Checkpoint web parity through Chromium input tasks

docs/status/M13-05B.md

@@ -0,0 +1,31 @@
+# M13-05B Status
+
+status: done  
+task: resource-specific CSP policy  
+updated: 2026-08-19 America/New_York  
+enablingTask: false  
+parityStateChange: false
+
+## Scope
+
+The deployment contract now separates same-origin policy for Worker, WASM, font, image and media
+resources. Chromium loaded same-origin Worker, WASM, image and media resources, and rejected data-image,
+blob-Worker and cross-origin connect attempts. WASM uses only the explicit `wasm-unsafe-eval` source
+expression; JavaScript `eval` remains denied. Resource responses and 404 responses carry the same policy.
+
+## Evidence
+
+- `npm --prefix web run test:csp-resource-policy` passed the HTTP resource matrix and Chromium browser gate.
+- `node tools/web/check-deployment-contract.mjs` passed.
+- `npm --prefix web run typecheck` passed.
+- `npm --prefix web run build` passed.
+- `git diff --check` passed.
+
+## Next Task
+
+`M13-05C`: production/build/test dependency inventories.
+
+## Rollback
+
+Remove the resource-specific CSP/MIME changes, checker, report, manifest, package command and this status;
+restore `M13-05A` as the queue tail.