Mobkoi engagement requests check the landing tag profile.

Advisory checks for the inspected Mobkoi landing-tag 1.0.0 query sender on three exact engagement routes. The separate VAST impression, click and video collectors remain uncovered.

What this pack matches

Hosts: events.mobkoi.com
Paths: /track/engagement_session_start, /track/engagement_page_in_view, /track/engagement_buffer_flush
Vendor docs: one-tag.mobkoi.com/tag.min.js

Rules

Codes are stable. A finding in CI, MCP, or the playground lands on the same id.

Field	Required	What it checks	Rule ids	Source
`sdk_event`	optional	Path-derived sender branch. A query parameter cannot change the selected path branch. Presence diagnostic severity: warning.		docs
`deid`	recommended	The inspected sender emits Date.now().toString(36) plus a base36 random suffix. This is a producer spelling check, without uniqueness, length, timestamp recovery or receiver acceptance claims. Presence diagnostic severity: warning.	`vendor.mobkoi-engagement.param.deid.missing` `vendor.mobkoi-engagement.param.deid.empty` `vendor.mobkoi-engagement.param.deid.invalid`	docs
`iid`	optional	Opaque impression reference copied from mbiid or session storage. The serializer omits null/undefined values, and this pack does not invent receiver-side presence, value or account rules. Presence diagnostic severity: warning.		docs
`asp`	recommended	Page-in-view sender copies location.href. Check a submitted absolute URL without requiring HTTPS, stripping query data or narrowing the scheme. Applies when {"kind":"all_values_in","params":["sdk_event"],"values":["engagement_page_in_view"]}. Presence diagnostic severity: warning.	`vendor.mobkoi-engagement.param.asp.missing` `vendor.mobkoi-engagement.param.asp.empty` `vendor.mobkoi-engagement.param.asp.invalid`	docs
`isl`	recommended	The page-in-view sender serializes its Boolean landing flag as true or false. Other events do not inherit this field contract. Applies when {"kind":"all_values_in","params":["sdk_event"],"values":["engagement_page_in_view"]}. Presence diagnostic severity: warning.	`vendor.mobkoi-engagement.param.isl.missing` `vendor.mobkoi-engagement.param.isl.empty` `vendor.mobkoi-engagement.param.isl.invalid`	docs
`rt`	recommended	The inspected page-in-view sender has three internal route branches. This is a version-scoped producer advisory rather than a closed receiver-wide event vocabulary. Applies when {"kind":"all_values_in","params":["sdk_event"],"values":["engagement_page_in_view"]}. Presence diagnostic severity: warning.	`vendor.mobkoi-engagement.param.rt.missing` `vendor.mobkoi-engagement.param.rt.empty` `vendor.mobkoi-engagement.param.rt.invalid`	docs
`top`	recommended	The buffer sender serializes accumulated Date.now differences in milliseconds. Preserve zero, negative clock changes and exponent notation; do not impose a positivity, integer precision or session-duration bound. Applies when {"kind":"all_values_in","params":["sdk_event"],"values":["engagement_buffer_flush"]}. Presence diagnostic severity: warning.	`vendor.mobkoi-engagement.param.top.missing` `vendor.mobkoi-engagement.param.top.empty` `vendor.mobkoi-engagement.param.top.invalid`	docs
`sr`	recommended	The inspected buffer sender has three internal flush reasons. The advisory applies only to this source profile. Applies when {"kind":"all_values_in","params":["sdk_event"],"values":["engagement_buffer_flush"]}. Presence diagnostic severity: warning.	`vendor.mobkoi-engagement.param.sr.missing` `vendor.mobkoi-engagement.param.sr.empty` `vendor.mobkoi-engagement.param.sr.invalid`	docs
`method`	required	Both navigator.sendBeacon(url) and the fallback fetch(url,{method:POST,keepalive:true}) use POST. No content-type, body, header or credentials requirement is inferred. Complete HTTP capture contract. Presence diagnostic severity: warning.	`vendor.mobkoi-engagement.http.method.missing` `vendor.mobkoi-engagement.http.method.empty` `vendor.mobkoi-engagement.http.method.invalid`	docs

Validate a payload

pixellint validate url "$ARTIFACT" --rulepack vendor/mobkoi-engagement

Try this failing payload in the playground. An example with a validation finding.

https://events.mobkoi.com/track/engagement_session_start?iid=opaque%2Fclick%2B1

cargo install pixellint · npm install pixellint