Exact pages, documented rights.

User direction narrows the research scope. It does not create blanket authorization to retrieve a retailer site.

What version 1 can access

Only one to five exact public HTTPS product-detail URLs entered by the user and confirmed at the market checkpoint. It does not discover candidates, follow affiliate redirectors, inspect arbitrary related pages, collect review corpora or call an unlicensed search provider.

Two checks before a product fetch

First, the source register must contain a current record for the exact normalized domain. That record names the access basis, terms URL, review date, permitted fields, caching rules, attribution, geographic limits, rate limit and accountable owner. Second, the current robots policy must permit retrieval of the exact product path. Both checks fail closed.

Runtime outcome

If rights are missing, expired or restrictive, or robots rules do not permit retrieval, the app does not fetch the product page. It returns Unable to verify, preserves the normalized user-supplied URL as unverified context and withholds a Go verdict and open action.

Controls

Every request re-resolves DNS, blocks private and reserved networks, pins an approved public address, validates TLS, limits redirects to three same-domain hops, caps response and header sizes and enforces deadlines. Retailer content is treated only as data. No instructions embedded in a page are followed.

Current register

The distributable default register contains no pre-authorized retailer domains. Deployment owners must complete legal and terms review before adding a source. This prevents user-supplied links from being treated as blanket permission while allowing documented sources to be compared without a search or scraping layer.