M-01 with A468 and A635 is generated as a development HTML meta policy and a release HTTP response-header manifest. Release requires header delivery with frame-ancestors 'none'; it has no meta fallback. Exact Clerk, API and OpenFreeMap origins are allowed, with no inline scripts or eval, self/blob workers, no objects and self base URI. Development alone adds the exact local API origin and ws://localhost:<resolved dev port>, following VITE_DEV_PORT or a Vite --port override. Workers use 5180; 5173/8787 remain reserved for coordinated live tests. Release keeps explicit HTTPS/non-loopback origin validation, no localhost default and no dev websocket. The review placeholder is NOT DEPLOYABLE.
Gate C attempt 2 proved that Protect IDs change between sessions. Under the conditional rule in A635, both profiles now use https://*.protect.clerk.com in script-src and https://*.protect.clerk.com:* in connect-src. The A468-observed CDN remains explicit in script-src and is also covered by the wildcard. No other directive or domain is widened. HTTP, the bare protect.clerk.com domain, lookalike/suffix domains, non-default script ports, Cloudflare, inline scripts and eval remain blocked. The documented connect wildcard necessarily permits new Protect IDs and ports, including CDN/loader connections; the script wildcard also covers probe subdomains at default HTTPS.
Variation evidence preserves worker 8’s sanitized JSON byte-for-byte. Policy records contain complete directive sources (including wildcard source expressions), hashes and provenance. Results and limits distinguish local intercepted-response checks from worker 8’s live cycle and incomplete final host observations. Source ordering matches worker 8: at 5173 the generated policy hashes exactly to its live 8dd3c3014f77bbc8206e0a80cd3f811bf478e132002a2f7ef7c1d4dcbb4e4546; worker 5180 changes only the websocket port. Later configuration needs a fresh exact hash. node scripts/record-csp-policy.mjs --check rejects stale source/policy/provenance records.
On 2026-10-12, direct public-resource checks returned HTTP 200:
https://tiles.openfreemap.org/fonts/{fontstack}/{range}.pbf, sprites at https://tiles.openfreemap.org/sprites/ofm_f384/ofm, and tile sources on that same host. No additional glyph/sprite domain is needed. Chromium checks actual successful glyph, sprite and vector-tile responses and visible source attribution./v1/environment reports user_settings.sign_up.captcha_enabled=false, null CAPTCHA provider/widget type, and no CAPTCHA public key. The Cloudflare challenge domain is therefore absent. Recheck the policy if the instance settings change.Known style exception: style-src 'self' 'unsafe-inline'. Vuetify’s cspNonce covers its generated theme style tag, but cannot authorize the inline style attributes used by MapLibre or all of Clerk’s runtime CSS-in-JS. Clerk documents its inline-style requirement in its CSP guide. A fixed public nonce in a static page would not add meaningful protection. Script directives remain strict; Chromium verifies a CSP violation and that an injected inline script never executes.
The owner ruling in ~/mitmonlabs-handoff/reviews/REVIEW_d885661_M01_CSP.md authorized the observed exact https://cdn.protect.clerk.com script host. A635 now authorizes the conditional documented Protect sources above; the earlier absence of Protect connect sources is historical. Captcha remains off, frame/form actions remain self and scripts remain strict.
The previous blocked-bootstrap evidence is retained in clerk-csp-evidence.json as historical evidence, not a current policy assertion. The historical live checklist was: sign-in and /v1/me 200, sign-out, identity switch, basemap/3D, zero final CSP violations, blocked inline/eval, Chromium version, policy hash, contacted origins and secret-free screenshots.
Release policy removes the development websocket and is emitted for delivery as an HTTP header with frame-ancestors 'none'. The final real API origin and deployment host remain owner decisions. Localhost API/meta evidence is development evidence.
The key file is read at both dev startup and build time. The public key belongs in the browser artifact; its value is never logged, committed or included in a review bundle. The audit allows only the expected public key and reports presence without its value. All other key values/PEM/JWT markers are rejected.
This is development evidence only. M-02 release builds remain deferred to FS1’s A459 accepted isolated browser-build pipeline. The locally installed development contracts package still physically contains internal source/schema files; this audit does not claim to replace that pipeline’s isolation or canary checks.
Worker bootstrap evidence records the historical pre-A635 signed-out Chromium 156.0.8078.4 run on 5180, with no credentials submitted. After the A468 script allowance, Protect probed client.protect.clerk.com hosts on HTTPS default/8443/18443/2082/992 ports and these connections were blocked. That raw receipt is retained unchanged; A635 supersedes its policy assertions. It is diagnostic evidence, not a signed-in stability result.
The initial app-origin eval violation was traced to Zod 4.1.12’s allowsEval Function-constructor probe. The app imports its schema runtime configuration before contract construction and uses Zod’s supported jitless: true setting. The same exact Zod version used by the bound contracts is declared directly. No shared code/schema changed, and the policy still blocks eval. The historical capture recorded no app-origin eval violation and six Protect connection violations. The smoke check asserts no app-origin inline/eval violations before its intentional negative probes.