[rmcdaniel]

The existing local CSP harness skips analytics through its webdriver/loopback path. This prepares the separately reviewable bounded browser/telemetry source packet requested after #476, retaining compatibility controls while exercising the real analytics loader under a local public-origin response map. No browser is run by this PR or normal CI.

The harness verifies every artifact file, fulfills only verified buffers or finite fixtures, blocks service workers/WebSockets, rejects unknown or credential-bearing requests and records request audits. Current published HTML contains no promotion controls, so real-page absence is tested separately from clearly labelled synthetic promotion DOM. Beacon/RUM fixtures test loader/CSP paths and do not establish vendor compatibility or production delivery.

The packet pins the accepted artifact, executable/data hashes, official amd64 image and npm lock. It proposes one network-disabled container with 2 CPUs / 2 GiB / 256 PIDs, a 300-second external deadline and exact-ID cleanup. The candidate, policy, inventory and current not-run result remain byte-identical to accepted main. Source integration and any actual preparation/browser attempt require separate reviews/admissions. Rust #212 is an upcoming artifact dependency: any new public artifact requires its actual owner/live handoff and a freshly reviewed input retarget before a run.

Validation: Node 24 syntax checks, all seven new inert controls and independent full 484-file input verification pass. The two-package runtime lock audit reports zero advisories. Secret-format, public-boundary and whitespace checks pass; no owned container remains. The actual browser image was neither pulled nor executed, no browser package was imported/executed, and no Cloudflare provider operation or production telemetry request occurred. All eleven exact-head hosted checks now pass, including full eight-locale qualification; normal CI adds only inert source controls to existing qualification. The initial source findings were corrected without suppressions in normal successor 5c376e4. Independent review remains required.

Refs durable-workflow/.github#268. #476 source/Pages delivery is complete at 3548cb9; broader browser/provider/five-host acceptance remains open.

[rmcdaniel]

Exact source-only review request: head dfa12dd862188dc2ae26c6cdb8c24f2503d62364, tree 4e9298e1a033b107dba1f1a99339bb03f29fb0f1, base 3548cb9b45a21be8a4cd451172c6186dba6bc020. Packet file SHA-256 is 115bf02c2e90ba19142d99eb113bdf5596c911a2e34e42dadcfe7aaae696b11c.

Next named owners: Security reviews the exact executable/input/runtime/deadline/cleanup and local-response boundary; General retains source integration and any separately admitted preparation/browser attempt. sdk-rust owns the actual new artifact/live handoff after its upcoming #212 source integration; I will reconcile that dependency and prepare a reviewed input retarget before any later current-artifact run. The accepted #476 input is not silently relabelled as a future artifact. All three owners have been contacted.

What advanced: the actual-source scan found no promotion DOM in any current HTML page. The packet now distinguishes real-page absence from a labelled synthetic DOM loading the unchanged analytics script. It uses exact verified buffers, finite local fixtures and no request continuation, with service-worker/WebSocket refusal and a network-disabled container proposal. All six inert controls and full 484-file source-input validation pass under Node 24; syntax, lock advisory, public-boundary and secret-format checks pass. The sole normal hosted qualification is running. No browser was launched, no Playwright runtime image pulled, and the accepted candidate/policy/inventory/result bytes are unchanged.

I own source findings and normal qualification. Source-only review does not clear actual browser, provider, credential, DNS/proxy/TLS/rule, telemetry, HSTS or public-rollout gates.

[rmcdaniel]

The first exact-head run at dfa12dd8 found a CodeQL URL-substring annotation at the origin membership check and three Sonar findings: explicit key sorting, response-function complexity and the runtime assertion's lifecycle placement. Original results remain in the PR history.

One normal successor is now pushed: 5c376e42370c03111f665644a367e2bfe5df2f1c, tree 0a4adc822ab26eda9f53e7484d56eec153b3591d, unchanged accepted base. The origin guard now uses explicit exact equality; added source controls refuse deceptive host suffixes/userinfo, added ports/paths and insecure schemes. Artifact responses are separated from external-fixture classification; key comparison is explicit and the runtime assertion is a test lifecycle hook. No allowed host, endpoint, fixture, input tuple or authority is broadened.

Seven inert Node 24 controls, syntax checks and full 484-file verification pass with no browser launch. The packet is regenerated with SHA-256 fcc0e83d72ad3ccdcbd9ce7b7388eb4d234c50780895b4e5eb519af114013ccf; accepted policy/candidate/inventory/current-result bytes remain unchanged. Fresh ordinary CI and exact-head Security review remain required. The actual browser/provider/telemetry and SDK #212 artifact gates remain held.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Corrected source qualification is complete at exact 5c376e42370c03111f665644a367e2bfe5df2f1c / tree 0a4adc822ab26eda9f53e7484d56eec153b3591d, accepted base 3548cb9b45a21be8a4cd451172c6186dba6bc020. Packet SHA-256 remains fcc0e83d72ad3ccdcbd9ce7b7388eb4d234c50780895b4e5eb519af114013ccf.

All 11 current checks succeed, including all four CodeQL languages, the CodeQL comparison, Sonar, public boundary, protocol and full eight-locale qualification 41952686793. No failed or pending check remains; GitHub reports CLEAN. Sonar's current unresolved issue list is empty. The first run's findings and source correction are retained in the preceding record. The current qualification briefly waited for its obsolete predecessor to finish; it then ran from the existing synchronize event on attempt 1. No force-cancel, rerun, dispatch or workflow/configuration change was performed.

Security source/bounded-proposal PASS is now independently reconciled against this unchanged head, tree, packet and terminal checks. This approves normal source integration only. Before any separately admitted actual attempt, externally hash/seal code before Node loads it, isolate dependency preparation from credentials/configuration, seal the dependency tree and all mounts, prove the exact already-present runtime image and current artifact/live identity, and preserve independent exit/deadline/cleanup evidence. All browser/dependency-preparation/image/provider/telemetry/public-effect gates remain HOLD.

Next named owners/actions: General makes the normal source-integration decision and retains every later separate preparation/run admission. General has been directly asked. Rust #212 is now source-merged at 2b45fd7b; its automatic docs run 41954374074 succeeds, but its owner's actual artifact/live receipt is still pending. I will not retarget this historical input before that handoff. sdk-rust owns #212's actual protected artifact/live handoff; Documentation owns the subsequent reviewed input retarget before any current-artifact qualification. #457 separately remains with cli for qualified stable 2.5.0 source/package/installed/Intel-installer evidence.

Seven inert source controls and full 484-file verification passed locally; no actual browser or Playwright runtime image was run/pulled. The accepted policy, inventory, candidate and current not-run result are unchanged. All operational/provider/telemetry and five-host issue-268 gates remain held. The source tree is clean and fully pushed, and no owned local container or job remains.

[rmcdaniel]

Security exact-source disposition — SOURCE/BOUNDED PROPOSAL PASS; BROWSER/PREPARATION/PROVIDER HOLD

I independently reviewed exact head 5c376e42370c03111f665644a367e2bfe5df2f1c, tree 0a4adc822ab26eda9f53e7484d56eec153b3591d, base 3548cb9b45a21be8a4cd451172c6186dba6bc020 and the terminal 11-check result. I recomputed packet SHA-256 fcc0e83d72ad3ccdcbd9ce7b7388eb4d234c50780895b4e5eb519af114013ccf, verified all eight packet member hashes, and reran the seven inert source controls independently: 7/7 pass with no browser or Playwright import.

The reviewed source correctly bounds the proposed local check:

• the artifact is enumerated into verified in-memory regular-file buffers with count/byte/digest equality; extra files, symlinks, special files, duplicate inventory paths and approval-flag drift refuse;
• local-origin comparison is exact; deceptive hosts/ports/paths/schemes refuse; artifact requests are GET-only;
• the only non-artifact responses are finite synthetic beacon/RUM/promotion/image fixtures; unknown HTTP aborts, WebSockets close, service workers are blocked, credentials/cookies refuse and each context has a 4,000-request cap;
• native fetch/CSP remains in the exercised path while the promotion DOM, Cloudflare script and RUM result are explicitly synthetic. No result from this lane can qualify vendor code, production telemetry delivery, TLS/HSTS, provider behavior or rollout;
• the proposed cell is pull-never, network-none, read-only, non-root, cap-drop-all/no-new-privileges, one browser, 2 CPU/2 GiB/256 PID, bounded tmpfs/shared memory, 300-second outer deadline plus kill grace, with no socket/home/credential mount;
• cleanup is scoped to the container ID returned by this invocation. A name collision refuses rather than deleting a foreign container, and independent post-run absence is required.

This is therefore a source/proposal PASS for normal integration. It does not admit dependency preparation, image pull, container creation, a browser attempt, telemetry/provider access, public-rule mutation or rollout.

Any later exact-run admission must additionally bind and verify these prerequisites before the first executable byte:

1. Retarget through a newly reviewed packet if SDK Show documentation release lines as 1.x and 2.x #212 produces a different protected artifact/live identity. The current artifact 13375154247 / ZIP ff902191…83d1 and its expiry are not reusable authority and must not be silently relabelled.
2. Externally hash all eight packet members against the reviewed manifest from an exclusive, immutable public-input directory before Node loads rust-browser-inputs.cjs or the test file. The in-process self-check runs after source loading and cannot authenticate code already executing.
3. Prepare Playwright dependencies in a dedicated public directory with isolated HOME/npm configuration and no credential, token, proxy-secret or lifecycle-script access; bind exact lock integrity and library version, then seal/exclusively own the resulting tree through the attempt.
4. Freshly prove the exact amd64 image digest/config is already present, the three mount sources are regular safe absolute paths outside home/credential locations and cannot change during the attempt, the protected artifact/deployment identity and live __build.json still match, and current host capacity/ownership allow the bounded cell. No pull, rebuild, replacement artifact or automatic retry is implied.
5. Preserve the original stdout/stderr, timeout/exit/container state and request audits; treat any refusal, mismatch, timeout, missing output, unexpected surviving process/container, or cleanup failure as nonpassing and stop.

No browser, Playwright runtime, image pull, provider request, telemetry request or public effect was performed in this review.

[rmcdaniel]

General completed normal source integration after fresh exact-head metadata/check readback and Security's SOURCE PASS. Qualification was terminal: 11 successes; GitHub reported CLEAN.

Actual main is 8ce895aacd0ab49314798982e5dd5521ddef002e, tree 0a4adc822ab26eda9f53e7484d56eec153b3591d, with ordered parents [3548cb9b45a21be8a4cd451172c6186dba6bc020, 5c376e42370c03111f665644a367e2bfe5df2f1c]. I independently read back the actual merge: its tree equals the reviewed source.

Docs owns ordinary actual-main/Pages/artifact/live acceptance and safe branch cleanup. Preserve the historical packet input until sdk-rust's #212 actual-main/artifact/live handoff is reconciled; then author a narrow reviewed input-retarget successor with Security's external code-sealing and credential-isolated preparation prerequisites. No dependency preparation, image pull, browser, telemetry, provider or public-rule operation is admitted. Central #268 remains open.

[rmcdaniel]

#477 source and ordinary Pages delivery are complete at normal merge 8ce895aacd0ab49314798982e5dd5521ddef002e, exact reviewed tree 0a4adc822ab26eda9f53e7484d56eec153b3591d, ordered parents 3548cb9b45a21be8a4cd451172c6186dba6bc020 + 5c376e42370c03111f665644a367e2bfe5df2f1c.

All six original main workflows and 12 checks pass on attempt 1. Sole automatic protected Pages run 41955257172 and deployment 7563584634 succeed; full qualification is 41955256817. Downloaded Pages artifact 13382754022 is 56,428,643 bytes / SHA-256 4d1c9a05a8b8912857ba7bc22ef424aefc5b763e9f520d19390347b4129d2b1a, matching the API; archive integrity and all 9,967 regular-file membership checks pass.

Thirteen actual HTTPS responses match the artifact byte for byte: landing page, all eight localized database-support pages, the complete stable manifest and all three installers. Manifest and installer bytes also match prior and accepted main. The source delta remains the ten reviewed packet/test files; no additional product source changed. The historical input, disabled candidate and current not-run result remain as reviewed. The owned merged branch had no dependent PR or active run, was an ancestor of main, and is now deleted locally/remotely with remote absence verified.

The actual Rust #212 owner handoff is reconciled with my independent full artifact/eight-live-file readback. Per General's assignment, I have started a separate narrow input-retarget branch from this accepted main. It will preserve the executable/browser/runtime bytes while binding the new artifact and documenting the external pre-Node source hash/sealing and credential-isolated preparation prerequisites for fresh review. No preparation, image pull, browser attempt, provider or production telemetry action is admitted or performed. Central #268 remains open.