46 lines
2.0 KiB
Markdown
46 lines
2.0 KiB
Markdown
# M13-05A Status
|
|
|
|
status: done
|
|
task: CSP default-deny policy
|
|
updated: 2026-08-19 America/New_York
|
|
enablingTask: false
|
|
parityStateChange: false
|
|
|
|
## Scope
|
|
|
|
The deployment contract now requires one CSP on every response: same-origin default/script/worker/connect
|
|
sources, no inline or eval execution, no data/blob script source, and object/base/frame embedding denied.
|
|
The Vite source, entry HTML, production source tree and built JS/HTML are scanned for dynamic code and data
|
|
scripts. The deployment HTTP checker verifies the policy on normal, missing and entry responses. Resource-
|
|
specific Worker/WASM/font/image/media rules remain in M13-05B.
|
|
|
|
## Evidence
|
|
|
|
- `npm --prefix web run test:csp-policy` passed.
|
|
- `node tools/web/check-deployment-contract.mjs` passed.
|
|
- `npm --prefix web run typecheck` passed.
|
|
- `npm --prefix web run build` passed; built output was scanned by the CSP checker.
|
|
- Checker output: `csp-policy-ok inline=DENY eval=DENY dataScript=DENY undeclaredConnect=DENY responses=3 execution=DISABLED next=M13-05B`.
|
|
- `git diff --check` passed.
|
|
|
|
## Artifact Hashes
|
|
|
|
- parent manifest: `d230ae49dbf38cd9e95e7379a1a49332e478d3d23b3638730d2ec6167204c368`
|
|
- contract: `3f2b0b10c5a5698be2adda61af80cfb9cb9291fb9797994bfa66a77b7b511eeb`
|
|
- deployment server: `a5734ce9760f65cf5bade8cc209454d39fa963ad7dfaf20653728a9d7a57b04c`
|
|
- contract checker: `5e2d80f5c1377420f4779291fa73c206741ed415e751e79ce5edae7ba039febf`
|
|
- CSP checker: `f97ab074da860e3f8489e520c8bb5932f858409136ef25cca56247bb1310340d`
|
|
- index: `16b7691b191127f84c5143e23aecdfc203dc9e279d34cb270b37631fcbd5f856`
|
|
- Vite: `fd160c685ed780738e2b37ce9a32e5d4718e11a2875e12d86ddad310213abaf3`
|
|
- package: `5b47e94cf828fc9d3021019eed9922eb67815aba5416266d8c967c7cb5bd96ba`
|
|
- report: `9c7c64bb021161a1165a7c089ccf3f4897877635914260f6f0b0da119a5036fb`
|
|
|
|
## Next Task
|
|
|
|
`M13-05B`: verify resource-specific CSP for Worker, WASM, font, image and media paths.
|
|
|
|
## Rollback
|
|
|
|
Remove the CSP contract/checker changes, report, manifest, package command and this status entry; restore
|
|
`M13-04J` as the queue tail.
|