From 3e058af40a5bf6a2b676130a8149cc1b489d2173 Mon Sep 17 00:00:00 2001
From: Markus Neusinger <2921697+MarkusNeusinger@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:40:10 +0200
Subject: [PATCH 1/8] fix(security): swap script-src 'unsafe-inline' for a
 per-request nonce
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The hash version was built, measured and rejected a day earlier (#11213):
Cloudflare JavaScript Detections injects an inline script at the edge whose
body carries a per-response ray id, so it has no hash that can be listed, and
a hash-only script-src blocked exactly that one script. Cloudflare documents
the way out — it copies a nonce out of the response header onto the script it
injects — and that is what this ships.

nginx mints the nonce from $request_id (16 random bytes as 32 hex digits, a
subset of the CSP nonce charset), sends it in the policy and stamps the same
value onto every <script> tag with sub_filter, at server level in both server
blocks because four different locations can end up serving the shell.

Three things keep the two halves from drifting apart: the shell is no-store
and sub_filter clears ETag and Last-Modified on its own, so a nonced body can
never be replayed under a fresh header; index.html is excluded from build-time
precompression, because gzip_static would serve an unstamped .gz; and the
deploy smoke refuses to promote a candidate whose script tags do not carry the
nonce from their own response header.

'strict-dynamic' stays out: it drops 'self' for scripts, and the built shell
links its chunks with <link rel="modulepreload"> — link elements the stamp
does not touch and trust propagation does not cover.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UEScQMZFvxxNNyNJYryfa3
---
 agentic/docs/project-guide.md     |  30 ++++
 app/cloudbuild.yaml               |  20 +++
 app/index.html                    |  11 +-
 app/nginx.conf                    |  31 ++++
 app/security-headers.conf         | 101 ++++++-----
 app/vite.config.ts                |  12 +-
 changelog.d/csp-nonce.md          |  23 +++
 tests/unit/api/test_csp_policy.py | 267 +++++++++++++++++++++---------
 8 files changed, 376 insertions(+), 119 deletions(-)
 create mode 100644 changelog.d/csp-nonce.md

diff --git a/agentic/docs/project-guide.md b/agentic/docs/project-guide.md
index ca884a89af1..76de07c4329 100644
--- a/agentic/docs/project-guide.md
+++ b/agentic/docs/project-guide.md
@@ -1065,6 +1065,36 @@ place, and the residual is narrow: it needs the previous candidate to pass every
 well, so the worst case is promoting a revision that was believed smoked, not shipping a
 page known to be broken.
 
+### Rollback
+
+Every deploy names its revision deterministically (`--revision-suffix=b$BUILD_ID`) and
+promotes it explicitly, so the previous revision is still there, still healthy, and one
+command away. Rolling back needs no rebuild and takes under a minute:
+
+```bash
+# 1. Find the revision that served before the current one.
+gcloud run revisions list --service anyplot-app --region europe-west4 \
+  --format='table(name, creationTimestamp, status.conditions[0].status)' --limit 5
+
+# 2. Send all traffic back to it.
+gcloud run services update-traffic anyplot-app --region europe-west4 \
+  --to-revisions=<previous-revision>=100
+```
+
+Same shape for `anyplot-backend`. This is the lever for anything that ships inside the
+image and only reveals itself in production. The current example is the CSP nonce path in
+`app/security-headers.conf`: if Cloudflare ever stops stamping its edge-injected script
+with the nonce it reads from our response header, the previous revision still serves the
+`'unsafe-inline'` policy byte for byte.
+
+Deliberately NOT built for that case: a Cloud Run environment variable that flips the
+policy inside a running revision. nginx cannot read the process environment from its
+configuration, so it would take a startup templating step (`envsubst` into a writable
+path — and `/etc/nginx` is read-only in the unprivileged image), which neither CI nor a
+local checkout here can exercise. A mechanism whose failure mode is "the container does
+not start", and which nothing can test, is a worse rollback than a traffic split the
+deploy pipeline already proves on every build.
+
 ## Debugging Tips
 
 ### Database Connection Issues
diff --git a/app/cloudbuild.yaml b/app/cloudbuild.yaml
index 81e86d956de..185fc2285a0 100644
--- a/app/cloudbuild.yaml
+++ b/app/cloudbuild.yaml
@@ -158,6 +158,26 @@ steps:
         }
         # Humans get the SPA shell.
         expect "$$HUMAN" "/" '<div id="root">' "a browser did not get the SPA shell"
+        # …and every <script> tag in that shell carries the CSP nonce from its
+        # own response header. The two halves are one `$$request_id` read twice
+        # — `add_header` in security-headers.conf, `sub_filter` in nginx.conf —
+        # and losing the stamp is the silent failure this probe exists for: a
+        # precompressed shell served by `gzip_static`, a location the filter
+        # never reaches, a renamed variable. The page keeps its `<div id="root">`
+        # and looks perfectly healthy to every probe above while the browser
+        # blocks every inline script on it, because a nonce in the policy makes
+        # 'unsafe-inline' inert. Cheap to check here, four weeks of nobody
+        # noticing if it is not.
+        curl -fsS $$RETRY -A "$$HUMAN" -D head.out -o body.out "$$URL/" \
+          || { echo "candidate did not serve the shell for the nonce probe"; exit 1; }
+        NONCE=$$(grep -i '^content-security-policy:' head.out | grep -o 'nonce-[0-9a-f]*' | head -1)
+        test -n "$$NONCE" || { echo "the shell's Content-Security-Policy carries no nonce"; exit 1; }
+        grep -qF "<script nonce=\"$${NONCE#nonce-}\"" body.out \
+          || { echo "no <script> tag carries the header's $$NONCE — the sub_filter stamp did not run"; exit 1; }
+        UNSTAMPED=$$(grep -o '<script[^>]*>' body.out | grep -v 'nonce=' | wc -l)
+        test "$$UNSTAMPED" = "0" \
+          || { echo "$$UNSTAMPED <script> tag(s) in the shell carry no nonce and would be blocked"; exit 1; }
+        echo "OK: CSP nonce on every script tag of the shell"
         # Crawlers get the prerendered page through @seo_proxy. The canonical
         # link is the marker: the SPA shell carries none at all, and its value
         # names the route, so one grep proves both "the bot hop ran" and "the
diff --git a/app/index.html b/app/index.html
index 921cd504b86..de9537798f4 100644
--- a/app/index.html
+++ b/app/index.html
@@ -25,9 +25,14 @@
     </script>
 
     <!-- On-device debug console (Eruda), gated behind ?debug=1 so it never
-         ships to normal users. Plain <script> (not type="module") so it runs
-         before module parse-time errors and can capture them — critical for
-         debugging mobile-only crashes where remote DevTools aren't available. -->
+         ships to normal users. A classic script element (not type="module") so
+         it runs before module parse-time errors and can capture them — critical
+         for debugging mobile-only crashes where remote DevTools aren't
+         available. The opening tag is described rather than written out: nginx
+         stamps the CSP nonce with a blunt `sub_filter` over the literal string,
+         so a comment containing it comes back to the browser with a stray
+         `nonce=` inside — harmless, but confusing in the one artefact anyone
+         debugging CSP will read. -->
     <script>
       (function () {
         try {
diff --git a/app/nginx.conf b/app/nginx.conf
index b4c3ad6405a..ee56ce3ee74 100644
--- a/app/nginx.conf
+++ b/app/nginx.conf
@@ -165,11 +165,35 @@ server {
     # levels — see security-headers.conf).
     include /etc/nginx/security-headers.conf;
 
+    # The delivery half of the CSP nonce; the header half and the whole
+    # reasoning are in security-headers.conf. Stamp the SAME `$request_id` the
+    # policy names onto every `<script` tag of the HTML we serve. A nonce makes
+    # 'unsafe-inline' inert, so a tag that misses the stamp is a tag that stops
+    # running — and the first one in the shell is the theme resolver.
+    #
+    # Server level rather than per-location, deliberately: four locations can
+    # end up serving index.html — the exact match, the SPA fallback, and in the
+    # python server block below two regex routes whose `try_files /index.html
+    # =404` serves the file IN PLACE, without the internal redirect that would
+    # re-run location matching. A stamp missing from one of those is a blank
+    # page on exactly those routes and nowhere else.
+    #
+    # `<script` cannot match `</script>`, and sub_filter's default type list is
+    # text/html alone, so this never reaches into a .js chunk or a JSON body.
+    # It does also pass over the proxied crawler pages from @seo_proxy, which
+    # carry no executable script of ours — one JSON-LD data block, which no
+    # browser executes — and crawlers run no JS either way.
+    sub_filter '<script' '<script nonce="$request_id"';
+    sub_filter_once off;
+
     # Compression - serve pre-compressed gzip files from Vite build when available
     gzip on;
     gzip_vary on;
     gzip_min_length 1024;
     gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json;
+    # Serves `<file>.gz` untouched when it exists, which is exactly what
+    # sub_filter cannot rewrite. index.html is therefore excluded from
+    # precompression in app/vite.config.ts — the nonce depends on it.
     gzip_static on;
 
     # Vite-fingerprinted assets — filename changes on every build, safe to cache forever
@@ -380,6 +404,13 @@ server {
     # main server block above).
     include /etc/nginx/security-headers.conf;
 
+    # CSP nonce, same as the main server block — and this block is the reason
+    # it sits at server level: the two spec-route regex locations below serve
+    # `/index.html` through `try_files` as a FILE, so they never reach the
+    # `location = /index.html` block and would carry no stamp at all.
+    sub_filter '<script' '<script nonce="$request_id"';
+    sub_filter_once off;
+
     gzip on;
     gzip_vary on;
     gzip_min_length 1024;
diff --git a/app/security-headers.conf b/app/security-headers.conf
index 2e3c38e2b5f..58d74eeb4f2 100644
--- a/app/security-headers.conf
+++ b/app/security-headers.conf
@@ -7,54 +7,81 @@
 # location, re-include this file there.
 #
 # CSP notes (must not break the SPA — see app/index.html and app/src):
-# - script-src 'unsafe-inline': index.html ships three executable inline
+# - script-src 'nonce-$request_id': index.html ships three executable inline
 #   scripts (theme resolver, Eruda loader, Plausible stub), and a FOURTH one
 #   arrives that this repository does not write — see the block below.
 # - script-src cdn.jsdelivr.net: on-device debug console (Eruda) behind ?debug=1.
+#   Reached through a `src`, so the host is what CSP judges, not a nonce.
 #
-# Why script-src still says 'unsafe-inline' (measured 2026-09-03)
-# ---------------------------------------------------------------
-# Replacing 'unsafe-inline' with the sha256 of each inline script is the
-# obvious hardening — index.html is static, so its scripts are fixed at build
-# time, and `yarn build` was verified to copy them through byte-for-byte. The
-# three hashes are recorded below and pinned by tests/unit/api/test_csp_policy.py
-# so they never go stale.
+# Why script-src is a NONCE and no longer 'unsafe-inline' (2026-09-04)
+# --------------------------------------------------------------------
+# The obvious hardening — replace 'unsafe-inline' with the sha256 of each
+# inline script — was built, measured and rejected on 2026-09-03 (#11213).
+# index.html is static, so its three hashes are stable, but a FOURTH inline
+# script arrives after nginx: Cloudflare JavaScript Detections injects one into
+# every HTML response at the edge, and its body carries a per-response ray id
+# and timestamp:
 #
-# They cannot be ENFORCED yet. Cloudflare JavaScript Detections injects an
-# inline script into every HTML response at the edge, after nginx, and its body
-# carries a per-response ray id and timestamp — so its hash differs on every
-# request and cannot be listed here. The whole policy was mounted over the LIVE
-# production bundle through a local proxy and loaded twice, once with each
-# script-src:
+#     window.__CF$cv$params={r:'a35d48a2bdf1be85',t:'MTc4ODUyNzk0NA=='};…
+#
+# A body that differs per response has no fixed hash, so it can never be
+# listed. Mounted over the live production bundle and loaded twice, the two
+# policies measured:
 #
 #     'unsafe-inline'  → Cloudflare's script runs (its hidden iframe appears)
 #     hashes only      → "Executing inline script violates … The action has
 #                        been blocked", no iframe, no JS-detection signal
 #
-# Exactly one script is blocked, and it is the edge's. Shipping the hash policy
-# would silently degrade bot detection on a site whose origin gate leans on the
-# edge — so it is not shipped, and 'unsafe-inline' is NOT joined by hashes
-# either: a browser ignores 'unsafe-inline' as soon as a hash is present, so the
-# two together are the same breakage wearing a stricter-looking policy.
+# Turning JavaScript Detections off is not the way out either: the Free plan
+# refuses it while Bot Fight Mode is on (the API rejects `enable_js=false`),
+# and it would be a security trade rather than a fix.
+#
+# A NONCE is the way out, and it is Cloudflare's own recommendation. Their
+# JavaScript Detections page (developers.cloudflare.com/bots/
+# additional-configurations/javascript-detections/, read 2026-09-04) says: "If
+# your CSP uses a `nonce` for script tags, Cloudflare will add these nonces to
+# the scripts it injects by parsing your CSP response header", and "We highly
+# discourage the use of `unsafe-inline` and instead recommend the use CSP
+# `nonces` in script tags which we parse and support in our CDN." Two
+# conditions come with it, and both hold here: the nonce must arrive in the
+# response HEADER (JavaScript Detections "is not supported with `nonce` set via
+# `<meta>` tags" — this file is the header), and `/cdn-cgi/challenge-platform/`
+# must be reachable, which `script-src 'self'` covers because it is same-origin.
+#
+# The nonce is `$request_id`: nginx's own 16 random bytes, rendered as 32 hex
+# digits. Hex is a subset of the base64-value charset the CSP nonce grammar
+# accepts, and 128 bits is above the 128 the spec asks for. nginx stamps it on
+# every `<script` tag of the shell with `sub_filter` (app/nginx.conf), so the
+# tag and this header always carry the SAME value — they are the same variable
+# read twice in one request.
+#
+# Two consequences worth knowing before editing either half:
+#
+#   * A nonce makes 'unsafe-inline' inert. A browser ignores 'unsafe-inline'
+#     the moment a nonce or hash appears, so the two together are not
+#     belt-and-braces — they are the nonce policy wearing a permissive label.
+#     A test forbids the combination.
+#   * A nonced response must never be replayed. `location = /index.html` sends
+#     `no-store`, and `sub_filter` additionally clears `Last-Modified` and the
+#     `ETag` (nginx does that itself whenever a body filter rewrites the
+#     response), so no client can revalidate its way into an old body under a
+#     new header. The other half of the same rule lives in app/vite.config.ts:
+#     the shell is excluded from precompression, because `gzip_static` would
+#     hand out the untouched `.gz` and `sub_filter` never sees a compressed
+#     body.
 #
-# The way out is a NONCE, not a hash. Cloudflare parses this response header
-# and stamps its own injected script with the nonce it finds there (their
-# JavaScript Detections docs say so explicitly, and recommend it over
-# 'unsafe-inline'). That needs nginx to mint one per request and rewrite
-# index.html's `<script>` tags with it — `sub_filter` plus `gzip_static off`
-# for the shell — which is a delivery change no test in this repo can prove and
-# no local nginx here can run. It is the open item; the alternative is turning
-# JavaScript Detections off in the zone, which is a security trade, not a fix.
+# 'strict-dynamic' is deliberately NOT here. It would drop 'self' for scripts,
+# and Vite's shell links its chunks with `<link rel="modulepreload">` — link
+# elements the stamp does not touch and 'strict-dynamic' does not cover. The
+# chunks stay on 'self'.
 #
-# The hashes of app/index.html's three executable inline scripts, ready for the
-# day one of those two happens (JSON-LD blocks need none — a browser never
-# executes `type="application/ld+json"`, so CSP never asks):
-#   'sha256-4VdX7wfQgL9PnVFBkrDWBbPpiST1xriKljA5URM8DcM='  theme resolver
-#   'sha256-HfNBzShy4Q4W9GmmnPkcx36GlrZI5mkU15xjpyh1pmk='  Eruda loader
-#   'sha256-BiWO1y5gYRbSlOrPh1rJPXYnES50FX9PwJpfXfWJy0A='  Plausible stub
-# A hash covers the exact bytes between `<script>` and `</script>`, so a single
-# re-indent invalidates one. The test recomputes them from index.html on every
-# run, which is what keeps this block honest while it waits.
+# Rolling back without a rebuild, if the edge ever stops honouring the nonce:
+#   gcloud run services update-traffic anyplot-app --region europe-west4 \
+#     --to-revisions=<previous-revision>=100
+# (`gcloud run revisions list --service anyplot-app --region europe-west4`
+# names them; every deploy gives its revision the deterministic suffix
+# `-b$BUILD_ID`, and the previous one still serves the 'unsafe-inline' policy
+# byte for byte.) agentic/docs/project-guide.md § Rollback has the long form.
 # - style-src 'unsafe-inline': MUI/emotion inject inline styles.
 # - img/font/connect storage.googleapis.com: plot previews + MonoLisa fonts on GCS.
 # - img/connect/frame api.anyplot.ai: API calls, og images, interactive-preview
@@ -70,4 +97,4 @@ add_header X-Frame-Options "SAMEORIGIN" always;
 add_header Referrer-Policy "strict-origin-when-cross-origin" always;
 # 180 days — moderate max-age, no includeSubDomains/preload (conservative first rollout).
 add_header Strict-Transport-Security "max-age=15552000" always;
-add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://storage.googleapis.com https://api.anyplot.ai; font-src 'self' data: https://storage.googleapis.com; connect-src 'self' https://api.anyplot.ai https://storage.googleapis.com https://plausible.io https://api.github.com; frame-src 'self' https://api.anyplot.ai; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
+add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-$request_id' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://storage.googleapis.com https://api.anyplot.ai; font-src 'self' data: https://storage.googleapis.com; connect-src 'self' https://api.anyplot.ai https://storage.googleapis.com https://plausible.io https://api.github.com; frame-src 'self' https://api.anyplot.ai; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
diff --git a/app/vite.config.ts b/app/vite.config.ts
index 8425a540754..7e51c9d98d2 100644
--- a/app/vite.config.ts
+++ b/app/vite.config.ts
@@ -21,8 +21,16 @@ export default defineConfig({
       overlay: { initialIsOpen: false },
       enableBuild: false,
     }),
-    compression({ algorithm: 'gzip', threshold: 1024 }),
-    compression({ algorithm: 'brotliCompress', threshold: 1024 }),
+    // index.html is EXCLUDED, and that is load-bearing rather than tidiness.
+    // nginx rewrites the shell per request to stamp the CSP nonce onto its
+    // <script> tags (app/nginx.conf, app/security-headers.conf), and
+    // `gzip_static on` would hand out the precompressed copy instead —
+    // untouched, unstamped, and with a policy that then blocks every inline
+    // script on the page. sub_filter only ever sees uncompressed bodies. The
+    // hashed chunks under /assets/ are what precompression is actually for,
+    // and they keep it; the shell is 11 kB and nginx still gzips it on the fly.
+    compression({ algorithm: 'gzip', threshold: 1024, exclude: [/index\.html$/] }),
+    compression({ algorithm: 'brotliCompress', threshold: 1024, exclude: [/index\.html$/] }),
   ],
   server: {
     port: 3000,
diff --git a/changelog.d/csp-nonce.md b/changelog.d/csp-nonce.md
new file mode 100644
index 00000000000..f43eb8e9240
--- /dev/null
+++ b/changelog.d/csp-nonce.md
@@ -0,0 +1,23 @@
+### Security
+
+- **`script-src` drops `'unsafe-inline'` for a per-request nonce.** nginx mints
+  one from `$request_id` — 16 random bytes as 32 hex digits — sends it in the
+  policy and stamps the same value onto every `<script>` tag of the shell with
+  `sub_filter`, in both server blocks. The measurement that stopped the hash
+  version a day earlier is what makes this the right shape: Cloudflare
+  JavaScript Detections injects an inline script at the edge whose body carries
+  a per-response ray id, so it has no listable hash — but Cloudflare documents
+  that it copies a nonce out of the response header onto that script, which a
+  hash could never be. Cache safety comes from three sides: the shell is
+  `no-store`, `sub_filter` clears `ETag` and `Last-Modified` on its own, and
+  `index.html` is now excluded from build-time precompression, because
+  `gzip_static` would otherwise serve an unstamped `.gz` and quietly block
+  every inline script on the page.
+
+### Changed
+
+- **The frontend deploy smoke checks the nonce before promoting.** The
+  candidate has to serve a shell whose `<script>` tags all carry the nonce from
+  that same response's header. A lost stamp leaves a page that looks healthy to
+  every other probe and runs no inline script at all, so it is worth the two
+  extra curls.
diff --git a/tests/unit/api/test_csp_policy.py b/tests/unit/api/test_csp_policy.py
index e41a63327cd..eacdefe8724 100644
--- a/tests/unit/api/test_csp_policy.py
+++ b/tests/unit/api/test_csp_policy.py
@@ -1,16 +1,18 @@
 """The delivery-side security policy, held against the files it describes.
 
 `app/security-headers.conf` is a string in an nginx include. Nothing compiles
-it, nothing imports it, and three things in it can drift silently — each of
+it, nothing imports it, and four things around it can drift silently — each of
 which has cost someone a day somewhere:
 
-1. **The inline-script hashes.** `script-src` cannot enforce them yet —
-   Cloudflare JavaScript Detections injects a fourth inline script at the edge
-   whose body changes per response (measured 2026-09-03, the reasoning is in
-   `security-headers.conf`) — so the file records them in a comment instead,
-   ready for the day a nonce or a zone setting makes the switch possible. A
-   recorded hash that no longer matches its script is worse than none: it looks
-   like readiness. This recomputes them on every run.
+1. **The CSP nonce, which lives in two files at once.** `script-src` names
+   `'nonce-$request_id'` here; `app/nginx.conf` stamps that same `$request_id`
+   onto every `<script` tag with `sub_filter`. Nothing but agreement makes them
+   one mechanism, and disagreement is invisible: the page still arrives, the
+   header still reads as a modern policy, and every inline script on it is
+   blocked — a nonce in the policy makes `'unsafe-inline'` inert, so there is
+   no fallback left to catch the fall. The delivery half also depends on the
+   shell NOT being precompressed (`gzip_static` would hand out the untouched
+   `.gz`) and on it never being stored for replay.
 
 2. **nginx's `add_header` inheritance.** A location with any `add_header` of
    its own drops every inherited one. `app/nginx.conf` therefore re-includes
@@ -22,14 +24,21 @@
    nginx in front of it, so nothing there inherits anything from the website —
    and it has two exits, only one of which is a middleware.
 
+4. **The keywords a hardening pass reaches for by reflex.** `'unsafe-inline'`
+   beside a nonce, `'strict-dynamic'` over a shell that links its chunks with
+   `<link rel="modulepreload">`, a `report-to` group nobody defined: each looks
+   stricter and is quietly worse.
+
+What this file cannot see is whether Cloudflare copies the nonce onto the
+script IT injects at the edge — that is a live measurement, recorded in
+`app/security-headers.conf` next to the directive it justifies.
+
 The nginx parse is deliberately crude — a brace counter over one file we write
 ourselves, not a config parser. It only has to be right about this file.
 """
 
 from __future__ import annotations
 
-import base64
-import hashlib
 import re
 from pathlib import Path
 
@@ -39,52 +48,12 @@
 
 
 ROOT = Path(__file__).resolve().parents[3]
-INDEX_HTML = ROOT / "app" / "index.html"
 HEADERS_CONF = ROOT / "app" / "security-headers.conf"
 NGINX_CONF = ROOT / "app" / "nginx.conf"
+VITE_CONFIG = ROOT / "app" / "vite.config.ts"
 
 INCLUDE_LINE = "include /etc/nginx/security-headers.conf;"
 
-# Comments are stripped BEFORE the script scan. index.html documents its own
-# Eruda loader with the words `Plain <script> (not type="module")`, and a
-# regex that reads that as a tag hashes the comment prose instead of the
-# script — silently, and with a hash that looks perfectly plausible.
-_COMMENT = re.compile(r"<!--.*?-->", re.DOTALL)
-# The closing tag is `</script` followed by whitespace, `/` or `>`, and then
-# anything up to the first `>` — which is what a browser accepts and what
-# CodeQL's py/bad-tag-filter insists on (`</script >`, `</script\t\n bar>`). A
-# regex that missed one of those would swallow the rest of the document into a
-# single "script body" and hash that, silently. The lookahead is what keeps
-# `</scriptfoo>` from counting as a close.
-_SCRIPT = re.compile(r"<script(?P<attrs>[^>]*)>(?P<body>.*?)</script(?=[\s/>])[^>]*>", re.DOTALL | re.IGNORECASE)
-_TYPE = re.compile(r"""type\s*=\s*["']?([^"'\s>]+)""", re.IGNORECASE)
-# An EXTERNAL script, which CSP judges by its URL and never by a hash. HTML
-# attribute names are case-insensitive and whitespace around `=` is legal, so
-# `<script SRC = "…">` is external too — a plain `"src=" in attrs` called it
-# inline and would have demanded a hash for a script with no body (Copilot
-# review). `\b` keeps it from matching a `data-src=` or an `xlink:src=`.
-_SRC = re.compile(r"\bsrc\s*=", re.IGNORECASE)
-# A <script> whose type is none of these is a DATA BLOCK (the three JSON-LD
-# blocks in index.html): the browser never executes it, and CSP never asks for
-# a hash.
-_EXECUTABLE_TYPES = {"", "module", "text/javascript", "application/javascript"}
-
-
-def inline_script_hashes(html: str) -> list[str]:
-    """`sha256-…` for every executable inline script, in document order."""
-    html = _COMMENT.sub("", html)
-    out = []
-    for match in _SCRIPT.finditer(html):
-        attrs = match.group("attrs")
-        if _SRC.search(attrs):
-            continue
-        declared = _TYPE.search(attrs)
-        if (declared.group(1).lower() if declared else "") not in _EXECUTABLE_TYPES:
-            continue
-        digest = hashlib.sha256(match.group("body").encode("utf-8")).digest()
-        out.append(f"sha256-{base64.b64encode(digest).decode('ascii')}")
-    return out
-
 
 def csp_directives() -> dict[str, list[str]]:
     """The Content-Security-Policy(-Report-Only) value, split by directive."""
@@ -129,40 +98,184 @@ def locations_with_add_header() -> list[str]:
     return [b for b in blocks if _ADD_HEADER.search(_without_comments(b))]
 
 
-def recorded_hashes() -> list[str]:
-    """The `sha256-…` values app/security-headers.conf keeps in its comment."""
-    conf = HEADERS_CONF.read_text(encoding="utf-8")
-    comments = "\n".join(line for line in conf.splitlines() if line.lstrip().startswith("#"))
-    return re.findall(r"'(sha256-[A-Za-z0-9+/=]+)'", comments)
-
-
-def test_recorded_hashes_match_the_inline_scripts_of_index_html():
-    """The hashes the conf holds in reserve still describe the scripts they name."""
-    expected = inline_script_hashes(INDEX_HTML.read_text(encoding="utf-8"))
-    assert expected, "app/index.html has no inline scripts — did the extraction break?"
-    assert sorted(recorded_hashes()) == sorted(expected), (
-        "the hashes recorded in app/security-headers.conf and app/index.html's inline "
-        "scripts disagree.\n"
-        f"  recorded: {sorted(recorded_hashes())}\n"
-        f"  computed: {sorted(expected)}\n"
-        "Recompute after ANY edit to an inline <script> — even whitespace."
+def server_blocks() -> list[str]:
+    """Every `server { … }` block of app/nginx.conf, as raw text."""
+    conf = NGINX_CONF.read_text(encoding="utf-8")
+    blocks = []
+    for match in re.finditer(r"^server\s*\{", conf, re.MULTILINE):
+        depth = 0
+        for i in range(match.end() - 1, len(conf)):
+            if conf[i] == "{":
+                depth += 1
+            elif conf[i] == "}":
+                depth -= 1
+                if depth == 0:
+                    blocks.append(conf[match.start() : i + 1])
+                    break
+    return blocks
+
+
+# The nonce as the stamp spells it (`nonce="$request_id"`). Its counterpart in
+# the header is read out of the parsed DIRECTIVE, never out of the raw file:
+# security-headers.conf explains itself at length and quotes `'nonce-…'` in its
+# own prose, so a regex over the whole file happily reports a nonce that the
+# policy no longer carries — which is how this very test first passed while the
+# header had none at all.
+_HEADER_NONCE = re.compile(r"^'nonce-(\$[A-Za-z_][A-Za-z0-9_]*)'$")
+_STAMP = re.compile(r"""sub_filter\s+'<script'\s+'<script nonce="(\$[A-Za-z_][A-Za-z0-9_]*)"'\s*;""")
+
+
+def header_nonce_variable() -> str | None:
+    """The nginx variable `script-src` reads its nonce from, if any."""
+    for token in csp_directives().get("script-src", []):
+        match = _HEADER_NONCE.match(token)
+        if match:
+            return match.group(1)
+    return None
+
+
+def test_the_policy_takes_its_nonce_from_a_per_request_variable():
+    """A nonce is only a nonce if it is fresh per response.
+
+    A literal would be a shared secret baked into an image and reused for the
+    lifetime of a revision — which is to say, not a secret. `$request_id` is
+    nginx's own 16 random bytes as 32 hex digits: hex is inside the CSP nonce
+    grammar's charset, and 128 bits is at the ceiling of what the spec asks
+    for.
+    """
+    script_src = csp_directives()["script-src"]
+    nonces = [t for t in script_src if t.startswith("'nonce-")]
+    assert nonces == ["'nonce-$request_id'"], (
+        f"script-src carries {nonces or 'no nonce'}; expected exactly one, "
+        "'nonce-$request_id'. A literal nonce is a constant, and a constant "
+        "nonce is 'unsafe-inline' with extra steps."
+    )
+    assert "'unsafe-inline'" not in script_src, (
+        "script-src still allows 'unsafe-inline'. With a nonce present a browser "
+        "ignores it anyway, so this only misleads the next reader."
+    )
+
+
+def test_the_header_and_the_stamp_name_the_same_variable():
+    """The one failure with no symptom until every inline script is dead.
+
+    The header promises a nonce; `sub_filter` writes one onto the tags. Nothing
+    connects them but this equality, and if it breaks the page still arrives,
+    still renders its shell, still reports a strict-looking policy — while the
+    browser refuses every script in it.
+    """
+    stamps = _STAMP.findall(NGINX_CONF.read_text(encoding="utf-8"))
+    assert stamps, (
+        "app/nginx.conf stamps no CSP nonce onto <script> tags. The policy's nonce "
+        "makes 'unsafe-inline' inert, so without the stamp NOTHING inline runs."
+    )
+    assert set(stamps) == {header_nonce_variable()}, (
+        f"the stamp writes {sorted(set(stamps))} but script-src reads "
+        f"{header_nonce_variable()!r} — the tags would carry a nonce the policy "
+        "does not allow."
+    )
+
+
+def test_every_server_block_stamps_the_nonce():
+    """Both vhosts, at server level, because four locations serve the shell.
+
+    The exact `= /index.html`, the SPA fallback, and — in the python block —
+    two regex routes whose `try_files /index.html =404` serves the file in
+    place, with no internal redirect to re-run location matching. A stamp
+    placed per-location is a stamp missing from whichever one is forgotten,
+    and it fails on those routes alone.
+    """
+    missing = [
+        block.splitlines()[0]
+        for block in server_blocks()
+        if INCLUDE_LINE in block and not _STAMP.search(_without_comments(block))
+    ]
+    assert not missing, (
+        f"these server blocks send the CSP but never stamp its nonce: {missing}. "
+        "Every <script> tag they serve would be blocked."
+    )
+    assert all("sub_filter_once off;" in block for block in server_blocks() if _STAMP.search(block)), (
+        "sub_filter replaces only the FIRST match without `sub_filter_once off` — "
+        "the shell has seven script tags and six of them would go unstamped."
+    )
+
+
+def test_the_shell_is_never_precompressed():
+    """`gzip_static` hands out the `.gz` untouched, and sub_filter never sees it.
+
+    The prettiest way to break this whole mechanism: leave a build artefact in
+    place. nginx would serve `index.html.gz` byte for byte, the stamp would
+    never run, the header would still carry its nonce, and every inline script
+    on the page would be refused — with nothing in any log to say why.
+    """
+    config = VITE_CONFIG.read_text(encoding="utf-8")
+    calls = re.findall(r"compression\(\{[^}]*\}\)", config)
+    assert calls, "app/vite.config.ts declares no compression plugin — did it move?"
+    unguarded = [c for c in calls if "index" not in c.split("exclude")[-1]]
+    assert not unguarded, (
+        "a compression plugin in app/vite.config.ts does not exclude index.html: "
+        f"{unguarded}. The shell is rewritten per request for the CSP nonce and "
+        "must not exist as a precompressed file."
+    )
+
+
+def test_the_shell_is_never_stored():
+    """A nonced response that can be replayed is a nonced response that fails.
+
+    A stored shell pairs yesterday's `nonce="…"` in the body with today's
+    header — and a 304 revalidation is worse, because HTTP says the 304's
+    headers REPLACE the stored ones, so the browser ends up holding exactly
+    that mismatch. Two things prevent it and only one of them is visible here:
+    `sub_filter` drops `Last-Modified` and `ETag` on its own whenever it
+    rewrites a body (so nothing can be revalidated), and these locations say
+    `no-store` (so nothing is kept to revalidate).
+    """
+    shells = [b for b in locations_with_add_header() if b.lstrip().startswith("location = /index.html")]
+    assert shells, "app/nginx.conf no longer has a `location = /index.html` — where does the shell get its headers?"
+    missing = [b.splitlines()[0].strip() for b in shells if "no-store" not in b]
+    assert not missing, (
+        f"these shell locations do not send `no-store`: {missing}. The shell carries a "
+        "per-request CSP nonce and must not be reusable."
+    )
+
+
+def test_strict_dynamic_needs_the_stamp_to_reach_the_module_preloads():
+    """It reads as the stricter policy and would load the app from nothing.
+
+    `'strict-dynamic'` makes a browser ignore `'self'` for scripts and trust
+    only what an already-trusted script pulls in. `yarn build` links every
+    chunk from the shell with `<link rel="modulepreload">` — a link element,
+    which trust propagation does not cover and which the `<script` stamp does
+    not touch. So adopting the keyword means widening the stamp in the same
+    breath; adopting it alone means the preloads are refused. Absent today, and
+    the reasoning is in security-headers.conf — this only has to hold whoever
+    adds it to the second half.
+    """
+    if "'strict-dynamic'" not in csp_directives()["script-src"]:
+        return
+    conf = _without_comments(NGINX_CONF.read_text(encoding="utf-8"))
+    assert re.search(r"sub_filter\s+'<link", conf), (
+        "script-src carries 'strict-dynamic', which drops 'self' for scripts, but "
+        "app/nginx.conf still stamps only <script> tags. Vite's <link "
+        'rel="modulepreload"> chunk hints would be blocked and the SPA would never '
+        "boot."
     )
 
 
-def test_script_src_never_mixes_unsafe_inline_with_hashes():
+def test_script_src_never_mixes_unsafe_inline_with_a_nonce_or_hash():
     """The two together are the trap, not the belt-and-braces pair they look like.
 
     A browser ignores `'unsafe-inline'` as soon as a hash or nonce is present.
-    So a policy carrying both is exactly as strict as the hash list alone —
-    which, while Cloudflare JavaScript Detections injects an unhashable inline
-    script, means the edge's script is blocked while the policy reads as though
-    nothing changed.
+    So a policy carrying both is exactly as strict as the nonce alone, while
+    reading as though it still has a safety net — and the day someone removes
+    the stamp because "'unsafe-inline' is still in there", the whole page goes
+    quiet.
     """
     script_src = csp_directives()["script-src"]
-    has_hash = any(t.startswith("'sha256-") for t in script_src)
-    assert not (has_hash and "'unsafe-inline'" in script_src), (
-        "script-src carries both a hash and 'unsafe-inline'. The browser ignores the "
-        "latter, so this is the hash-only policy with a misleading label. Pick one."
+    keyed = [t for t in script_src if t.startswith(("'sha256-", "'sha384-", "'sha512-", "'nonce-"))]
+    assert not (keyed and "'unsafe-inline'" in script_src), (
+        f"script-src carries both {keyed} and 'unsafe-inline'. The browser ignores the "
+        "latter, so this is the strict policy with a misleading label. Pick one."
     )
 
 

From 74f48e411c9d685aad8944a7c3d2f7d8d0d219a6 Mon Sep 17 00:00:00 2001
From: Markus Neusinger <2921697+MarkusNeusinger@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:54:36 +0200
Subject: [PATCH 2/8] fix(security): address the Copilot review of the nonce
 path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Four findings, all real, and one of them a bug the local probes had already
walked past:

* python.anyplot.ai/<spec> and /<spec>/<library> serve the shell as a FILE
  through `try_files /index.html =404`, inside their own location and without
  the internal redirect that would reach `location = /index.html`. Measured:
  those two routes answered with no Cache-Control at all while the main host
  sent `no-store` — a nonced body that a client may keep. Both now send the
  shell's Cache-Control and re-include the header snippet.
* The deploy smoke counted `nonce=` attributes instead of comparing them, so a
  tag carrying a DIFFERENT nonce passed while the browser would refuse it.
  Reproduced against a local nginx stamping `$connection_requests$msec`: the
  old form saw "0 tags without a nonce", the new one fails with "0 of 7 tags
  carry the header's nonce".
* The rollback pointed at "the previous revision", which stops being the
  pre-nonce one after the next deploy. It now says to pick by creation time,
  and says what the lever becomes when no such revision is left.
* The API service is anyplot-api, not anyplot-backend.

Also corrected two claims rather than defending them: 16 random bytes are
exactly 128 bits and CSP recommends rather than requires them, and
'strict-dynamic' would cost the modulepreload hints — a console full of
violations and a slower first paint — not the whole SPA, because the entry
module is itself a nonced <script>.

`test_the_shell_is_never_stored` now finds every location that answers with
the shell, by reading the try_files argument positions rather than the one
exact match it happened to know about.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UEScQMZFvxxNNyNJYryfa3
---
 agentic/docs/project-guide.md     | 27 +++++----
 app/cloudbuild.yaml               | 16 ++++--
 app/nginx.conf                    | 12 ++++
 app/security-headers.conf         | 41 +++++++++-----
 tests/unit/api/test_csp_policy.py | 91 +++++++++++++++++++++++--------
 5 files changed, 134 insertions(+), 53 deletions(-)

diff --git a/agentic/docs/project-guide.md b/agentic/docs/project-guide.md
index 76de07c4329..031e6e5e795 100644
--- a/agentic/docs/project-guide.md
+++ b/agentic/docs/project-guide.md
@@ -1068,24 +1068,31 @@ page known to be broken.
 ### Rollback
 
 Every deploy names its revision deterministically (`--revision-suffix=b$BUILD_ID`) and
-promotes it explicitly, so the previous revision is still there, still healthy, and one
+promotes it explicitly, so earlier revisions are still there, still healthy, and one
 command away. Rolling back needs no rebuild and takes under a minute:
 
 ```bash
-# 1. Find the revision that served before the current one.
+# 1. List recent revisions with their creation times.
 gcloud run revisions list --service anyplot-app --region europe-west4 \
-  --format='table(name, creationTimestamp, status.conditions[0].status)' --limit 5
+  --format='table(name, creationTimestamp, status.conditions[0].status)' --limit 10
 
-# 2. Send all traffic back to it.
+# 2. Send all traffic to the one you want back.
 gcloud run services update-traffic anyplot-app --region europe-west4 \
-  --to-revisions=<previous-revision>=100
+  --to-revisions=<chosen-revision>=100
 ```
 
-Same shape for `anyplot-backend`. This is the lever for anything that ships inside the
-image and only reveals itself in production. The current example is the CSP nonce path in
-`app/security-headers.conf`: if Cloudflare ever stops stamping its edge-injected script
-with the nonce it reads from our response header, the previous revision still serves the
-`'unsafe-inline'` policy byte for byte.
+Same shape for `anyplot-api`. This is the lever for anything that ships inside the image
+and only reveals itself in production.
+
+**Pick the target by what it contains, not by its position.** "The previous revision" is
+the right answer only while the change you are undoing is the most recent deploy; one more
+deploy later, the previous revision carries it too. The creation timestamps in step 1 are
+there for that — find the last revision created before the change landed. The current
+example is the CSP nonce path in `app/security-headers.conf`: if Cloudflare ever stops
+stamping its edge-injected script with the nonce it reads from our response header, any
+revision from before that PR still serves the `'unsafe-inline'` policy byte for byte.
+Once no such revision is left, the lever is a revert PR through the normal pipeline
+instead — slower, but by then the question has long been answered live.
 
 Deliberately NOT built for that case: a Cloud Run environment variable that flips the
 policy inside a running revision. nginx cannot read the process environment from its
diff --git a/app/cloudbuild.yaml b/app/cloudbuild.yaml
index 185fc2285a0..4a5e5b63ff3 100644
--- a/app/cloudbuild.yaml
+++ b/app/cloudbuild.yaml
@@ -172,12 +172,16 @@ steps:
           || { echo "candidate did not serve the shell for the nonce probe"; exit 1; }
         NONCE=$$(grep -i '^content-security-policy:' head.out | grep -o 'nonce-[0-9a-f]*' | head -1)
         test -n "$$NONCE" || { echo "the shell's Content-Security-Policy carries no nonce"; exit 1; }
-        grep -qF "<script nonce=\"$${NONCE#nonce-}\"" body.out \
-          || { echo "no <script> tag carries the header's $$NONCE — the sub_filter stamp did not run"; exit 1; }
-        UNSTAMPED=$$(grep -o '<script[^>]*>' body.out | grep -v 'nonce=' | wc -l)
-        test "$$UNSTAMPED" = "0" \
-          || { echo "$$UNSTAMPED <script> tag(s) in the shell carry no nonce and would be blocked"; exit 1; }
-        echo "OK: CSP nonce on every script tag of the shell"
+        # Every tag against THAT nonce, not "has some nonce": a stale or
+        # mismatched value is refused by the browser exactly like a missing one,
+        # and counting attributes rather than comparing them would wave it
+        # through (Copilot review).
+        TAGS=$$(grep -o '<script[^>]*>' body.out | wc -l)
+        MATCHING=$$(grep -o "<script nonce=\"$${NONCE#nonce-}\"" body.out | wc -l)
+        test "$$TAGS" -gt 0 || { echo "the shell served no <script> tag at all"; exit 1; }
+        test "$$MATCHING" = "$$TAGS" \
+          || { echo "$$MATCHING of $$TAGS <script> tag(s) carry the header's $$NONCE — the rest would be blocked"; exit 1; }
+        echo "OK: all $$TAGS script tags of the shell carry the header's nonce"
         # Crawlers get the prerendered page through @seo_proxy. The canonical
         # link is the marker: the SPA shell carries none at all, and its value
         # names the route, so one grep proves both "the bot hop ran" and "the
diff --git a/app/nginx.conf b/app/nginx.conf
index ee56ce3ee74..3706e44497f 100644
--- a/app/nginx.conf
+++ b/app/nginx.conf
@@ -471,10 +471,20 @@ server {
     }
 
     # /:specId -> hub on main domain (no language segment; canonical is /{spec_id})
+    #
+    # `try_files /index.html =404` serves the shell as a FILE, in THIS location —
+    # no internal redirect, so `location = /index.html` and its headers are never
+    # reached. That is why the two routes below repeat the shell's Cache-Control
+    # instead of inheriting it: the shell now carries a per-request CSP nonce, and
+    # a stored copy would pair an old `nonce="…"` in the body with a fresh one in
+    # the header. Measured before the fix: these two routes answered with no
+    # Cache-Control at all while anyplot.ai/<spec> answered `no-store`.
     location ~ "^/(?<spec_id>[A-Za-z0-9][A-Za-z0-9-]*)/?$" {
         set $python_seo_uri /seo-proxy/$spec_id;
         error_page 418 = @seo_proxy_python;
         if ($is_bot) { return 418; }
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        include /etc/nginx/security-headers.conf;
         try_files /index.html =404;
     }
 
@@ -483,6 +493,8 @@ server {
         set $python_seo_uri /seo-proxy/$spec_id/python/$library;
         error_page 418 = @seo_proxy_python;
         if ($is_bot) { return 418; }
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        include /etc/nginx/security-headers.conf;
         try_files /index.html =404;
     }
 
diff --git a/app/security-headers.conf b/app/security-headers.conf
index 58d74eeb4f2..bf5c01d6eef 100644
--- a/app/security-headers.conf
+++ b/app/security-headers.conf
@@ -50,10 +50,11 @@
 #
 # The nonce is `$request_id`: nginx's own 16 random bytes, rendered as 32 hex
 # digits. Hex is a subset of the base64-value charset the CSP nonce grammar
-# accepts, and 128 bits is above the 128 the spec asks for. nginx stamps it on
-# every `<script` tag of the shell with `sub_filter` (app/nginx.conf), so the
-# tag and this header always carry the SAME value — they are the same variable
-# read twice in one request.
+# accepts, and 16 bytes is exactly the 128 bits of entropy CSP recommends for a
+# nonce (a recommendation in the spec, not a requirement). nginx stamps that
+# value on every `<script` tag of the shell with `sub_filter` (app/nginx.conf),
+# so the tag and this header always agree — they are the same variable read
+# twice within one request.
 #
 # Two consequences worth knowing before editing either half:
 #
@@ -70,18 +71,30 @@
 #     hand out the untouched `.gz` and `sub_filter` never sees a compressed
 #     body.
 #
-# 'strict-dynamic' is deliberately NOT here. It would drop 'self' for scripts,
-# and Vite's shell links its chunks with `<link rel="modulepreload">` — link
-# elements the stamp does not touch and 'strict-dynamic' does not cover. The
-# chunks stay on 'self'.
+# 'strict-dynamic' is deliberately NOT here, and the reason is narrower than it
+# first looks. It would drop 'self' for scripts and trust only what an
+# already-trusted script pulls in. The entry module IS a nonced <script>, so it
+# runs, and its imports are fetched by a script rather than the parser, so they
+# run too. What breaks is the layer above them: Vite's shell links every chunk
+# with `<link rel="modulepreload">`, and a link element is neither a script
+# element strict-dynamic can trust nor something the `<script` stamp touches. So
+# the hints are refused — a console full of violations and a slower first paint,
+# because each chunk then waits for the entry module to ask for it, instead of a
+# blank page. Not a catastrophe; just a cost with nothing bought, since the
+# chunks are fingerprinted files under 'self' already. Adopting the keyword
+# means widening the stamp to <link> in the same change; a test says so.
 #
-# Rolling back without a rebuild, if the edge ever stops honouring the nonce:
+# Rolling back without a rebuild, if the edge ever stops honouring the nonce —
+# pick the last revision created BEFORE this policy shipped, which is NOT
+# "the previous one" once another frontend deploy has happened (Copilot review):
+#   gcloud run revisions list --service anyplot-app --region europe-west4 \
+#     --format='table(name, creationTimestamp)' --limit 10
 #   gcloud run services update-traffic anyplot-app --region europe-west4 \
-#     --to-revisions=<previous-revision>=100
-# (`gcloud run revisions list --service anyplot-app --region europe-west4`
-# names them; every deploy gives its revision the deterministic suffix
-# `-b$BUILD_ID`, and the previous one still serves the 'unsafe-inline' policy
-# byte for byte.) agentic/docs/project-guide.md § Rollback has the long form.
+#     --to-revisions=<that-revision>=100
+# Once this has been live long enough that no pre-nonce revision is left, the
+# lever is a revert PR through the normal pipeline instead — which is fine,
+# because by then the question this policy risks has been answered.
+# agentic/docs/project-guide.md § Rollback has the long form.
 # - style-src 'unsafe-inline': MUI/emotion inject inline styles.
 # - img/font/connect storage.googleapis.com: plot previews + MonoLisa fonts on GCS.
 # - img/connect/frame api.anyplot.ai: API calls, og images, interactive-preview
diff --git a/tests/unit/api/test_csp_policy.py b/tests/unit/api/test_csp_policy.py
index eacdefe8724..64783d879aa 100644
--- a/tests/unit/api/test_csp_policy.py
+++ b/tests/unit/api/test_csp_policy.py
@@ -77,11 +77,8 @@ def _without_comments(text: str) -> str:
     return "\n".join(line for line in text.splitlines() if not line.lstrip().startswith("#"))
 
 
-def locations_with_add_header() -> list[str]:
-    """Every `location …{ … }` block of app/nginx.conf that sets a header itself.
-
-    Returned as the raw block text, so the caller can check what is inside it.
-    """
+def location_blocks() -> list[str]:
+    """Every `location …{ … }` block of app/nginx.conf, as raw text."""
     conf = NGINX_CONF.read_text(encoding="utf-8")
     blocks = []
     for match in re.finditer(r"^\s*location\s[^{]*\{", conf, re.MULTILINE):
@@ -95,7 +92,40 @@ def locations_with_add_header() -> list[str]:
                 if depth == 0:
                     blocks.append(conf[start : i + 1])
                     break
-    return [b for b in blocks if _ADD_HEADER.search(_without_comments(b))]
+    return blocks
+
+
+def locations_with_add_header() -> list[str]:
+    """Every location block that sets a header itself, and so drops the rest."""
+    return [b for b in location_blocks() if _ADD_HEADER.search(_without_comments(b))]
+
+
+_TRY_FILES = re.compile(r"try_files\s+([^;]+);")
+
+
+def locations_serving_the_shell_in_place() -> list[str]:
+    """Every location that answers with index.html under its OWN headers.
+
+    Two shapes, and the difference is the whole point. `try_files … /index.html`
+    with the shell LAST is a URI fallback: nginx redirects internally and re-runs
+    location matching, so the response is built by `location = /index.html` and
+    inherits its headers. `try_files /index.html =404` has the shell as a
+    non-last argument, which is a FILE — served right here, with this location's
+    headers and no others. Both shapes exist in app/nginx.conf, the second twice
+    in the python server block, and only the first is obvious from reading it.
+    """
+    out = []
+    for block in location_blocks():
+        head = block.strip().splitlines()[0].strip()
+        if head.startswith("location = /index.html"):
+            out.append(block)
+            continue
+        for match in _TRY_FILES.finditer(_without_comments(block)):
+            arguments = match.group(1).split()
+            if "/index.html" in arguments[:-1]:
+                out.append(block)
+                break
+    return out
 
 
 def server_blocks() -> list[str]:
@@ -229,36 +259,51 @@ def test_the_shell_is_never_stored():
     `sub_filter` drops `Last-Modified` and `ETag` on its own whenever it
     rewrites a body (so nothing can be revalidated), and these locations say
     `no-store` (so nothing is kept to revalidate).
+
+    Checking only `location = /index.html` is what the first version did, and it
+    passed while python.anyplot.ai/<spec> answered with no Cache-Control at all:
+    that route serves the shell as a FILE inside its own location and never
+    reaches the exact match (Copilot review). Every location that can produce
+    the shell is checked instead.
     """
-    shells = [b for b in locations_with_add_header() if b.lstrip().startswith("location = /index.html")]
-    assert shells, "app/nginx.conf no longer has a `location = /index.html` — where does the shell get its headers?"
-    missing = [b.splitlines()[0].strip() for b in shells if "no-store" not in b]
+    shells = locations_serving_the_shell_in_place()
+    assert len(shells) >= 3, (
+        f"only {len(shells)} location(s) look like they serve the shell — expected the "
+        "exact match in each server block plus the two python-host spec routes. Did the "
+        "try_files shapes change?"
+    )
+    missing = [b.strip().splitlines()[0].strip() for b in shells if "no-store" not in _without_comments(b)]
     assert not missing, (
-        f"these shell locations do not send `no-store`: {missing}. The shell carries a "
-        "per-request CSP nonce and must not be reusable."
+        f"these locations answer with the shell but do not send `no-store`: {missing}. "
+        "The shell carries a per-request CSP nonce and must not be reusable."
     )
 
 
-def test_strict_dynamic_needs_the_stamp_to_reach_the_module_preloads():
-    """It reads as the stricter policy and would load the app from nothing.
+def test_strict_dynamic_would_have_to_widen_the_stamp_to_the_module_preloads():
+    """The keyword and the stamp are one decision, taken in two files.
 
     `'strict-dynamic'` makes a browser ignore `'self'` for scripts and trust
-    only what an already-trusted script pulls in. `yarn build` links every
-    chunk from the shell with `<link rel="modulepreload">` — a link element,
-    which trust propagation does not cover and which the `<script` stamp does
-    not touch. So adopting the keyword means widening the stamp in the same
-    breath; adopting it alone means the preloads are refused. Absent today, and
-    the reasoning is in security-headers.conf — this only has to hold whoever
-    adds it to the second half.
+    only what an already-trusted script pulls in. The entry module is a nonced
+    `<script>`, so it and the imports it fetches still run — the casualty is
+    narrower and easy to miss: `yarn build` links every chunk from the shell
+    with `<link rel="modulepreload">`, and a link element is neither something
+    trust propagation reaches nor something a `<script`-only stamp touches. The
+    hints are refused, which costs a console full of violations and a slower
+    first paint rather than a blank page (Copilot review corrected an earlier,
+    louder claim here).
+
+    So this is not a ban on the keyword. It is the requirement that whoever
+    adopts it widens the stamp in the same change instead of discovering the
+    cost in production. Nothing to check while the keyword is absent.
     """
     if "'strict-dynamic'" not in csp_directives()["script-src"]:
         return
     conf = _without_comments(NGINX_CONF.read_text(encoding="utf-8"))
     assert re.search(r"sub_filter\s+'<link", conf), (
         "script-src carries 'strict-dynamic', which drops 'self' for scripts, but "
-        "app/nginx.conf still stamps only <script> tags. Vite's <link "
-        'rel="modulepreload"> chunk hints would be blocked and the SPA would never '
-        "boot."
+        "app/nginx.conf still stamps only <script> tags — so Vite's <link "
+        'rel="modulepreload"> chunk hints are refused and every chunk waits for the '
+        "entry module to ask for it. Stamp <link> too, or drop the keyword."
     )
 
 

From 71c635955630c9fc4c366eee506fad8dc2fbc727 Mon Sep 17 00:00:00 2001
From: Markus Neusinger <2921697+MarkusNeusinger@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:58:57 +0200
Subject: [PATCH 3/8] test(csp): the shell-route count and its message agree

Four locations serve the shell, and the assertion said three while its
message named four.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UEScQMZFvxxNNyNJYryfa3
---
 tests/unit/api/test_csp_policy.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/unit/api/test_csp_policy.py b/tests/unit/api/test_csp_policy.py
index 64783d879aa..9de65e3dbee 100644
--- a/tests/unit/api/test_csp_policy.py
+++ b/tests/unit/api/test_csp_policy.py
@@ -267,10 +267,10 @@ def test_the_shell_is_never_stored():
     the shell is checked instead.
     """
     shells = locations_serving_the_shell_in_place()
-    assert len(shells) >= 3, (
-        f"only {len(shells)} location(s) look like they serve the shell — expected the "
-        "exact match in each server block plus the two python-host spec routes. Did the "
-        "try_files shapes change?"
+    assert len(shells) >= 4, (
+        f"only {len(shells)} location(s) look like they serve the shell — expected at "
+        "least four: the exact match in each server block plus the two python-host spec "
+        "routes. Did the try_files shapes change?"
     )
     missing = [b.strip().splitlines()[0].strip() for b in shells if "no-store" not in _without_comments(b)]
     assert not missing, (

From 39e8a29fcafeda9f03888e11363fbbc2bed408d8 Mon Sep 17 00:00:00 2001
From: Markus Neusinger <2921697+MarkusNeusinger@users.noreply.github.com>
Date: Fri, 4 Sep 2026 16:06:04 +0200
Subject: [PATCH 4/8] fix(security): the nonce smoke has to ask for compression
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Copilot's second round found the probe blind to the failure it was written
for. Plain curl sends no Accept-Encoding, so `gzip_static` never reaches for
the `.gz` — and a precompressed shell coming back is the single most likely
way to lose the stamp. Reproduced against a local nginx with an index.html.gz
planted in the docroot:

    plain curl        7 stamped tags   → the smoke passed
    curl --compressed 0 stamped tags   → what a browser gets

`--compressed` on that one fetch closes it; the probe now fails with
"0 of 7 <script> tag(s) carry the header's nonce" against the same planted
file and passes on the real build.

Also: the rollback in project-guide.md is a numbered procedure with one action
per step, per the repository's Google-style convention, instead of two
commands separated by comments inside one block. And the changelog records the
python.anyplot.ai Cache-Control gap as its own Fixed entry — it predates this
PR (those routes never sent one) and is worth its own line.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UEScQMZFvxxNNyNJYryfa3
---
 agentic/docs/project-guide.md | 20 ++++++++++++--------
 app/cloudbuild.yaml           | 10 +++++++++-
 changelog.d/csp-nonce.md      | 13 +++++++++++++
 3 files changed, 34 insertions(+), 9 deletions(-)

diff --git a/agentic/docs/project-guide.md b/agentic/docs/project-guide.md
index 031e6e5e795..ed1a9535ca3 100644
--- a/agentic/docs/project-guide.md
+++ b/agentic/docs/project-guide.md
@@ -1071,15 +1071,19 @@ Every deploy names its revision deterministically (`--revision-suffix=b$BUILD_ID
 promotes it explicitly, so earlier revisions are still there, still healthy, and one
 command away. Rolling back needs no rebuild and takes under a minute:
 
-```bash
-# 1. List recent revisions with their creation times.
-gcloud run revisions list --service anyplot-app --region europe-west4 \
-  --format='table(name, creationTimestamp, status.conditions[0].status)' --limit 10
+1. List the recent revisions with their creation times:
 
-# 2. Send all traffic to the one you want back.
-gcloud run services update-traffic anyplot-app --region europe-west4 \
-  --to-revisions=<chosen-revision>=100
-```
+   ```bash
+   gcloud run revisions list --service anyplot-app --region europe-west4 \
+     --format='table(name, creationTimestamp, status.conditions[0].status)' --limit 10
+   ```
+
+2. Send all traffic to the revision you want back:
+
+   ```bash
+   gcloud run services update-traffic anyplot-app --region europe-west4 \
+     --to-revisions=<chosen-revision>=100
+   ```
 
 Same shape for `anyplot-api`. This is the lever for anything that ships inside the image
 and only reveals itself in production.
diff --git a/app/cloudbuild.yaml b/app/cloudbuild.yaml
index 4a5e5b63ff3..dbabe049df2 100644
--- a/app/cloudbuild.yaml
+++ b/app/cloudbuild.yaml
@@ -168,7 +168,15 @@ steps:
         # blocks every inline script on it, because a nonce in the policy makes
         # 'unsafe-inline' inert. Cheap to check here, four weeks of nobody
         # noticing if it is not.
-        curl -fsS $$RETRY -A "$$HUMAN" -D head.out -o body.out "$$URL/" \
+        #
+        # `--compressed` is the load-bearing flag, not a courtesy. Plain curl
+        # sends no Accept-Encoding, so `gzip_static` never reaches for the
+        # `.gz` — and the single most likely way to lose the stamp is exactly a
+        # precompressed shell coming back, which this probe would then pass
+        # while every browser got the untouched file (Copilot review).
+        # Reproduced against a local nginx with an index.html.gz planted in the
+        # docroot: plain curl saw 7 stamped tags, `curl --compressed` saw 0.
+        curl -fsS $$RETRY --compressed -A "$$HUMAN" -D head.out -o body.out "$$URL/" \
           || { echo "candidate did not serve the shell for the nonce probe"; exit 1; }
         NONCE=$$(grep -i '^content-security-policy:' head.out | grep -o 'nonce-[0-9a-f]*' | head -1)
         test -n "$$NONCE" || { echo "the shell's Content-Security-Policy carries no nonce"; exit 1; }
diff --git a/changelog.d/csp-nonce.md b/changelog.d/csp-nonce.md
index f43eb8e9240..1e43e2365df 100644
--- a/changelog.d/csp-nonce.md
+++ b/changelog.d/csp-nonce.md
@@ -21,3 +21,16 @@
   that same response's header. A lost stamp leaves a page that looks healthy to
   every other probe and runs no inline script at all, so it is worth the two
   extra curls.
+
+### Fixed
+
+- **The python.anyplot.ai spec routes sent the SPA shell with no
+  `Cache-Control` at all.** `try_files /index.html =404` answers with the shell
+  as a file inside that location, so it never reaches `location =
+  /index.html` and never inherited its `no-store` — measured against a local
+  nginx while the main host answered correctly on the same path. A stale shell
+  asks for `/assets/` hashes a later deploy no longer has; with the nonce it
+  would additionally pair an old `nonce="…"` with a fresh header. Both routes
+  now send the shell's `Cache-Control` and re-include the security-header
+  snippet beside it, since an `add_header` of their own would otherwise have
+  dropped the whole inherited set.

From 256b2828917a8264d17e125a4acd2f58f4135377 Mon Sep 17 00:00:00 2001
From: Markus Neusinger <2921697+MarkusNeusinger@users.noreply.github.com>
Date: Fri, 4 Sep 2026 16:15:55 +0200
Subject: [PATCH 5/8] docs(csp): the preload nonce is a real mechanism, and 128
 bits is a floor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review round three raised two points about text, not behaviour, and they go
opposite ways.

Taken: the test docstring still called 128 bits "the ceiling of what the spec
asks for" after security-headers.conf had already been corrected. CSP
RECOMMENDS at least 128 bits; both places now say so in the same words.

Not taken: that a nonce cannot authorize a `<link rel="modulepreload">`, and
that the strict-dynamic guard therefore encodes an ineffective fix. A preload
request carries its link element's nonce as cryptographic nonce metadata and a
nonce-source in script-src matches it — which is exactly why React #26781,
Next.js #64091, Vite #9719 and Rails #53794 all carry the same report and the
same fix, "put the nonce on the preload link". Widening the stamp to <link> is
the remedy, and the guard stands. Both files now name that evidence so the
question does not have to be re-litigated by the next reader.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UEScQMZFvxxNNyNJYryfa3
---
 app/security-headers.conf         | 20 +++++++++++++-------
 tests/unit/api/test_csp_policy.py | 22 +++++++++++++++-------
 2 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/app/security-headers.conf b/app/security-headers.conf
index bf5c01d6eef..64294834988 100644
--- a/app/security-headers.conf
+++ b/app/security-headers.conf
@@ -76,13 +76,19 @@
 # already-trusted script pulls in. The entry module IS a nonced <script>, so it
 # runs, and its imports are fetched by a script rather than the parser, so they
 # run too. What breaks is the layer above them: Vite's shell links every chunk
-# with `<link rel="modulepreload">`, and a link element is neither a script
-# element strict-dynamic can trust nor something the `<script` stamp touches. So
-# the hints are refused — a console full of violations and a slower first paint,
-# because each chunk then waits for the entry module to ask for it, instead of a
-# blank page. Not a catastrophe; just a cost with nothing bought, since the
-# chunks are fingerprinted files under 'self' already. Adopting the keyword
-# means widening the stamp to <link> in the same change; a test says so.
+# with `<link rel="modulepreload">`, and a link element is not something
+# strict-dynamic's trust propagation reaches. So the hints are refused — a
+# console full of violations and a slower first paint, because each chunk then
+# waits for the entry module to ask for it, instead of a blank page. Not a
+# catastrophe; just a cost with nothing bought, since the chunks are
+# fingerprinted files under 'self' already.
+#
+# The remedy, for whoever wants the keyword: widen the stamp to <link> in the
+# same change. A preload request carries its link element's nonce as
+# cryptographic nonce metadata, and a nonce-source in script-src matches it —
+# which is why React, Next.js, Vite and Rails each carry the same bug report
+# and the same fix, "put the nonce on the preload link". A test enforces the
+# pairing.
 #
 # Rolling back without a rebuild, if the edge ever stops honouring the nonce —
 # pick the last revision created BEFORE this policy shipped, which is NOT
diff --git a/tests/unit/api/test_csp_policy.py b/tests/unit/api/test_csp_policy.py
index 9de65e3dbee..22404f325c2 100644
--- a/tests/unit/api/test_csp_policy.py
+++ b/tests/unit/api/test_csp_policy.py
@@ -170,8 +170,9 @@ def test_the_policy_takes_its_nonce_from_a_per_request_variable():
     A literal would be a shared secret baked into an image and reused for the
     lifetime of a revision — which is to say, not a secret. `$request_id` is
     nginx's own 16 random bytes as 32 hex digits: hex is inside the CSP nonce
-    grammar's charset, and 128 bits is at the ceiling of what the spec asks
-    for.
+    grammar's charset, and 16 bytes meets the at-least-128-bits the spec
+    recommends (a recommendation, not a ceiling and not a requirement — the
+    same wording as security-headers.conf, deliberately).
     """
     script_src = csp_directives()["script-src"]
     nonces = [t for t in script_src if t.startswith("'nonce-")]
@@ -286,11 +287,18 @@ def test_strict_dynamic_would_have_to_widen_the_stamp_to_the_module_preloads():
     only what an already-trusted script pulls in. The entry module is a nonced
     `<script>`, so it and the imports it fetches still run — the casualty is
     narrower and easy to miss: `yarn build` links every chunk from the shell
-    with `<link rel="modulepreload">`, and a link element is neither something
-    trust propagation reaches nor something a `<script`-only stamp touches. The
-    hints are refused, which costs a console full of violations and a slower
-    first paint rather than a blank page (Copilot review corrected an earlier,
-    louder claim here).
+    with `<link rel="modulepreload">`, and a link element is not something trust
+    propagation reaches. The hints are refused, which costs a console full of
+    violations and a slower first paint rather than a blank page (a review
+    corrected an earlier, louder claim here).
+
+    Why the remedy is a WIDER stamp rather than a ban: a preload request carries
+    the link element's nonce as its cryptographic nonce metadata, and a
+    nonce-source in `script-src` matches it. That is not theory — it is why
+    React (#26781), Next.js (#64091), Vite (#9719) and Rails (#53794) all
+    carry the same bug report and the same fix, "put the nonce on the preload
+    link". A later review round suggested the opposite, that a nonce cannot
+    authorize a modulepreload; it can, and the sources are in the PR.
 
     So this is not a ban on the keyword. It is the requirement that whoever
     adopts it widens the stamp in the same change instead of discovering the

From 7aab6d6c8ca4b6bda2b26690c2beeeedc8c5827b Mon Sep 17 00:00:00 2001
From: Markus Neusinger <2921697+MarkusNeusinger@users.noreply.github.com>
Date: Fri, 4 Sep 2026 16:23:02 +0200
Subject: [PATCH 6/8] test(csp): match the shell exclusion, do not search for
 the word

Two last review notes, both fair.

The precompression guard looked for "index" anywhere after `exclude`, so
`/index\.js$/` and even `/not-index\.html$/` would have satisfied it while
`dist/index.html.gz` was written all the same. It now matches the pattern, and
the four cases that distinguish those are checked.

And the rollback section says "deliberately not built" in sentence case, per
the Google style rules the repository follows.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UEScQMZFvxxNNyNJYryfa3
---
 agentic/docs/project-guide.md     |  2 +-
 tests/unit/api/test_csp_policy.py | 11 +++++++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/agentic/docs/project-guide.md b/agentic/docs/project-guide.md
index ed1a9535ca3..2cf09e7fe20 100644
--- a/agentic/docs/project-guide.md
+++ b/agentic/docs/project-guide.md
@@ -1098,7 +1098,7 @@ revision from before that PR still serves the `'unsafe-inline'` policy byte for
 Once no such revision is left, the lever is a revert PR through the normal pipeline
 instead — slower, but by then the question has long been answered live.
 
-Deliberately NOT built for that case: a Cloud Run environment variable that flips the
+One thing is deliberately not built for that case: a Cloud Run environment variable that flips the
 policy inside a running revision. nginx cannot read the process environment from its
 configuration, so it would take a startup templating step (`envsubst` into a writable
 path — and `/etc/nginx` is read-only in the unprivileged image), which neither CI nor a
diff --git a/tests/unit/api/test_csp_policy.py b/tests/unit/api/test_csp_policy.py
index 22404f325c2..064645207fb 100644
--- a/tests/unit/api/test_csp_policy.py
+++ b/tests/unit/api/test_csp_policy.py
@@ -237,12 +237,19 @@ def test_the_shell_is_never_precompressed():
     The prettiest way to break this whole mechanism: leave a build artefact in
     place. nginx would serve `index.html.gz` byte for byte, the stamp would
     never run, the header would still carry its nonce, and every inline script
-    on the page would be refused — with nothing in any log to say why.
+    on the page would be refused — with nothing in any log to say why. Measured
+    on a local nginx with the `.gz` planted back: `curl --compressed` saw zero
+    stamped tags where the plain shell had seven.
+
+    The pattern is matched, not merely searched for the word "index" — a first
+    version accepted `/index\\.js$/` and even `/not-index\\.html$/`, both of
+    which leave `index.html.gz` in `dist/` (Copilot review).
     """
     config = VITE_CONFIG.read_text(encoding="utf-8")
     calls = re.findall(r"compression\(\{[^}]*\}\)", config)
     assert calls, "app/vite.config.ts declares no compression plugin — did it move?"
-    unguarded = [c for c in calls if "index" not in c.split("exclude")[-1]]
+    excludes_the_shell = re.compile(r"exclude\s*:\s*\[[^\]]*(?<![\w-])index\\?\.html\$?/")
+    unguarded = [c for c in calls if not excludes_the_shell.search(c)]
     assert not unguarded, (
         "a compression plugin in app/vite.config.ts does not exclude index.html: "
         f"{unguarded}. The shell is rewritten per request for the CSP nonce and "

From 4569fd9027606aa9f75909f051e0a516b03f953b Mon Sep 17 00:00:00 2001
From: Markus Neusinger <2921697+MarkusNeusinger@users.noreply.github.com>
Date: Fri, 4 Sep 2026 16:31:26 +0200
Subject: [PATCH 7/8] test(csp): run the exclude pattern, and demand 32 hex
 digits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round four, both findings real and both about a check that could pass on
something invalid.

The smoke extracted the nonce with `nonce-[0-9a-f]*`, which matches a bare
`nonce-`, and `test -n` calls that non-empty. A policy with an empty nonce and
`nonce=""` on every tag would then have agreed with itself all the way through
the probe while the browser blocked every script. It now requires the 32 hex
digits nginx's $request_id always is:

    old extraction on a `'nonce-'` header: ['nonce-']  -> passed
    new extraction:                        []          -> fails

And the precompression guard now RUNS the declared exclude pattern against
"index.html" instead of reading it for the word "index". Two rounds found the
reading version accepting patterns that exclude nothing — /index\.js$/,
/not-index\.html$/, and /foo/index\.html$/ — which is a sign the approach was
wrong rather than the spelling. Eight cases checked, including those three and
a flagged /INDEX\.HTML$/i.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UEScQMZFvxxNNyNJYryfa3
---
 app/cloudbuild.yaml               |  9 +++++--
 tests/unit/api/test_csp_policy.py | 43 +++++++++++++++++++++++++------
 2 files changed, 42 insertions(+), 10 deletions(-)

diff --git a/app/cloudbuild.yaml b/app/cloudbuild.yaml
index dbabe049df2..f271493d962 100644
--- a/app/cloudbuild.yaml
+++ b/app/cloudbuild.yaml
@@ -178,8 +178,13 @@ steps:
         # docroot: plain curl saw 7 stamped tags, `curl --compressed` saw 0.
         curl -fsS $$RETRY --compressed -A "$$HUMAN" -D head.out -o body.out "$$URL/" \
           || { echo "candidate did not serve the shell for the nonce probe"; exit 1; }
-        NONCE=$$(grep -i '^content-security-policy:' head.out | grep -o 'nonce-[0-9a-f]*' | head -1)
-        test -n "$$NONCE" || { echo "the shell's Content-Security-Policy carries no nonce"; exit 1; }
+        # Exactly 32 hex digits, which is what nginx's $$request_id always is.
+        # `[0-9a-f]*` would have accepted a bare `nonce-` — and `test -n` calls
+        # that non-empty — so a policy with an empty nonce and `nonce=""` on
+        # every tag would have matched itself all the way through this probe
+        # while the browser blocked the lot (Copilot review).
+        NONCE=$$(grep -i '^content-security-policy:' head.out | grep -oE 'nonce-[0-9a-f]{32}' | head -1)
+        test -n "$$NONCE" || { echo "the shell's Content-Security-Policy carries no 32-hex-digit nonce"; exit 1; }
         # Every tag against THAT nonce, not "has some nonce": a stale or
         # mismatched value is refused by the browser exactly like a missing one,
         # and counting attributes rather than comparing them would wave it
diff --git a/tests/unit/api/test_csp_policy.py b/tests/unit/api/test_csp_policy.py
index 064645207fb..9cd52b7334f 100644
--- a/tests/unit/api/test_csp_policy.py
+++ b/tests/unit/api/test_csp_policy.py
@@ -231,6 +231,31 @@ def test_every_server_block_stamps_the_nonce():
     )
 
 
+_EXCLUDE_LIST = re.compile(r"exclude\s*:\s*\[([^\]]*)\]")
+_JS_REGEX_LITERAL = re.compile(r"/((?:[^/\\\n]|\\.)+)/([gimsuy]*)")
+
+
+def _js_regex_literals_after_exclude(call: str) -> list[re.Pattern[str]]:
+    """The `exclude:` regex literals of one plugin call, as Python patterns.
+
+    JavaScript and Python agree on the small subset a filename filter uses —
+    literal characters, `\\.`, `^`, `$`, character classes — so a JS literal can
+    simply be run here. Flags other than `i` have no counterpart worth
+    translating and are ignored; an unparseable literal is skipped rather than
+    crashing the suite, and skipping it can only make the test stricter.
+    """
+    listed = _EXCLUDE_LIST.search(call)
+    if not listed:
+        return []
+    patterns = []
+    for source, flags in _JS_REGEX_LITERAL.findall(listed.group(1)):
+        try:
+            patterns.append(re.compile(source, re.IGNORECASE if "i" in flags else 0))
+        except re.error:
+            continue
+    return patterns
+
+
 def test_the_shell_is_never_precompressed():
     """`gzip_static` hands out the `.gz` untouched, and sub_filter never sees it.
 
@@ -241,19 +266,21 @@ def test_the_shell_is_never_precompressed():
     on a local nginx with the `.gz` planted back: `curl --compressed` saw zero
     stamped tags where the plain shell had seven.
 
-    The pattern is matched, not merely searched for the word "index" — a first
-    version accepted `/index\\.js$/` and even `/not-index\\.html$/`, both of
-    which leave `index.html.gz` in `dist/` (Copilot review).
+    The declared pattern is RUN against the emitted name rather than read for
+    the word "index", because two rounds of review found the reading version
+    accepting patterns that exclude nothing: `/index\\.js$/`,
+    `/not-index\\.html$/`, and then `/foo/index\\.html$/`, which matches a
+    nested file while `dist/index.html` is still compressed. Whatever the next
+    plausible near-miss is, `re.search(pattern, "index.html")` answers it.
     """
     config = VITE_CONFIG.read_text(encoding="utf-8")
     calls = re.findall(r"compression\(\{[^}]*\}\)", config)
     assert calls, "app/vite.config.ts declares no compression plugin — did it move?"
-    excludes_the_shell = re.compile(r"exclude\s*:\s*\[[^\]]*(?<![\w-])index\\?\.html\$?/")
-    unguarded = [c for c in calls if not excludes_the_shell.search(c)]
+    unguarded = [c for c in calls if not any(p.search("index.html") for p in _js_regex_literals_after_exclude(c))]
     assert not unguarded, (
-        "a compression plugin in app/vite.config.ts does not exclude index.html: "
-        f"{unguarded}. The shell is rewritten per request for the CSP nonce and "
-        "must not exist as a precompressed file."
+        "a compression plugin in app/vite.config.ts declares no exclude pattern that "
+        f"actually matches the emitted shell: {unguarded}. index.html is rewritten per "
+        "request for the CSP nonce and must not exist as a precompressed file."
     )
 
 

From 6471eea26714e4668913d451461b87472604b58f Mon Sep 17 00:00:00 2001
From: Markus Neusinger <2921697+MarkusNeusinger@users.noreply.github.com>
Date: Fri, 4 Sep 2026 16:40:42 +0200
Subject: [PATCH 8/8] test(csp): the server-level guard has to look at server
 level
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round five, no threads, two suppressed notes and both worth taking.

`test_every_server_block_stamps_the_nonce` searched the whole server block,
nested locations included, so moving the stamp into `location = /index.html`
would have satisfied it — the exact regression it exists to refuse, and the
deploy smoke would not have caught it either since it probes `/` on the main
host. `_server_level_of` now cuts every nested `location { … }` out first.
Mutation-checked: with the stamp moved into that one location, the test fails
with "these server blocks do not stamp the CSP nonce at server level".

And the changelog said "two extra curls" where the nonce probe adds one.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UEScQMZFvxxNNyNJYryfa3
---
 changelog.d/csp-nonce.md          |  7 +++--
 tests/unit/api/test_csp_policy.py | 52 +++++++++++++++++++++++++------
 2 files changed, 47 insertions(+), 12 deletions(-)

diff --git a/changelog.d/csp-nonce.md b/changelog.d/csp-nonce.md
index 1e43e2365df..568c5e5b5a6 100644
--- a/changelog.d/csp-nonce.md
+++ b/changelog.d/csp-nonce.md
@@ -18,9 +18,10 @@
 
 - **The frontend deploy smoke checks the nonce before promoting.** The
   candidate has to serve a shell whose `<script>` tags all carry the nonce from
-  that same response's header. A lost stamp leaves a page that looks healthy to
-  every other probe and runs no inline script at all, so it is worth the two
-  extra curls.
+  that same response's header, fetched with `--compressed` so a precompressed
+  shell cannot slip past. A lost stamp leaves a page that looks healthy to every
+  other probe and runs no inline script at all, so it is worth the one extra
+  curl.
 
 ### Fixed
 
diff --git a/tests/unit/api/test_csp_policy.py b/tests/unit/api/test_csp_policy.py
index 9cd52b7334f..39b12e31b32 100644
--- a/tests/unit/api/test_csp_policy.py
+++ b/tests/unit/api/test_csp_policy.py
@@ -145,6 +145,35 @@ def server_blocks() -> list[str]:
     return blocks
 
 
+def _server_level_of(block: str) -> str:
+    """One server block with every nested `location { … }` cut out.
+
+    What is left is the directives that apply to the whole vhost. A directive
+    found only inside a location governs that location alone, and for the CSP
+    stamp that difference is the whole point — so the search has to be able to
+    tell them apart.
+    """
+    out = []
+    index = 0
+    for match in re.finditer(r"^\s*location\s[^{]*\{", block, re.MULTILINE):
+        if match.start() < index:
+            continue
+        out.append(block[index : match.start()])
+        depth = 0
+        for i in range(match.end() - 1, len(block)):
+            if block[i] == "{":
+                depth += 1
+            elif block[i] == "}":
+                depth -= 1
+                if depth == 0:
+                    index = i + 1
+                    break
+        else:
+            index = len(block)
+    out.append(block[index:])
+    return _without_comments("".join(out))
+
+
 # The nonce as the stamp spells it (`nonce="$request_id"`). Its counterpart in
 # the header is read out of the parsed DIRECTIVE, never out of the raw file:
 # security-headers.conf explains itself at length and quotes `'nonce-…'` in its
@@ -207,25 +236,30 @@ def test_the_header_and_the_stamp_name_the_same_variable():
     )
 
 
-def test_every_server_block_stamps_the_nonce():
-    """Both vhosts, at server level, because four locations serve the shell.
+def test_every_server_block_stamps_the_nonce_at_server_level():
+    """Both vhosts, at SERVER level, because four locations serve the shell.
 
     The exact `= /index.html`, the SPA fallback, and — in the python block —
     two regex routes whose `try_files /index.html =404` serves the file in
     place, with no internal redirect to re-run location matching. A stamp
     placed per-location is a stamp missing from whichever one is forgotten,
-    and it fails on those routes alone.
+    and it fails on those routes alone — which the deploy smoke would not
+    notice either, since it probes `/` on the main host.
+
+    Hence `_server_level_of`: searching the whole block would be satisfied by a
+    stamp buried in one `location`, which is exactly the regression this guard
+    exists to refuse (Copilot review).
     """
+    servers = [(b, _server_level_of(b)) for b in server_blocks()]
     missing = [
-        block.splitlines()[0]
-        for block in server_blocks()
-        if INCLUDE_LINE in block and not _STAMP.search(_without_comments(block))
+        block.strip().splitlines()[0] for block, top in servers if INCLUDE_LINE in block and not _STAMP.search(top)
     ]
     assert not missing, (
-        f"these server blocks send the CSP but never stamp its nonce: {missing}. "
-        "Every <script> tag they serve would be blocked."
+        f"these server blocks do not stamp the CSP nonce at server level: {missing}. "
+        "A stamp inside one location leaves every other route that serves the shell "
+        "unstamped, and each of its <script> tags would be blocked."
     )
-    assert all("sub_filter_once off;" in block for block in server_blocks() if _STAMP.search(block)), (
+    assert all("sub_filter_once off;" in top for _, top in servers if _STAMP.search(top)), (
         "sub_filter replaces only the FIRST match without `sub_filter_once off` — "
         "the shell has seven script tags and six of them would go unstamped."
     )