workinf_Blender_Wasm/docs/status/M13-05B.md

M13-05B Status

status: done
task: resource-specific CSP policy
updated: 2026-08-19 America/New_York
enablingTask: false
parityStateChange: false

Scope

The deployment contract now separates same-origin policy for Worker, WASM, font, image and media resources. Chromium loaded same-origin Worker, WASM, image and media resources, and rejected data-image, blob-Worker and cross-origin connect attempts. WASM uses only the explicit wasm-unsafe-eval source expression; JavaScript eval remains denied. Resource responses and 404 responses carry the same policy.

Evidence

• npm --prefix web run test:csp-resource-policy passed the HTTP resource matrix and Chromium browser gate.
• node tools/web/check-deployment-contract.mjs passed.
• npm --prefix web run typecheck passed.
• npm --prefix web run build passed.
• git diff --check passed.

Next Task

M13-05C: production/build/test dependency inventories.

Rollback

Remove the resource-specific CSP/MIME changes, checker, report, manifest, package command and this status; restore M13-05A as the queue tail.