Complete V1 RC deployment capability gates

docs/web/DEPLOYMENT.md

@@ -0,0 +1,36 @@
+# Web Blender Modeler V1 Deployment Contract
+
+The normative machine-readable contract is `deployment-contract.json`. A server is compatible only
+when every response, including errors and SPA fallbacks, preserves these headers:
+
+| Header | Required value |
+| --- | --- |
+| `Cross-Origin-Opener-Policy` | `same-origin` |
+| `Cross-Origin-Embedder-Policy` | `require-corp` |
+| `Cross-Origin-Resource-Policy` | `same-origin` |
+
+Production uses HTTPS. Loopback development may use `http://127.0.0.1`; `file://` is unsupported.
+Runtime assets are same-origin. A reverse proxy must not strip the isolation, range, cache, MIME or
+ETag headers.
+
+## Cache policy
+
+- `/` and `/index.html`: `Cache-Control: no-cache` so a deployment is revalidated.
+- `/engine-manifest.json`: `Cache-Control: no-cache` so engine identity is revalidated.
+- `/assets/*`: `Cache-Control: public, max-age=31536000, immutable`; Vite content hashes these names.
+- `/vendor/blender/*`: `Cache-Control: no-cache`; these stable URLs are verified by the engine manifest.
+- Other paths: `Cache-Control: no-cache` until a more specific content-addressed rule exists.
+
+The server must use the MIME map in the JSON contract. In particular, WebAssembly is
+`application/wasm`, JavaScript is `text/javascript; charset=utf-8`, and NanoVDB is
+`application/x-nanovdb`.
+
+## Range and validators
+
+`.wasm`, `.blend` and `.nvdb` accept a single `bytes` range. A valid range returns `206` with
+`Accept-Ranges`, `Content-Range`, `Content-Length` and a strong content SHA-256 ETag. An invalid or
+unsatisfied range returns `416`. An `If-Range` mismatch ignores the range and returns the complete
+resource with status `200`; partial bytes from a different revision must never be combined.
+
+Run `node tools/web/check-deployment-contract.mjs` for the static contract gate. Production HTTP
+behavior is a separate M6 acceptance gate and must exercise an actual server before release.

docs/web/deployment-contract.json

@@ -0,0 +1,67 @@
+{
+  "schemaVersion": 1,
+  "product": "Web Blender Modeler V1",
+  "browserScope": "Chromium",
+  "transport": {
+    "production": "https",
+    "localDevelopment": "http://127.0.0.1",
+    "fileProtocolSupported": false,
+    "sameOriginRuntimeAssets": true
+  },
+  "methods": ["GET", "HEAD"],
+  "responseHeaders": {
+    "allResponses": {
+      "Cross-Origin-Opener-Policy": "same-origin",
+      "Cross-Origin-Embedder-Policy": "require-corp",
+      "Cross-Origin-Resource-Policy": "same-origin"
+    },
+    "routes": [
+      {
+        "id": "entry-document",
+        "patterns": ["/", "/index.html"],
+        "cacheControl": "no-cache"
+      },
+      {
+        "id": "runtime-manifest",
+        "patterns": ["/engine-manifest.json"],
+        "cacheControl": "no-cache"
+      },
+      {
+        "id": "content-hashed-assets",
+        "patterns": ["/assets/*"],
+        "cacheControl": "public, max-age=31536000, immutable"
+      },
+      {
+        "id": "stable-engine-assets",
+        "patterns": ["/vendor/blender/*"],
+        "cacheControl": "no-cache"
+      },
+      {
+        "id": "fallback",
+        "patterns": ["*"],
+        "cacheControl": "no-cache"
+      }
+    ]
+  },
+  "mimeTypes": {
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".wasm": "application/wasm",
+    ".json": "application/json; charset=utf-8",
+    ".png": "image/png",
+    ".wav": "audio/wav",
+    ".blend": "application/octet-stream",
+    ".nvdb": "application/x-nanovdb"
+  },
+  "rangeRequests": {
+    "extensions": [".wasm", ".blend", ".nvdb"],
+    "unit": "bytes",
+    "singleRangeOnly": true,
+    "etag": "strong-sha256",
+    "satisfiedStatus": 206,
+    "unsatisfiedStatus": 416,
+    "requiredSatisfiedHeaders": ["Accept-Ranges", "Content-Range", "Content-Length", "ETag"],
+    "ifRangeMismatch": "return-full-200"
+  }
+}

docs/web/sbom.spdx.json

@@ -3,7 +3,7 @@
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
   "name": "blender-web-editor-sbom",
-  "documentNamespace": "https://blender-web.local/spdx/0ce47f13cb0c6d4aa08df7f3df6d81f63db9574c3cdac8a2ee6abc0cc6f8e91e",
+  "documentNamespace": "https://blender-web.local/spdx/e62e3ed568907b9c7d85050e4f2b6bd874d425cca768a0201c3c57cdd9ad9926",
   "creationInfo": {
     "created": "1970-01-01T00:00:00Z",
     "creators": [
@@ -2524,8 +2524,8 @@
     {
       "SPDXID": "SPDXRef-npm-node-modules-nanoid-2e287a9dc6ed",
       "name": "nanoid",
-      "versionInfo": "3.3.17",
-      "downloadLocation": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.17.tgz",
+      "versionInfo": "3.3.18",
+      "downloadLocation": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz",
       "filesAnalyzed": false,
       "licenseConcluded": "NOASSERTION",
       "licenseDeclared": "NOASSERTION",
@@ -2534,13 +2534,13 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/nanoid@3.3.17"
+          "referenceLocator": "pkg:npm/nanoid@3.3.18"
         }
       ],
       "checksums": [
         {
           "algorithm": "SHA512",
-          "checksumValue": "c502dfd00dc738c9601ead27db8eff2d1b80398981edd5c9fc3bc0c46bec4818a3e395ed052990c9cbbe17c3836c7c27b3f5f21596a0c8bd7e27439f7f0d44d2"
+          "checksumValue": "0d38383096c631691f8ba55915d36ddbf71a31b432e0ebbe3a9fe1250bc611672755fa00d5003ec7344a033c3d8c3ebe19538e798aff98872e0d276e83a17afb"
         }
       ]
     },
@@ -3292,7 +3292,7 @@
       "checksums": [
         {
           "algorithm": "SHA256",
-          "checksumValue": "3c65ff96cc15c9072d2517555484ccfd0009a2814d96faadcc5bd7b2e3458503"
+          "checksumValue": "e7b16da68885fe43f32ab7b3eeb2c037b4fd8bf54fe6d5e77049aa51e294b1fb"
         }
       ]
     },