Carlos Florêncio
1.7 KiB
id, title, status, system, owners, created, last_updated, requirements
| id | title | status | system | owners | created | last_updated | requirements | |||
|---|---|---|---|---|---|---|---|---|---|---|
| plugins-runtime-response-preservation-design | Runtime response preservation | draft | plugins |
|
2026-09-21 | 2026-09-21 |
|
Runtime response preservation
This design extends same-origin runtime transport. Requirement 013 owns proxy-compatible response delivery. Requirement 012 retains startup failure detection. This change adds no trust-boundary exception.
setRuntimeHeaders shall send Cache-Control: no-store, no-transform for
runtime documents, assets, and the host bootstrap. The directive applies to
served representations, including retained releases. Stored package bytes and
digests remain unchanged. Do not add public or weaken capability validation.
Cloudflare documents no-transform as preventing automatic beacon injection
(Web Analytics FAQ).
An explicit proxy rule can still require operator correction if the proxy
ignores origin directives. Kandev does not change external proxy settings.
Extend the cookie-authenticated HTTPS test proxy with optional HTML injection that honors the response directive. Inject only into runtime HTML and preserve streaming for events. A control that removes the directive must reproduce the blocked-script startup failure. With the directive present, the real host must reach Ready on desktop and phone. This fixture proves the HTTP contract, not the configuration of a particular Cloudflare account.
See the recovery work package.