architected the zero-cloud execution boundary for Who Is Watching, locking runtime permissions to sidePanel, tabs, activeTab, scripting, storage, webRequest with zero external CDNs or telemetry endpoints. Founders can trigger full product builds via cli2voip voice or Telegram directly into cli2cli.
Defined the single-purpose product wedge for Who Is Watching (OIA pillar) from Market Gap Intelligence and User Frustration Radar signals, stripping onboarding bloat so the primary workflow completes in under 3 clicks inside the FHG Warm Parchment surface.
Assembled Who Is Watching from battle-tested 864z-build-kit Feature Bricks (agent-dom-scraper, accordion-record-v1, agent-markdown-converter) and wired its deterministic interactive HTML sandbox, W3C WebMCP discovery tools, and cli2voip voice / Telegram into cli2cli build orchestration.
Executed adversarial packet-trace and permission-boundary stress tests against Who Is Watching v2.1.6, certifying 31/31 QA verification gates with 0 bytes of unintended outbound data transit.
Translated the 3 real user pain statements for Who Is Watching into RULE-017 zero-price walkthrough transcripts and accessible captions, with visual and content assets powered by custom-trained LoRA models and on-device training pipelines.
[Quick Overview Short 1 (00:00.0–00:08.9) · 0.0s–8.9s]: Tired of auditing third-party trackers and identity vendors on websites getting locked behind monthly subscriptions and external cloud portals?
[Quick Overview Short 2 (00:08.9–00:14.6) · 8.9s–14.6s]: With Who Is Watching, Named Vendor & Category Attribution runs right where you already work.
[Quick Overview Short 3 (00:14.6–00:24.6) · 14.6s–24.6s]: Exposes Concrete Tracking Cookies & Pixel IDs and One-Click Forensic HTML & Markdown Audit Report—100% under your own custody.
[Quick Overview Short 4 (00:24.6–00:34.4) · 24.6s–34.4s]: Software that lives where you do. No accounts, no tracking, and zero cloud rent—at 864zeros.com.
[Full Product Demo 1 (00:00.0–00:08.6) · 0.0s–8.6s]: Need a better way to handle auditing third-party trackers and identity vendors on websites, without handing your data to another monthly cloud landlord?
[Full Product Demo 2 (00:08.6–00:19.6) · 8.6s–19.6s]: Watch Who Is Watching in action: Translates obscure tracking domains into plain-English company names across Ad-Tech, Session Recording, Fingerprinting, and Analytics categories.
[Full Product Demo 3 (00:19.6–00:36.8) · 19.6s–36.8s]: See the actual persistent identifier keys and pixel IDs set in your browser during the session—not just a vague counter. Plus, export a timestamped compliance and security report of every tracker detected on a page for GDPR, FERPA, or vendor procurement audits.
[Full Product Demo 4 (00:36.8–00:46.1) · 36.8s–46.1s]: Unlike commercial tracker extensions owned by ad conglomerates, Who Is Watching runs 100% on your device with zero outbound network calls.
[Full Product Demo 5 (00:46.1–00:55.9) · 46.1s–55.9s]: Software that lives where you do. No accounts, no tracking, and zero cloud rent—at 864zeros.com.
Artifact Identification: who-is-watching (v2.1.6) · Pillar: OIA. All 31 verification gates passed and stamped by 864zeros LLC engineering board.