2.0 KiB
FAIL
crates/ely-web-content/src/handlers.rs:103 — The dead HTTP proxy leaves WebRTC UDP traffic unrestricted, so page data can still reach destinations outside the content folder. In the independently built real-window probe, bundled JavaScript created an RTCPeerConnection and data channel, installed an answer derived from its offer with a=ice-ufrag:REVIEW_SENTINEL, and added a host ICE candidate targeting a local UDP listener at 127.0.0.1:52027. The listener received 173 STUN packets containing the page-controlled REVIEW_SENTINEL bytes while the current gate exited successfully with ok: webview (marker share 0.0871, 23 pages freed). A simpler iceServers: [{urls: 'stun:127.0.0.1:<port>'}] probe also reached its UDP listener. This violates PRD §17.3's restricted-resource contract and the all-network restriction claimed in agents.md:185. Apply the outbound restriction to WebRTC networking and add a live UDP regression that checks for both STUN requests and page-controlled ICE payloads. Evidence: /tmp/c14-r3-ice-capture.log, /tmp/c14-r3-ice-gate.log.
tests/scripts/webview.sh:59 — Recovery is accepted from a load event without checking that the recovered page is displayed. examples/webprobe.rs:67 prints probe: recovered and immediately quits on Event::Loaded. In the isolated copy, removing both assignments that clear WebView::fault during reload and successful loading left the renderer permanently selecting the fault view, yet the unchanged gate still exited successfully with ok: webview (marker share 0.0871, 23 pages freed). A separate observation with exit delayed three seconds measured a post-reload marker share of 0.0000. Thus the PRD §6.3 reopening interface can remain broken while the recovery gate passes. Keep the probe alive until the recovered content is displayed, assert the page marker and disappearance of the fault state after activating Reload, and require the retained-fault mutation to fail. Evidence: /tmp/c14-r3-stuck-fault.log, /tmp/c14-r3-stuck-fault-visible.log.