Technology collection notice verification

Requirement: REQ-QC-PROFILING. Technical support remains partial; legal and translation review are open.

The optional build/server entry creates an original public declaration of technology functions and activation instructions. It verifies an intact retained legal artifact and derives the actual provider, complete purpose set, public controller and pinned privacy document. A declaration-derived material service scope is mandatory. The builder rejects ungated services, indirect-only collection, nonoptional service storage, unassessed or specialized scope guards, malformed data, unsafe links and draft production use.

Package tests exercise all three function kinds, exact artifact tampering, rehashed declaration forgery against the independently verified artifact, complete supplied French labels, escaped HTML and static disclosure. Both consent factories exercise initial blocking, opening/closing without a grant, voluntary activation, withdrawal, migration from an older generic scope, GPC and a failing required receipt transport. Presentation changes produce another notice identity; material declaration changes require another service scope. The browser runtime graph excludes this optional build-time module and release verification.

The bundled website example uses the actual compiled runtime and native controls in on-demand mode. Site tests check no profile before a grant, untracked topic reading while off, preferences without permission, discarded drafts, a saved grant, session reload, withdrawal/cleanup and unavailable preference storage. The public static notice is present without JavaScript. Chromium inspection covered desktop, 390px and 320px, with no horizontal page overflow at 320px. Opening the disclosed controls left the profile off; an explicit saved grant counted only later topic openings, reload preserved that count, and rejection returned the profile to off. Platform coverage remains limited to that inspected Chromium configuration.

These tests cover declared cooperative browser work. They do not prove notification timing on an adopter’s site, person-level consent, necessity, backend propagation, ordinary versus specialized classification, reviewed French/legal text or a complete jurisdiction pack. Ordinary receipts do not automatically archive the supplemental descriptor. The host retains it and any required presentation evidence separately.

npm run build
node --test packages/notabenda/test/technology-collection.test.mjs
node site/build.mjs
node --test site/test/technology-collection.test.mjs
python3 scripts/regulatory.py --check