M13-05A Status

status: done
task: CSP default-deny policy
updated: 2026-08-19 America/New_York
enablingTask: false
parityStateChange: false

Scope

The deployment contract now requires one CSP on every response: same-origin default/script/worker/connect sources, no inline or eval execution, no data/blob script source, and object/base/frame embedding denied. The Vite source, entry HTML, production source tree and built JS/HTML are scanned for dynamic code and data scripts. The deployment HTTP checker verifies the policy on normal, missing and entry responses. Resource- specific Worker/WASM/font/image/media rules remain in M13-05B.

Evidence

npm --prefix web run test:csp-policy passed.
node tools/web/check-deployment-contract.mjs passed.
npm --prefix web run typecheck passed.
npm --prefix web run build passed; built output was scanned by the CSP checker.
Checker output: csp-policy-ok inline=DENY eval=DENY dataScript=DENY undeclaredConnect=DENY responses=3 execution=DISABLED next=M13-05B.
git diff --check passed.

Artifact Hashes

parent manifest: d230ae49dbf38cd9e95e7379a1a49332e478d3d23b3638730d2ec6167204c368
contract: 3f2b0b10c5a5698be2adda61af80cfb9cb9291fb9797994bfa66a77b7b511eeb
deployment server: a5734ce9760f65cf5bade8cc209454d39fa963ad7dfaf20653728a9d7a57b04c
contract checker: 5e2d80f5c1377420f4779291fa73c206741ed415e751e79ce5edae7ba039febf
CSP checker: f97ab074da860e3f8489e520c8bb5932f858409136ef25cca56247bb1310340d
index: 16b7691b191127f84c5143e23aecdfc203dc9e279d34cb270b37631fcbd5f856
Vite: fd160c685ed780738e2b37ce9a32e5d4718e11a2875e12d86ddad310213abaf3
package: 5b47e94cf828fc9d3021019eed9922eb67815aba5416266d8c967c7cb5bd96ba
report: 9c7c64bb021161a1165a7c089ccf3f4897877635914260f6f0b0da119a5036fb

Next Task

M13-05B: verify resource-specific CSP for Worker, WASM, font, image and media paths.

Rollback

Remove the CSP contract/checker changes, report, manifest, package command and this status entry; restore M13-04J as the queue tail.

2.0 KiB Raw Blame History