# AcreSignal Sidecar Compliance Review Checklist

## Extension Scope

- [x] Manifest V3.
- [x] No `permissions` block.
- [x] No `<all_urls>` host permission.
- [x] Host permissions are limited to supported listing marketplaces.
- [x] No background service worker.
- [x] No external scripts.

## No-Scrape Controls

- [x] Reads only `window.location.href`.
- [x] Strips query string and hash before AcreSignal handoff.
- [x] Does not call `document.querySelector`.
- [x] Does not read `document.body.textContent`.
- [x] Does not use `XMLHttpRequest`.
- [x] Does not fetch marketplace URLs.
- [x] User manually enters price, acreage, parcel identity, geography, coordinates, and strategy.

## AcreSignal API Controls

- [x] Public market-score check uses stored aggregate ledger data only.
- [x] Public market-score check has rate limiting and thin-sample suppression.
- [x] Listing handoff normalizes user-supplied URL context.
- [x] Full reports, paid provider data, and artifacts require authenticated AcreSignal flows.
- [x] MCP payload copy is a user-triggered local clipboard action.

## Remaining External Release Steps

- [ ] Submit release-candidate package through Chrome Web Store developer account.
- [ ] Complete Google review and signing.
- [ ] Add final Chrome Web Store item ID to `CHROME_WEB_STORE_ITEM_ID`.