# Grax 1.5.4 validation report

## Build identity

- Manifest: Chrome Manifest V3
- Version: 1.5.4
- Minimum Chrome: 121
- DNR architecture: compressed dynamic-only native rules
- Packaged filter rules: 6,748
- Runtime compatibility policies: 194
- Enabled managed dynamic rules: 6,942
- Redirect compatibility policies: 139
- Regex rules: 39
- Logical source coverage: 49,182 filters
- Static `rule_resources`: none
- Runtime scripts: three storage-driven registrations at `document_start`

## Compatibility policies

- Grok/X/Twitter/Twimg entity allowance: priority 975,000.
- Claude/Anthropic entity allowance: priority 976,000.
- DeepSeek application family allowance: priority 977,000.
- Authentication, payment, WAF, and CAPTCHA infrastructure allowance: priority 980,000.
- Claude, DeepSeek, and verification-frame registration exclusions are present.
- No CSP response-header mutation is used.

## Recursive proxy validation

- Lazy installation before confirmed mock/failure.
- Arbitrary deep callable chains remain non-thenable and fail-silent.
- Direct and `Function.prototype.toString.call` signatures return exactly `function () { [native code] }` for generated stubs.
- Genuine native functions retain native signatures.
- Synthetic deep-property descriptors are configurable, non-enumerable, writable, and callable.
- Existing real SDK objects are preserved.
- Original `Function.prototype.toString` is restored on pause.
- Tracking-related errors and unhandled rejections are handled without console output.
- Claude/native security contexts short-circuit before shim installation.

## Automated validation passed

- Manifest schema, permissions, dynamic registration, web-accessible mocks, and JavaScript/Python syntax.
- All 6,748 packaged rules, 39 regex rules, ID ranges, priorities, conditions, quotas, and metadata hashes.
- Background lifecycle:
  - enabled: 3 registered scripts and 6,942 managed dynamic rules;
  - site pause: 2 immediate session bypass rules;
  - global pause: 0 registered scripts and 0 managed rules;
  - global resume: 3 registered scripts, 6,942 rules, and immediate reinjection.
- Chromium 144 YouTube/Googlevideo trusted runtime.
- Chromium 144 Grok/X trusted runtime.
- Chromium 144 Filma24 playback and hostile destination containment.
- Chromium 144 WAF challenge and embedded-challenge isolation.
- Chromium 144 kill-switch and Cloudflare application-shell compatibility.
- Chromium 144 recursive compatibility and native-signature masking.
- Chromium native Manifest V3 packing with the existing Grax signing identity.

The managed test environment could not resolve the public Claude or DeepSeek hosts, so authenticated live sessions were not executed. Their injection exclusions and network policies were validated directly from the registered-script and generated-DNR runtime state, while the proxy and WAF behavior was exercised in Chromium 144.

## Preservation audit

The validator compares 101 protected resources against the final v1.5.3 release. All hashes match, including the complete `page-guard.js`, `content.js`, Filma24 pop-under bundle, all four packaged filter bundles, popup/options UI, assets, cosmetic data, filter sources, and vendor code.
