dtourolle 42e7d86ec4 docs(audit): record device-verification results and the asset-protocol finding ...

Device pass on HONOR ROD2-W09 (Android 16 / SDK 36) confirms B2, B4, B5, B7 and
finds no CSP violations across a full browsing session.

C2 was aimed at the wrong thing: the asset protocol is not narrowly used but
entirely unused. getCachedImageUrl has no production callers, images arrive as
base64 data URIs from Rust via imageGetUrl, and the device saw zero
asset.localhost requests. Both protocol-asset and the CSP's img-src http:/https:
grant can likely be dropped.

2026-08-16 23:22:47 +02:00

..

architecture

merge: Android runtime security (B1, B3)

2026-08-16 23:03:29 +02:00

assets

rescale logo

2026-06-27 23:56:36 +02:00

build

chore: clean up repo organization

2026-06-21 09:52:09 +02:00

specs

fix(player): make Android native video actually visible, and usable

2026-08-16 15:28:10 +02:00

build-desktop-packages.md

feat(build): cross-platform desktop packaging; bump to 0.1.0

2026-07-24 23:49:50 +02:00

build-release.md

More clean up

2026-06-20 15:38:26 +02:00

build-windows.md

feat(build): cross-platform desktop packaging; bump to 0.1.0

2026-07-24 23:49:50 +02:00

codebase-audit.md

docs(audit): record device-verification results and the asset-protocol finding

2026-08-16 23:22:47 +02:00

defect-windows.md

docs(changelog): backfill every release, and date each fixed defect

2026-08-16 10:40:33 +02:00

release-checklist.md

chore: clean up repo organization

2026-06-21 09:52:09 +02:00

requirements.md

merge: Android runtime security (B1, B3)

2026-08-16 23:03:29 +02:00

traceability-ci.md

ci: enforce the checks the contributor rules already required

2026-08-16 22:51:44 +02:00

traceability.md

merge: Android runtime security (B1, B3)

2026-08-16 23:03:29 +02:00

traces-quick-ref.md

ci: enforce the checks the contributor rules already required

2026-08-16 22:51:44 +02:00

ux-flows.md

feat(search): answer search from a local index; tier downloads by lifetime

2026-08-04 17:35:17 +02:00