1.5 KiB
FAIL
crates/ely-web-content/src/handlers.rs:406 — The resource fence leaves WebSocket connections unrestricted. In the independently built real-window probe, replacing the blocked image request with new WebSocket('ws://127.0.0.1:<port>/pixel?text=REVIEW_SENTINEL') made the same local listener report probe: network=reached; its captured bytes contained GET /pixel?text=REVIEW_SENTINEL HTTP/1.1 and Upgrade: websocket. Thus page data reaches an unauthorized network destination despite the C14.0 claim that all requests outside the content folder are cancelled, violating PRD §17.3's restricted-resource contract. Enforce the destination policy for WebSocket connections as well as ordinary resource loads, and add a live regression that verifies the listener receives no handshake.
tests/scripts/webview.sh:42 — The crash/recovery gate accepts a missing fault interface and recovery button. Its pixel assertion runs before the renderer is terminated, and recovery is driven directly by the probe calling WebView::reload. In the isolated copy, suppressing the entire fault-rendering branch with self.fault.clone().filter(|_| false) kept the previous page image visible after the crash and removed the Reload button, while the unchanged gate still exited successfully with ok: webview (marker share 0.0871, 23 pages freed). This lets the PRD §6.3 visible-failure and reopening contract regress undetected. Assert the rendered fault state after termination and recover by activating the displayed Reload control; require the suppressed-fault mutation to fail.