[EquityBot]

Summary

Works through the monthly evidence check in #26: every flagged page was read and its entry's claims compared with it. Two entries really changed, and the channel check stops reporting addresses that are on the page but hidden.

Entries whose substance changed

• lead-lists-au: the privacy policy now points to a new Privacy Requests page (updated 28 October 2026), which gives suppressions@leadlists.com.au. The register had suppression@, without the s. The page also gives a postal address in Chadstone, now a channel.
• dymocks-au: www.dymocks.group now redirects to the policy on www.dymocks.com.au, which names Dymocks Pty Ltd (ABN 64 074 571 083, active on ABN Lookup) and privacy@dymocks.com.au instead of Dymocks Holdings Pty Ltd and privacy@dymocks.group. The postal address is unchanged.

CI will flag both address changes as warnings; both were checked on the businesses' own pages.

Hash updated, claims unchanged: canva-au (Canva published a new version later on 2 November; a sentence diff shows only its EEA representative's address changed, which the register does not record), equifax-marketing-au, everyday-rewards-au (2 pages), lead-lists-au, michael-page-au, records-finder-au (4 pages).

Evidence removed (claims still match in a browser; docs/provenance.md records why):

• Coles (2 pages) and Harvey Norman now answer a plain fetch with a script-only bot check.
• Equifax's contact page and credit ban form show the current date as a field example ('E.g., 02/11/2026'), so their hash changes every day. Records Finder's Australian search page prints its database update date, which changed within the day.

Channel check (xtask)

 email_on_pages(address, pages)
-  pages = evidence pages: raw HTML + main text
+  pages = evidence pages: raw HTML + main text + Cloudflare-protected addresses
+  match whole addresses only: notprivacy@x.au no longer counts as privacy@x.au
+  if an address is missing: also fetch the entry's sources that have no evidence record
   missing only when every page was searched

• Aussie Broadband, CareerOne, Hays, ManpowerGroup, Robert Half and smrtr publish their addresses through Cloudflare's email obfuscation (data-cfemail), which the check now decodes.
• Thryv's address is on its privacy policy, and Chandler Macleod's and Peoplebank's on the RGF Staffing policy. These are sources with no evidence record (Thryv's sits behind a bot check), so the check now searches them before reporting an address as missing.

Drift check

• An evidence page that answers 401, 403 or 429 now goes to the workflow log instead of the issue's Failing list, as web forms already do. Runner-only bot blocks (Bunnings, CareerOne, The Iconic last month) no longer hold the issue open. A 404, 410, 5xx, timeout or near-empty page still goes to the issue.
• Each run saves every HTML page's main text, one sentence per line, as a 90-day evidence-text artifact, and the issue links to the run. A changed page can then be diffed against an earlier run's copy.

Closes #26.

Evidence

• Before: a local cargo run -p xtask -- evidence-drift registry/au on main reported the 13 changed pages, 5 failing pages and 10 email channels 'on none of the entry's evidence pages'.
  After: the same run on this branch reports no channel problems; addresses that sit only on bot-checked pages (Dymocks, Lead Lists, Thryv, Harvey Norman) go to the log as inconclusive.
• New hashes were taken twice and matched.
• cargo fmt --check, cargo clippy --locked --all-targets -- -D warnings and cargo test --locked --workspace (136 passed) pass, as do cargo build --locked --release and registry check (80 entries, 0 errors, 0 warnings). With whole-address matching, decoding and the source search disabled, the 4 new or extended tests fail; with refused pages classed as failures, a_page_refused_to_scripts_is_not_a_failure fails. A test checks that the saved text rejoins to the hashed text. actionlint passes on the workflow.
• A full local drift run with the text directory saved 94 page files; it reported only Canva (its later revision, now rehashed) and a dropped Qantas connection.

Merge danger

Door: two-way. Blast radius: register data, monthly check

Users' requests to Lead Lists and Dymocks go to the new addresses. The monthly check fetches some extra pages, but only for entries with an address missing from their evidence pages. An evidence page that keeps answering 401, 403 or 429 is no longer reported in the issue, only in the workflow log, so its hash goes unchecked until someone reads the log.

Unverified

• Bunnings, CareerOne and The Iconic answer GitHub's runners with 403 but read fine (with matching hashes) from an Australian connection; they will now appear only in the workflow log.
• The artifact upload and the issue's run link have not run on GitHub yet; the first scheduled or manual run will exercise them.
• Local runs also saw WINR serve a captcha and Myer, Qantas and Telstra drop connections; all four read fine from GitHub on 1 November and are unchanged here.
• Why the other 9 updated pages changed is unknown: only hashes were stored, not old page text. From the next run the artifact keeps it.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 40 complexity · 0 duplication

Metric	Results
Complexity	40
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

✅ No blocking issues noticed

No blocking implementation findings were identified. The review agents found no logic, security, or quality issues in the changed files.

One acceptance criterion lacks a dedicated automated test for the updated registry data. Coverage metrics are also unavailable, so production-line coverage cannot be independently verified.

Test suggestions

• Decode Cloudflare data-cfemail and protected-link addresses.
• Match addresses in raw markup, decoded entities, and mailto links.
• Reject addresses embedded in longer local parts, domains, or percent-encoded values.
• Search source pages that have no evidence record.
• Treat missing addresses as inconclusive when any source page cannot be searched.
• Validate the updated registry entity and channel data for Lead Lists and Dymocks.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Validate the updated registry entity and channel data for Lead Lists and Dymocks.

Low confidence findings

• Add an automated test covering the updated registry entity and channel data. Coverage is unavailable in this review, so test execution should also verify the changed production paths where possible.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud