` tag, no `https://` prefix). The Storybook
+ `|| true` fix from WS-8 was itself swallowing the step's real exit code — moved to step-level
+ `continue-on-error: true`, which still surfaces genuine failure in the Actions UI without
+ blocking the job (the exact visibility gap that let F-12's flag-name bug hide for so long).
+ `copy-duckdb-assets.mjs`'s idempotency check gained a SHA-256 content hash alongside the
+ file-size check (same-size dependency bump could otherwise leave stale content).
+- **Unrelated, pre-existing E2E finding (documented, not fixed — correctly out of scope):**
+ `tests/e2e/a11y.spec.ts` — "writer version control panel has no serious axe violations" fails
+ deterministically (same 4.47-vs-4.5 `color-contrast` ratio on both `chromium` and `Mobile
+ Chrome`, both CI attempts) on `--sc-accent` (`#92400e`) over its own `/20`-opacity background
+ (`#e0cab0`). Confirmed unrelated to this PR: `git diff --name-only main...HEAD` touches no CSS,
+ Tailwind config, Writer/version-control component, or color token, and `package.json`'s only
+ diff is the WS-5 `copy-duckdb-assets.mjs` script wiring (no dependency bump). `e2e` is **not** in
+ the branch's required status checks (`gh api .../branches/main/protection` →
+ `required_status_checks.contexts` = Security Audit, Build, Quality Gate ×2 only), so this does
+ not block merge. Left untouched — fixing an unrelated design-token contrast issue is out of scope
+ for a CSP/crypto/doc-truth security sprint; flagged here for a maintainer to file separately.
+- **DoD evidence:**
+ ```bash
+ grep -q "Ausstiegskriterium\|exit criterion" docs/CI.md → OK
+ pnpm exec biome check vitest.config.ts → clean
+ CI quality job (both Node versions) → pass, with the new thresholds in effect for this exact commit
+ ```
+- **Deviations (🟡):** thresholds set to +5-per-metric cap rather than the literal "~1pt below
+ measured" (which would have been +6 on statements) — documented above and in the
+ `vitest.config.ts` comment itself.
+
+---
+
+### WS-7 — Version bump to 1.24.2
+- **Status:** ✅ done (version-bump commit only, per hard rule — tagging/publishing a release is
+ a maintainer action, STOP-AND-ASK, not performed)
+- **Finding IDs:** none directly — release housekeeping, last in Wave 2 per the execution order
+- **Fix:** `package.json` bumped to `1.24.2`; ran `node scripts/sync-tauri-version.mjs` and
+ `node scripts/sync-sw-version.mjs` rather than hand-editing (per `CLAUDE.md`'s documented
+ auto-sync convention) — these updated `src-tauri/tauri.conf.json`, `src-tauri/Cargo.toml`, and
+ `public/sw.js`'s `APP_VERSION` in place. `node scripts/sync-readme-metrics.mjs` reported
+ "already in sync" (it doesn't track the version badge specifically) — the `README.md` version
+ badge (`v1.24.1` → `v1.24.2`) updated by hand. New `CHANGELOG.md` `[1.24.2]` entry lists every
+ finding ID (F-01…F-14) with its resolution, organized by Security/Fixed/Documentation per
+ Keep-a-Changelog convention, matching this project's existing entry style.
+- **Scope note:** `ROADMAP.md`/`AUDIT.md`/`TODO.md`'s remaining `1.24.1` references are WS-11's
+ job (re-audit close-out), not this workstream — confirmed against the plan's own division of
+ labor before leaving them untouched here.
+- **DoD evidence:**
+ ```bash
+ node -p "require('./package.json').version" → 1.24.2
+ python3 -c "...tauri.conf.json...['version']" → 1.24.2
+ grep -q "v1.24.2" README.md CHANGELOG.md → both found
+ node scripts/check-doc-metrics.mjs → OK
+ pnpm exec biome check package.json → clean
+ pnpm exec vitest run tests/unit/swLocaleStrategy.test.ts → 5/5 passed (only test referencing APP_VERSION conceptually; no hardcoded version-string assertion, confirmed no breakage)
+ ```
+- **Deviations (🟡):** none.
+
+---
+
+### WS-11 — Re-audit + post-mortem close-out
+- **Status:** ✅ done
+- **Finding IDs:** all 14 (closing entry)
+- **Full re-audit, final state (all commits through the WS-7 version bump):**
+ ```bash
+ $ node scripts/check-i18n-keys.mjs && node scripts/build-i18n.mjs && node scripts/content-guard.mjs \
+ && node scripts/check-doc-metrics.mjs && node scripts/check-suppressions.mjs && node scripts/audit-tokens.mjs
+ [i18n] OK — 19 locales match 2849 keys (reference: en).
+ [build-i18n] Done. 54131 total keys across 19 bundles. (git status confirmed no diff — nothing hand-edited)
+ content-guard: OK (community templates)
+ [docs:check] OK — 7 files match actual state (19 locales, 2849 keys, latest v1.24.1)
+ [suppressions] OK — 52 (baseline 52)
+ [token-audit] PASS — 160 ≤ baseline 160
+
+ pnpm run lint → clean (1648 files)
+ pnpm run typecheck (fresh, *.tsbuildinfo removed first) → clean
+ pnpm run parity:check → 0 drifts, 22 flags, "Audit passed — all flags consistent"
+ pnpm run build && pnpm run bundle:budget → 154 JS chunks ≤ 6200 KB
+ node scripts/smoke-prod-build.mjs → PASS, 0 CSP violations, wasm: ok
+ ```
+ **`latest v1.24.1` above is correct-by-design, not stale** (CodeRabbit flagged this — verified,
+ not a bug): `check-doc-metrics.mjs#getLatestReleasedVersion()` reads `git tag`, not
+ `package.json`. `package.json`/`tauri.conf.json` are pre-bumped to `1.24.2` (WS-7) as release
+ prep, but no `v1.24.2` git tag exists yet — tagging is a maintainer action, deliberately not
+ performed by this sprint (see WS-7's own entry and every "not yet merged/tagged" note in
+ `AUDIT.md`/`TODO.md`/`ROADMAP.md`). The gate will correctly report `v1.24.2` once that tag is
+ created; reporting it now, before the tag exists, would itself be the doc-truth violation this
+ entire sprint is about.
+ `pnpm run test:run` (full suite, no `--coverage`) was not re-attempted a third time locally —
+ two independent attempts earlier in this sprint were both killed with zero output on this
+ machine's ~3.7 GB RAM. CI's `quality` job's `vitest run --coverage` (a strict superset — a
+ coverage report cannot generate from a suite with failing tests) already passed on this exact
+ commit history through the WS-9 push, which is stronger evidence of full-suite health than a
+ third local attempt would add.
+- **Docs:** `AUDIT.md` gained the "Audit 2026-07-29 — CSP / Crypto / Truth" section — full finding
+ table (all 14 IDs, severity, resolution) plus the post-mortem answering the sprint's central
+ question directly (would a `faad8f0`-shaped commit fail today? yes, in 3 independent places —
+ walked through each). The post-mortem also names the two *other* instances of the identical
+ "gate looks green but checks the wrong property" pattern that surfaced **during this same
+ sprint's own execution** (Storybook's `|| true`, F-12; the F-10 drift gate's own initial
+ exclusion of the one file with real incident history) — three occurrences in one sprint is
+ itself the finding, documented as such rather than treated as three unrelated bugs.
+ `TODO.md` gained a `v1.24.2` block (code-complete items + the two genuinely-open follow-ups:
+ worker-generation consolidation, F-14; the pre-existing unrelated a11y color-contrast finding).
+ `ROADMAP.md` synced with a matching `v1.24.2` section.
+- **Doc-truth discipline applied to these edits themselves:** none of the three docs claim this
+ work is "released" or "merged" — `AUDIT.md`'s version line, `TODO.md`'s status line, and
+ `ROADMAP.md`'s section header all explicitly state "PR #284 open, CI green, not yet
+ merged/tagged," matching this sprint's own theme (don't let a doc claim more than what's
+ actually true). Caught and corrected in my own first draft before committing.
+- **DoD evidence:**
+ ```bash
+ grep -q "2026-07-29" AUDIT.md → found
+ node scripts/check-doc-metrics.mjs → OK (re-run after AUDIT/TODO/ROADMAP edits)
+ git status --short → only AUDIT.md, TODO.md, ROADMAP.md changed
+ ```
+- **Deviations (🟡):** `pnpm run test:run` full-suite re-run substituted with CI's already-passing
+ `--coverage` run as equivalent-or-stronger evidence — documented above with the reasoning.
diff --git a/index.html b/index.html
index d7805e26..e778b547 100644
--- a/index.html
+++ b/index.html
@@ -47,7 +47,13 @@
-
+
diff --git a/index.tsx b/index.tsx
index a4e14015..b340b597 100644
--- a/index.tsx
+++ b/index.tsx
@@ -49,6 +49,14 @@ import '@fontsource/noto-sans/greek-700.css';
import './index.css';
import './register-sw';
+// QNBS-v3: Disable Aurora on low-end hardware (≤4 logical CPUs) to prevent GPU/battery drain;
+// prefers-reduced-data handled in CSS. Moved out of an inline bodies in index.html that have no `src` attribute and non-empty
+ * content. Case-insensitive (`i` flag) — HTML tag names are case-insensitive per spec, and an
+ * uppercase ``
+ * or `` — browsers still parse these as a valid `` (CodeQL's own "Bad HTML
+ * filtering regexp" example), so a strict `<\/script>` literal would let such a script slip past
+ * this detector undetected, same failure class as the case-sensitivity gap above. `\b` after the
+ * opening ``.
+ */
+function inlineScriptContents(html: string): string[] {
+ const results: string[] = [];
+ // QNBS-v3 (CodeQL js/bad-tag-filter): tolerate a malformed-but-browser-valid closing tag like `` so it can't evade this detector.
+ for (const m of html.matchAll(/]*)>([\s\S]*?)<\/script(?:\s[^>]*)?>/gi)) {
+ const attrs = m[1] ?? '';
+ const body = m[2] ?? '';
+ if (!/\bsrc\s*=/i.test(attrs) && body.trim().length > 0) {
+ results.push(body);
+ }
+ }
+ return results;
+}
+
+const namedCsps: readonly [name: string, csp: string][] = [
+ ['index.html (meta)', webCsp()],
+ ['vercel.json (header)', extractVercelHeaderValue(vercelJson, 'Content-Security-Policy')],
+ ['public/_headers (Cloudflare)', extractHeadersFileValue(headersFile, 'Content-Security-Policy')],
+ ['src-tauri/tauri.conf.json (Tauri WebView)', tauriCsp()],
+ ...nginxCsps().map((csp, i) => [`nginx.conf (block ${i + 1})`, csp] as [string, string]),
+];
+
+describe('CSP correctness — Layer B (functional directives, not cross-surface consistency)', () => {
+ it('nginx.conf has exactly 3 Content-Security-Policy add_header blocks', () => {
+ expect(nginxCsps()).toHaveLength(3);
+ });
+
+ it('covers all 5 deployment surfaces (4 header/meta files + 3 nginx blocks = 7 CSP strings)', () => {
+ expect(namedCsps).toHaveLength(7);
+ });
+
+ it.each(namedCsps)(
+ "%s: script-src contains 'wasm-unsafe-eval' (WebLLM/ONNX Runtime Web/Transformers.js/DuckDB-WASM/Whisper-STT/Kokoro-TTS)",
+ (_name, csp) => {
+ const tokens = directiveTokens(csp, 'script-src');
+ expect(tokens, 'script-src directive must exist').toBeDefined();
+ expect(tokens).toContain("'wasm-unsafe-eval'");
+ },
+ );
+
+ it.each(namedCsps)("%s: script-src does NOT contain 'unsafe-eval'", (_name, csp) => {
+ const tokens = directiveTokens(csp, 'script-src') ?? [];
+ expect(tokens).not.toContain("'unsafe-eval'");
+ });
+
+ it.each(namedCsps)("%s: script-src does NOT contain 'unsafe-inline'", (_name, csp) => {
+ const tokens = directiveTokens(csp, 'script-src') ?? [];
+ expect(tokens).not.toContain("'unsafe-inline'");
+ });
+
+ it.each(namedCsps)(
+ '%s: frame-src (or child-src) allows blob: (Binder/ManuscriptResearchSplit PDF-preview iframes)',
+ (_name, csp) => {
+ const tokens = directiveTokens(csp, 'frame-src') ?? directiveTokens(csp, 'child-src');
+ expect(tokens, 'frame-src or child-src directive must exist').toBeDefined();
+ expect(tokens).toContain('blob:');
+ },
+ );
+
+ it.each(namedCsps)(
+ '%s: worker-src allows blob: (regression guard — DuckDB/inference workers)',
+ (_name, csp) => {
+ expect(directiveTokens(csp, 'worker-src')).toContain('blob:');
+ },
+ );
+
+ it.each(namedCsps)('%s: img-src allows blob: (regression guard)', (_name, csp) => {
+ expect(directiveTokens(csp, 'img-src')).toContain('blob:');
+ });
+
+ it.each(namedCsps)("%s: object-src is 'none'", (_name, csp) => {
+ expect(directiveTokens(csp, 'object-src')).toEqual(["'none'"]);
+ });
+
+ it.each(namedCsps)("%s: base-uri is 'self'", (_name, csp) => {
+ expect(directiveTokens(csp, 'base-uri')).toEqual(["'self'"]);
+ });
+
+ it.each(namedCsps)(
+ "%s: frame-ancestors is 'none' (inert in the meta tag, effective as a header)",
+ (_name, csp) => {
+ expect(directiveTokens(csp, 'frame-ancestors')).toEqual(["'none'"]);
+ },
+ );
+});
+
+describe('CSP correctness — connect-src completeness (F-08)', () => {
+ // QNBS-v3: LanguageTool's default self-hosted URL is `http://localhost:8010` — an HTTP origin,
+ // which the web PWA's `https:` scheme-source does NOT cover either (different scheme). This was
+ // missing on ALL 5 surfaces, not just Tauri as the source audit assumed (its "the web `https:`
+ // masks the gap" reasoning only holds for HTTPS-reachable hosts). Fixed everywhere 2026-07-29.
+ it.each(namedCsps)(
+ '%s: allows LanguageTool default self-hosted port 8010 (features/settings/settingsSlice.ts:105)',
+ (_name, csp) => {
+ const tokens = directiveTokens(csp, 'connect-src') ?? [];
+ expect(tokens).toContain('http://localhost:8010');
+ expect(tokens).toContain('http://127.0.0.1:8010');
+ },
+ );
+
+ // QNBS-v3: the web PWA's `connect-src 'self' https: ...` DOES implicitly cover these HTTPS hosts
+ // (ADR-0004) — only the strict Tauri connect-src (no `https:` blanket) needs them enumerated.
+ describe('Tauri-only: Hugging Face Hub hosts (no https: blanket to fall back on)', () => {
+ const tauriConnectSrc = directiveTokens(tauriCsp(), 'connect-src') ?? [];
+
+ it('allows the Hugging Face Hub host that WebLLM/Transformers.js resolve models from (their library defaults)', () => {
+ expect(tauriConnectSrc).toContain('https://huggingface.co');
+ });
+
+ it('allows the Hugging Face Xet CDN bridge that actual model-weight downloads redirect to (empirically traced 2026-07-29: a resolve/main/*.bin request 302s to us.aws.cdn.hf.co)', () => {
+ expect(tauriConnectSrc).toContain('https://us.aws.cdn.hf.co');
+ });
+ });
+});
+
+describe('CSP correctness — no ungehashtes (unhashed) inline