# M13-05B Status

status: done
task: resource-specific CSP policy
updated: 2026-08-19 America/New_York
enablingTask: false
parityStateChange: false

## Scope

The deployment contract now separates same-origin policy for Worker, WASM, font, image and media
resources. Chromium loaded same-origin Worker, WASM, image and media resources, and rejected data-image,
blob-Worker and cross-origin connect attempts. WASM uses only the explicit `wasm-unsafe-eval` source
expression; JavaScript `eval` remains denied. Resource responses and 404 responses carry the same policy.

## Evidence

- `npm --prefix web run test:csp-resource-policy` passed the HTTP resource matrix and Chromium browser gate.
- `node tools/web/check-deployment-contract.mjs` passed.
- `npm --prefix web run typecheck` passed.
- `npm --prefix web run build` passed.
- `git diff --check` passed.

## Next Task

`M13-05C`: production/build/test dependency inventories.

## Rollback

Remove the resource-specific CSP/MIME changes, checker, report, manifest, package command and this status;
restore `M13-05A` as the queue tail.