fix: deployment-surface hardening — Permissions-Policy, font pipeline, CSP headers

README.md

@@ -12,8 +12,8 @@
   <img src="https://img.shields.io/badge/Version-v1.24.1-6366F1" alt="v1.24.1">
   <img src="https://img.shields.io/badge/Storage-IndexedDB_v8-F59E0B" alt="IndexedDB v8">
   <img src="https://img.shields.io/badge/PWA-v3.0-5BB974?logo=pwa" alt="PWA v3.0">
-  <img src="https://img.shields.io/badge/i18n-19_locales-2844_keys-0EA5E9" alt="i18n 19 locales — 2844 keys">
-  <img src="https://img.shields.io/badge/Tests-5807%2B_%2F_525_files-22C55E" alt="5807+ tests / 525 files">
+  <img src="https://img.shields.io/badge/i18n-19_locales-2854_keys-0EA5E9" alt="i18n 19 locales — 2854 keys">
+  <img src="https://img.shields.io/badge/Tests-5807%2B_%2F_527_files-22C55E" alt="5807+ tests / 527 files">
   <img src="https://img.shields.io/codecov/c/github/qnbs/WorldScript-Studio?logo=codecov&label=Coverage" alt="Codecov Coverage">
   <img src="https://img.shields.io/badge/License-MIT-22C55E" alt="License MIT">
   <img src="https://img.shields.io/github/actions/workflow/status/qnbs/WorldScript-Studio/.github/workflows/ci.yml?branch=main&logo=github" alt="CI Status">
@@ -351,7 +351,7 @@ One-click encrypted export of your entire project library from **Settings → Da
 
 ### 🌐 Full Multi-Language Support
 
-Shipped UI locales with **2844 i18n keys** across all 19 languages — zero hardcoded user-facing strings:
+Shipped UI locales with **2854 i18n keys** across all 19 languages — zero hardcoded user-facing strings:
 
 - 🇩🇪 **German** (Deutsch)
 - 🇬🇧 **English**
@@ -460,8 +460,8 @@ The Settings → AI panel shows a live GPU status badge with adapter details and
 | **PDF Export**       | jsPDF                                                     | Client-side, configurable PDF document generation                    |
 | **Document Export**  | docx + jszip                                              | Word-compatible `.docx` generation (lazy-loaded)                     |
 | **PWA**              | Service Worker + Web App Manifest v3                     | Offline support, installability, Workbox chunking                    |
-| **i18n**             | Custom React Context (`I18nContext.tsx`)                  | 2844 keys × 19 locales (de/en/es/fr/it + ar/he/fa RTL Beta + ja/zh/pt/el/fi/sv/hu/is/eu Beta); EN fallback; `localStorage` persistence |
-| **Testing**          | Vitest 4.x (5807+ tests / 525 files) + Playwright E2E    | Unit/integration + cross-browser E2E; Stryker mutation (manual workflow)          |
+| **i18n**             | Custom React Context (`I18nContext.tsx`)                  | 2854 keys × 19 locales (de/en/es/fr/it + ar/he/fa RTL Beta + ja/zh/pt/el/fi/sv/hu/is/eu Beta); EN fallback; `localStorage` persistence |
+| **Testing**          | Vitest 4.x (5807+ tests / 527 files) + Playwright E2E    | Unit/integration + cross-browser E2E; Stryker mutation (manual workflow)          |
 | **Code Quality**     | Biome (lint + format) + TypeScript 7 (tsgo) strict       | `--error-on-warnings` in CI; zero `any` policy                      |
 | **Visualization**    | Force-directed graph                                      | Interactive character relationship network                           |
 | **Desktop**          | Tauri v2                                                  | Cross-platform installer; auto-updater via `latest.json`             |
@@ -498,7 +498,7 @@ WorldScript-Studio/
 │   ├── sw.js             # PWA Service Worker
 │   └── manifest.json     # PWA Web App Manifest v3
 ├── tests/
-│   ├── unit/             # Vitest unit tests (5807+ tests, 525 files)
+│   ├── unit/             # Vitest unit tests (5807+ tests, 527 files) — count spans tests/, components/, packages/*/tests/, not just this folder
 │   │   ├── ai/           # aiSmallModules, aiCoreFallbackPaths
 │   │   └── settings/     # WebLlmPanel, AiSections
 │   └── e2e/              # Playwright specs + helpers.ts
@@ -657,9 +657,9 @@ The main pipeline is [`.github/workflows/ci.yml`](.github/workflows/ci.yml). Opt
 | `scorecard`  | weekly + `main` push | OpenSSF Scorecard — SARIF uploaded to GitHub Code Scanning |
 
 **Current test metrics (2026-07-28):**
-- **5807+ unit tests** across **525 test files** — all passing
+- **5807+ unit tests** across **527 test files** — all passing
 - Coverage thresholds: lines ≥ 74 · branches ≥ 60 · functions ≥ 67 · statements ≥ 72 — enforced in CI (see Codecov badge for live metrics)
-- i18n: **2844 keys × 19 locales** (en/de/fr/es/it + ar/he/fa RTL Beta + ja/zh/pt/el/fi/sv/hu/is/eu Beta)
+- i18n: **2854 keys × 19 locales** (en/de/fr/es/it + ar/he/fa RTL Beta + ja/zh/pt/el/fi/sv/hu/is/eu Beta)
 
 **CI-cloud-first workflow (recommended):** On constrained hardware run **`pnpm run lint && pnpm run i18n:check && pnpm run typecheck`** locally, then push and let CI handle coverage, E2E, Lighthouse, and Stryker. Authoritative numbers come from CI artifacts (Codecov, JUnit). After CI goes green, update the README badges and `AUDIT.md` quality-gate line from the reported metrics. See **[`docs/CI.md`](docs/CI.md) § Cloud CI-first vs local development** for the full post-merge doc-update checklist.
 

docs/DEPLOYMENT.md

@@ -113,6 +113,21 @@ pnpm run build:edge && pnpm exec vite preview --base /
 
 ---
 
+## Header invariants per host
+
+HTTP response headers are **not** portable across targets — each host has its own config file, and one target can't set headers at all. Voice (`hooks/useMicLevel.ts`, `hooks/useSpeechRecognition.ts`) depends on `Permissions-Policy: microphone=(self)`; an empty `microphone=()` allowlist silently breaks it even for same-origin calls.
+
+| Host | Config file | Permissions-Policy | Content-Security-Policy |
+|------|-------------|---------------------|--------------------------|
+| **GitHub Pages** (canonical upstream) | *(none — platform has no header-injection mechanism)* | ❌ not settable at all (no meta-tag equivalent exists) | ⚠️ meta tag in [`index.html`](../index.html) only — this is the **sole** enforcement point on this host |
+| **Vercel** | [`vercel.json`](../vercel.json) `headers[]` | `microphone=(self)` | header set, mirrors the `index.html` meta CSP |
+| **Cloudflare Pages** | [`public/_headers`](../public/_headers) | `microphone=(self)` | header set, mirrors the `index.html` meta CSP |
+| **Docker / nginx** (`.github/workflows/docker.yml` image) | [`nginx.conf`](../nginx.conf) | `microphone=(self)` | header set, mirrors the `index.html` meta CSP |
+
+When both a header CSP and the `index.html` meta CSP are present, the browser enforces **both simultaneously** — a resource load must satisfy every active policy, so if the two diverge on an overlapping directive, the *more restrictive* result applies (not "the header wins and the meta tag is ignored"). The exception is `frame-ancestors` (and `sandbox`/`report-uri`): the CSP spec explicitly disallows these in a `<meta>`-delivered policy, so they only take effect via the header — that's why adding the header is a real hardening, not just a duplicate. If the two policies ever diverge on a directive both can express, keep them identical (see [ADR-0004](adr/0004-csp-connect-src-byok-tradeoff.md) and the regression tests in `tests/unit/csp.test.ts` / `tests/unit/deploymentHeaders.test.ts`) so the effective policy stays predictable rather than silently intersecting two different allowlists. **New header-origin rule:** any new external endpoint or directive change must be applied to all three header configs plus both test files, not just `index.html`.
+
+---
+
 ## Security notes
 
 - No server-side storage of manuscripts or API keys.

docs/SECURITY-THREAT-MODEL.md

@@ -128,6 +128,7 @@ Goal: Intercept/decrypt collaboration traffic
 | `sw.js` | I | Network-only for AI hosts | ✅ Complete |
 | `tauri.conf.json` | I | Strict CSP — explicit `connect-src` allowlist, no `https:` blanket | ✅ Complete |
 | `index.html` (web PWA) | I | CSP `connect-src 'self' https:` — broad HTTPS by design for BYOK; no `http:`/`ws:` wildcards | ⚠️ Documented tradeoff ([ADR-0004](adr/0004-csp-connect-src-byok-tradeoff.md)) |
+| `vercel.json` / `public/_headers` / `nginx.conf` | I | `Content-Security-Policy` response header, mirrors the meta CSP (`frame-ancestors 'none'` only takes effect as a header) | ✅ Complete on Vercel/CF/Docker. **GitHub Pages cannot set response headers at all** — the `index.html` meta CSP is the sole enforcement there. |
 
 ### CSP connect-src: web-vs-Tauri asymmetry (ADR-0004)
 
@@ -138,10 +139,18 @@ CSP. The redundant explicit cloud-provider entries were removed (they changed no
 and implied a hardening the policy did not provide). **Residual risk:** a `fetch` driven in the web
 PWA (e.g. via AI prompt injection) can reach any HTTPS origin. Mitigations: no secrets in
 `connect-src`-reachable globals; keys encrypted at rest and only attached to the user's chosen
-provider request; AI output never `eval`'d; host HTTP-header CSP tightens production further.
-`http:`/`ws:` scheme-wildcards remain disallowed (cleartext exfiltration blocked). The native **Tauri**
-CSP stays strict (no `https:`). Closing this fully = build-time CSP generation (Option C, v2.0).
-Regression test: `tests/unit/csp.test.ts`.
+provider request; AI output never `eval`'d. `http:`/`ws:` scheme-wildcards remain disallowed
+(cleartext exfiltration blocked). The native **Tauri** CSP stays strict (no `https:`). Closing this
+fully = build-time CSP generation (Option C, v2.0). Regression test: `tests/unit/csp.test.ts`.
+
+**Host header CSP (2026-07-28):** `vercel.json`, `public/_headers`, and `nginx.conf` now set a real
+`Content-Security-Policy` response header, identical to the meta CSP above — `connect-src` is
+unchanged (this tradeoff still applies there), but `frame-ancestors 'none'` only takes effect as a
+header, never as a meta tag, so that's a genuine additional control on Vercel/Cloudflare Pages/Docker.
+**GitHub Pages — the canonical upstream mirror — cannot set any HTTP response header**, so the meta
+CSP above remains its *only* enforcement point, and `Permissions-Policy` cannot be set there under any
+circumstance (no meta-tag equivalent exists for it). Regression test:
+`tests/unit/deploymentHeaders.test.ts`.
 
 ## Security Checklist
 

docs/adr/0004-csp-connect-src-byok-tradeoff.md

@@ -2,6 +2,7 @@
 
 - **Status:** Accepted
 - **Date:** 2026-06-10
+- **Revised: 2026-07-28** — corrected a false Consequences claim (see below); no change to the Decision.
 - **Deciders:** Maintainer + Claude Code
 - **Context tags:** security, csp, networking, byok, tauri
 
@@ -56,13 +57,28 @@ needed there.
   successful AI prompt injection into a code path that issues a request) can reach any HTTPS origin.
   Mitigations: no secrets are placed in `connect-src`-reachable globals; API keys are encrypted at
   rest and only attached to the user-configured provider request; AI output is never `eval`'d
-  (`CLAUDE.md` Key Constraints); the host (Vercel/CF) tightens CSP further via HTTP response headers
-  in production. Closing this fully requires build-time CSP generation from the provider registry +
-  a validated custom-endpoint allowlist (Option C), deferred to v2.0.
+  (`CLAUDE.md` Key Constraints). Closing this fully requires build-time CSP generation from the
+  provider registry + a validated custom-endpoint allowlist (Option C), deferred to v2.0.
+- **Revision note (2026-07-28):** this section previously claimed "the host (Vercel/CF) tightens CSP
+  further via HTTP response headers in production." That was **false** at the time it was written —
+  none of `vercel.json`, `public/_headers`, or `nginx.conf` set a `Content-Security-Policy` header, so
+  the accepted `connect-src` residual risk above had *no* documented compensating control. This has
+  now been fixed: `vercel.json`, `public/_headers`, and `nginx.conf` all set a real `Content-Security-Policy`
+  header, identical to the `index.html` meta CSP (`connect-src` is unchanged — this ADR's tradeoff still
+  applies there — but `frame-ancestors 'none'` is only meaningful as a header, never as a meta tag, so
+  that specific directive is a genuine new hardening on the three hosts that can set it).
+  **GitHub Pages — the canonical upstream mirror — cannot set any HTTP response header at all** (no
+  `_headers`-equivalent, no platform config surface); the `index.html` meta CSP is the *only*
+  enforcement point there, and `Permissions-Policy` has no meta-tag equivalent at all, so it cannot be
+  set on GitHub Pages under any circumstance. Any future claim in this ADR about host-level hardening
+  must be checked against all four surfaces, not assumed.
 - **Maintenance rule:** when adding a new **localhost** or **wss** endpoint, update **both**
   `index.html` and `src-tauri/tauri.conf.json`, and extend `tests/unit/csp.test.ts`. New **cloud
   HTTPS** providers need no `connect-src` change on web (covered by `https:`) but **do** need an
-  explicit entry in the strict Tauri `connect-src`.
+  explicit entry in the strict Tauri `connect-src`. **New header-origin or directive change:** update
+  `vercel.json`, `public/_headers`, and `nginx.conf` together, plus `tests/unit/csp.test.ts` and
+  `tests/unit/deploymentHeaders.test.ts` — a divergence between the header CSP and the meta CSP makes
+  the meta tag misleading (see `docs/DEPLOYMENT.md` § Header invariants per host).
 
 ## Rejected alternatives
 

index.css

@@ -30,12 +30,10 @@
     "Noto Sans Arabic", "Noto Sans Hebrew", "Inter", system-ui, -apple-system, sans-serif;
   --font-editor-rtl:
     "Noto Naskh Arabic", "Noto Sans Hebrew", "Merriweather", Georgia, "Times New Roman", serif;
-  /* QNBS-v3: Phase 3 — CJK/Greek font stacks for ja/zh/el Beta languages.
-     CJK: Noto Sans JP covers Hiragana, Katakana, and Kanji (loaded via Google Fonts).
-     Greek: Noto Sans GR covers monotonic and polytonic Greek (loaded via Google Fonts). */
-  --font-ui-cjk: "Noto Sans JP", "Inter", system-ui, -apple-system, sans-serif;
-  --font-ui-greek: "Noto Sans GR", "Inter", system-ui, -apple-system, sans-serif;
-  /* QNBS-v3: Korean (Hangul) — Noto Sans KR (loaded via Google Fonts CDN); Inter lacks Hangul glyphs. */
+  /* QNBS-v3: self-hosted via @fontsource (index.tsx), replacing a broken Google Fonts request ("Noto Sans GR" doesn't exist) — SC added for zh's Simplified Han forms; Greek uses the base "Noto Sans" family's greek subset. */
+  --font-ui-cjk: "Noto Sans JP", "Noto Sans SC", "Inter", system-ui, -apple-system, sans-serif;
+  --font-ui-greek: "Noto Sans", "Inter", system-ui, -apple-system, sans-serif;
+  /* QNBS-v3: Korean (Hangul) — Noto Sans KR, self-hosted via @fontsource; Inter lacks Hangul glyphs. */
   --font-ui-kr: "Noto Sans KR", "Inter", system-ui, -apple-system, sans-serif;
   --sc-prose-measure: 65ch;
 

index.html

@@ -48,8 +48,9 @@
     <!--
       CSP-Strategie:
       - script-src: nur eigene Skripte (Vite ES modules, kein inline nötig)
-      - style-src: eigene + unsafe-inline (React inline-styles) + fonts.googleapis.com für CJK/Greek
-      - font-src: self + fonts.gstatic.com für CJK/Greek (Google Fonts)
+      - style-src: eigene + unsafe-inline (React inline-styles) — keine Fremd-Font-CDN mehr,
+        CJK/Greek sind über @fontsource self-hosted (siehe index.tsx)
+      - font-src: self + data: — keine Fremd-Font-CDN mehr nötig (self-hosted, siehe index.tsx)
       - connect-src: 'self'
                     + https:  — intentional broad HTTPS scheme-source. REQUIRED by the
                       shipped BYOK feature `openAiCompatibleBaseUrl` (Settings → AI →
@@ -67,14 +68,14 @@
                     connect-src with no `https:` blanket; only the web PWA accepts the
                     broader scheme for BYOK. See ADR-0004 for the web-vs-Tauri rationale.
       - img-src: data: URLs für Base64-Bilder erlaubt
-      - Produktions-CSP wird über HTTP-Header des Hosts verschärft
+      - Produktions-CSP wird über HTTP-Header des Hosts verschärft (siehe ADR-0004, docs/DEPLOYMENT.md)
     -->
     <meta http-equiv="Content-Security-Policy"
           content="
             default-src 'self';
             script-src  'self';
-            style-src   'self' 'unsafe-inline' https://fonts.googleapis.com;
-            font-src    'self' https://fonts.gstatic.com data:;
+            style-src   'self' 'unsafe-inline';
+            font-src    'self' data:;
             img-src     'self' data: blob:;
             connect-src 'self' https: http://localhost:11434 http://127.0.0.1:11434 http://localhost:1234 http://127.0.0.1:1234 http://localhost:8000 http://127.0.0.1:8000 wss://y-webrtc-signaling.fly.dev wss://signaling.yjs.dev;
             worker-src  'self' blob:;
@@ -86,13 +87,7 @@
             upgrade-insecure-requests;
           " />
 
-    <!-- QNBS-v3: CJK (Noto Sans JP) + Korean (Noto Sans KR) + Greek (Noto Sans GR) via Google Fonts
-         CDN — these are the non-Latin scripts NOT self-hosted via @fontsource in index.tsx. Arabic/
-         Hebrew (incl. Noto Naskh Arabic) are self-hosted there, so they are intentionally NOT requested
-         here to avoid duplicate font downloads and RTL typography drift. -->
-    <link rel="preconnect" href="https://fonts.googleapis.com">
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-    <link href="https://fonts.googleapis.com/css2?family=Noto+Sans+JP:wght@400;500;700&family=Noto+Sans+KR:wght@400;500;700&family=Noto+Sans+GR:wght@400;500;700&display=swap" rel="stylesheet">
+    <!-- QNBS-v3: CJK/Greek self-hosted via @fontsource in index.tsx (no external font CDN) — "Noto Sans GR" doesn't exist at Google Fonts and 400'd the combined request, silently dropping JP/KR too. -->
 
     <title>WorldScript Studio</title>
 </head>

index.tsx

@@ -32,9 +32,19 @@ import '@fontsource/noto-sans-arabic/700.css';
 import '@fontsource/noto-sans-hebrew/400.css';
 import '@fontsource/noto-sans-hebrew/500.css';
 import '@fontsource/noto-sans-hebrew/700.css';
-/* QNBS-v3: Phase 3 — CJK fonts for ja/zh Beta languages.
-   Fonts loaded via Google Fonts CDN in index.html for ja/zh.
-   Greek uses system fallback (most systems have Noto Sans Greek pre-installed). */
+/* QNBS-v3: CJK (ja/zh) + Greek (el) self-hosted, replacing a broken Google Fonts CDN request (`Noto+Sans+GR` doesn't exist there, so the combined request 400'd and silently dropped JP/KR too). */
+import '@fontsource/noto-sans-jp/400.css';
+import '@fontsource/noto-sans-jp/500.css';
+import '@fontsource/noto-sans-jp/700.css';
+import '@fontsource/noto-sans-kr/400.css';
+import '@fontsource/noto-sans-kr/500.css';
+import '@fontsource/noto-sans-kr/700.css';
+import '@fontsource/noto-sans-sc/400.css';
+import '@fontsource/noto-sans-sc/500.css';
+import '@fontsource/noto-sans-sc/700.css';
+import '@fontsource/noto-sans/greek-400.css';
+import '@fontsource/noto-sans/greek-500.css';
+import '@fontsource/noto-sans/greek-700.css';
 
 import './index.css';
 import './register-sw';