32 lines
1.1 KiB
Markdown
32 lines
1.1 KiB
Markdown
# M13-05B Status
|
|
|
|
status: done
|
|
task: resource-specific CSP policy
|
|
updated: 2026-08-19 America/New_York
|
|
enablingTask: false
|
|
parityStateChange: false
|
|
|
|
## Scope
|
|
|
|
The deployment contract now separates same-origin policy for Worker, WASM, font, image and media
|
|
resources. Chromium loaded same-origin Worker, WASM, image and media resources, and rejected data-image,
|
|
blob-Worker and cross-origin connect attempts. WASM uses only the explicit `wasm-unsafe-eval` source
|
|
expression; JavaScript `eval` remains denied. Resource responses and 404 responses carry the same policy.
|
|
|
|
## Evidence
|
|
|
|
- `npm --prefix web run test:csp-resource-policy` passed the HTTP resource matrix and Chromium browser gate.
|
|
- `node tools/web/check-deployment-contract.mjs` passed.
|
|
- `npm --prefix web run typecheck` passed.
|
|
- `npm --prefix web run build` passed.
|
|
- `git diff --check` passed.
|
|
|
|
## Next Task
|
|
|
|
`M13-05C`: production/build/test dependency inventories.
|
|
|
|
## Rollback
|
|
|
|
Remove the resource-specific CSP/MIME changes, checker, report, manifest, package command and this status;
|
|
restore `M13-05A` as the queue tail.
|