feat(standard): §9.1 no third-party subresources; §11.3.1 rename — v2.06 - #40
Conversation
Two changes, both small in diff and neither cosmetic. §9.1 closes a gap this document was itself falling through. §9's three PFA requirements are scoped to an "application", and a stylesheet shipped with a document is not one — so the HTML published at Standard.SpacecraftSoftware.org loaded its two §12 fonts from a third-party CDN, disclosing every reader's IP, User-Agent and Referer on every page view. No tracker, no analytics SDK: the letter of the "No Tracking/No Ads" row was satisfied while its purpose was not. That is a scoping defect, and the fix is to widen the scope rather than argue the row. §9.1 states the rule as a property of artifacts, not applications: nothing we ship fetches a subresource from a host we do not control at render time. Fonts are bundled and declared local()-first. Three readings are closed explicitly — a graceful fallback does not cure the fetch, because the request is the disclosure; a hyperlink is not a subresource; and an unavoidable dependency must be declared in README.md naming the host and the data disclosed. §11.3.1's `success` token is renamed Signal Green -> Aurora Green. The name described two different colours (Blue #28C76F, Tokyo Night #9ECE6A), and token names are one flat namespace to the tooling: the palette-css gate resolves a name first-writer-wins across the whole file, so a doubled name can shadow another palette's check. Blue's moves because Tokyo Night is registered verbatim and Blue's names are uniformly orbital. The hex does not change, so no ratio moves. makeinfo: zero errors, zero warnings. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3d91d94f1e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @strong{The scope is therefore widened, and the rule is stated as an | ||
| artifact property rather than an application property.} No Spacecraft | ||
| Software artifact --- application, library, document, stylesheet, diagram, | ||
| slide, or generated page --- may fetch a subresource from a host the | ||
| project does not control at render time. |
There was a problem hiding this comment.
When this repository builds its published HTML, Makefile:20 embeds spacecraft.css, whose line 13 still imports both fonts from https://fonts.googleapis.com; the tree also contains no bundled font files. Consequently, every generated page continues making exactly the third-party request prohibited here, so the stated privacy gap remains open until the font assets and local @font-face declarations are included in this change. The standard explicitly governs this repository itself.
AGENTS.md reference: AGENTS.md:L88-L88
Useful? React with 👍 / 👎.
| @documentencoding UTF-8 | ||
| @documentlanguage en | ||
| @settitle The Steelbore Standard 2.05 | ||
| @settitle The Steelbore Standard 2.06 |
There was a problem hiding this comment.
For the reviewed SHA, git cat-file -p cfa6535dd15044429180258a7f14b3e5e9885d1b contains no gpgsig or SSH signature header, so this commit cannot show as Verified when pushed. Recreate the proposed commit with the required cryptographic signature before it is published; the repository rule expressly applies this requirement to assistant-generated commits.
AGENTS.md reference: AGENTS.md:L90-L90
Useful? React with 👍 / 👎.
| not control, with any unavoidable exception declared in @file{README.md} | ||
| default |
There was a problem hiding this comment.
In the generated checklist this insertion leaves the pre-existing next line reading default, producing “exception declared in README.md default” while dropping the intended requirement that local storage is the default. Move default before the new semicolon in the Texinfo source and regenerate the Markdown companion so the audit checklist continues to state §9 accurately.
AGENTS.md reference: AGENTS.md:L31-L33
Useful? React with 👍 / 👎.
Follows the §9.1 text with the change that proves it. The stylesheet's @import of fonts.googleapis.com is replaced by @font-face rules whose src names local() only, backed by the existing monospace fallback: an installed copy is used, and where none exists the page degrades to a system font without opening a connection. §9.1's wording is softened to match what is actually shipped. The first draft said fonts are "bundled, never fetched" — but spacecraft.css exists in nine locations, and bundling would mean nine copies of two binaries plus their REUSE sidecars for a fidelity gain, not a privacy one. The baseline is now local()-only with bundling permitted where an artifact needs the face to render faithfully for every reader. What the section forbids is the third-party fetch, which neither form makes. The header, @font-face rules and :root block are now generated from steelbore.toml by the Construct-side generator, so this copy is written rather than edited. Its `Palette: … v1.34` pin had been wrong since v1.35 precisely because nothing generated it. Verified in the built output: zero googleapis references in the generated HTML, palette variables still present, three copies byte-identical. makeinfo: zero errors, zero warnings. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 participant
Two normative changes, batched into one version to avoid a second two-repo round trip.
§9.1 — closing a gap this document was falling through
§9's three PFA requirements are scoped to an application — "Every Spacecraft Software application must satisfy all three". A stylesheet shipped with a document is not an application, so nothing in §9 reached the HTML published at
Standard.SpacecraftSoftware.org, which loads its two §12 fonts from a third-party CDN. Every reader's IP address, User-Agent and Referer went to that CDN on every page view, with no notice and no opt-in.No tracker was involved and no analytics SDK was shipped — so the letter of the "No Tracking/No Ads" row was satisfied while its purpose plainly was not. That is a scoping defect, not a licence for the behaviour, and the honest fix is to widen the scope rather than argue the row.
§9.1 restates the rule as a property of artifacts rather than applications: nothing we ship fetches a subresource from a host the project does not control at render time. Fonts are bundled and declared with
@font-facelistinglocal()first, so an installed copy is preferred and no request fires at all. §12's licence whitelist (OFL, Apache-2.0, UFL, CC0) exists precisely so those files may be redistributed; its mention of Google Fonts has always been a place to verify free licensing, never a mandated delivery channel.Three readings are closed explicitly, because each was a way the rule could have been made hollow:
README.md, naming the host, the data disclosed, and why no bundled alternative exists — the same shape as a §3.1 memory-safe-language exemption.§11.3.1 —
Signal Green→Aurora GreenThe name described two different colours:
#28C76Fin Steelbore Blue and#9ECE6Ain Tokyo Night. Palette token names are a single flat namespace to the tooling that readssteelbore.toml—check-palette-css.pyresolves a name to a hex first-writer-wins across the whole file, so a doubled name can silently shadow another palette's check. It was latent only because no stylesheet happened to declare that token.Blue's is the one that moves. Tokyo Night is registered verbatim under §11.3.5 and its names form a coherent upstream-evoking set; Blue's are uniformly orbital (Orbit Navy, Deep Orbit, Orbit Divider, Ion White, Dawn Sky, Azure Hue, Azure Bright, Warm Thruster), so
Aurora Greenfits the set it joins.The hex does not change, so no contrast ratio moves and no project rendering Blue sees a different colour.
Unchanged
§9's three original PFA rows in full, every palette value, every contrast ratio, the §11.1 role contract, and the palette family and its membership. No project conforming at v2.05 becomes non-conformant at v2.06 on the palette side; the §9.1 obligation is new.
Verification
makeinfo --no-split— zero errors, zero warningsSignal Greenremains in the document (Tokyo Night's), confirmed by grepreuse lintand the §6.5 CRLF gate pass.mdcompanion regenerated via the DocBook routeConstruct follows at the same version and date with the
steelbore.tomlrename, the regenerated.scm, a new token-name-uniqueness CI gate, and thespacecraft.cssrebuild that §9.1 now requires.🤖 Generated with Claude Code