Complete guides and evals for three Cross-Origin Storage use cases - #1347
Open
tomayac wants to merge 6 commits into
Open
Complete guides and evals for three Cross-Origin Storage use cases#1347tomayac wants to merge 6 commits into
tomayac wants to merge 6 commits into
Conversation
Collaborator
|
We've recently merged an update to the eval generation structure which deprecates the eval artifacts generated by Would you mind removing those generated artifacts from this PR, and we can re-generate with the new format in subsequent PRs? The process is documented in https://github.com/GoogleChrome/modern-web-guidance-src/blob/main/guides/README.md?plain=1#L14. |
Fills in the remaining required files for the three Cross-Origin Storage (COS) use case stubs added in #1208: guide.md content, negative-demo.html, grader.ts, and tasks/task.md. - avoid-redundant-large-asset-downloads: imperative navigator.crossOriginStorage.requestFileHandle() API. - load-shared-resources-declaratively: declarative HTML crossoriginstorage attribute and JS crossOriginStorage import attribute. - share-web-fonts-across-origins: declarative CSS cross-origin-storage() request-url-modifier. Fixes #1281 Fixes #1282 Fixes #1283
The first task description mentioned an AI model, then referenced a shared library. Rewrote all three task variations to consistently describe loading the ffmpeg.wasm core module.
demo.html and guide.md called navigator.crossOriginStorage.requestFileHandle() behind a supportsCOS existence check. Removed that check: the API is now called directly and every outcome is handled with try/catch, matching the COS explainer's own example code and the fact that a fully implemented COS can still legitimately reject a call (availability gating, GREASE'ing, Permissions Policy). grader.ts previously replaced navigator.crossOriginStorage with a hand-rolled in-memory mock. Removed the mock: the grader now assumes COS is natively implemented in the test environment and only wraps the real requestFileHandle() to record calls for assertions, forwarding every call to the original implementation unchanged. Also aligned demo.html, negative-demo.html, and grader.ts on the ffmpeg-core.wasm asset used in tasks/task.md.
'Defensive' meant still wrapping calls in try/catch after a passed feature-detection check, not skipping the check entirely. Restored the single up-front navigator.crossOriginStorage?.requestFileHandle check with immediate fallback to the network when absent, while keeping try/catch around every COS call for outcomes a fully implemented COS can still legitimately reject (availability gating, GREASE'ing, Permissions Policy). Updated guide.md, expectations.md, and grader.ts to match.
The hashes in demo.html/negative-demo.html were copied from the WICG
explainer's own illustrative placeholders (e.g. 8f434346..., sha256-abc123...)
and never corresponded to any actual bytes. Now that the graders assume a
real, non-mocked Cross-Origin Storage implementation, that's a functional
bug: a real implementation hash-verifies written bytes against the
declared hash and rejects a mismatch with a DataError, so the store step
would silently fail every time and the demos would never actually
exercise the cache-hit path.
Shipped small placeholder files alongside each demo and computed their
real SHA-256 digests:
- avoid-redundant-large-asset-downloads/assets/ffmpeg-core.wasm: a
minimal stand-in for the real (multi-megabyte) ffmpeg.wasm core module.
Shipping the actual production binary would add several MB to this PR
for no grading benefit, so this is a small placeholder that starts with
the real Wasm magic number, with the hex hash in demo.html updated to
match.
- load-shared-resources-declaratively/assets/{shared-widget.css,
shared-widget.js,shared-config.js}: small stand-ins for a popular
stylesheet, script, and config module, with the SRI-style base64
hashes in demo.html and negative-demo.html updated to match.
- share-web-fonts-across-origins/fonts/shared-emoji.woff2: a small
stand-in for a popular emoji font, with the SRI-style base64 hash in
demo.html updated to match.
Verified each shipped file's SHA-256 digest against the hash referenced
in its demo before committing. Also removed grader.ts's synthetic
fake-body fallback for ffmpeg-core.wasm, now dead code since the real
file is served from disk like every other asset.
The eval generation structure was recently updated, deprecating the eval
artifacts this PR generated. Drop them here so they can be regenerated in
the new targets/<base_app>/ format in follow-up PRs:
- grader.ts, negative-demo.html, and tasks/task.md for all three guides
- the asset fixtures that existed only to back them (ffmpeg-core.wasm,
shared-{config.js,widget.css,widget.js}, shared-emoji.woff2)
demo.html is restored to its pre-PR state rather than deleted, since it
predates this PR and every other guide still ships one; removing it looks
like a repo-wide cleanup rather than this PR's job.
What remains is the guidance itself: guide.md for all three use cases,
plus one added expectation.
Also teach getStatusMessage() to report registered tmp-* feature IDs.
#1256 added tmp-* handling to validateFeature() and getFeatureName() but
not to this path, so BASELINE_STATUS("tmp-cross-origin-storage") in the
new guides threw "Status not found" and failed the guides integrity test.
Pending features now report as unsupported everywhere, with a link to the
upstream tracking issue.
tomayac
force-pushed
the
guidance/cos-use-case-evals
branch
from
August 18, 2026 11:53
3832a86 to
ea4b81c
Compare
Member
Author
Thank you, done all of that in ea4b81c. PTAL. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fills in the remaining required files for the three Cross-Origin Storage (COS) use case stubs that #1208 added:
guide.mdcontent,negative-demo.html,grader.ts, andtasks/task.md. Written against a fresh read of the WICG/cross-origin-storage README.What's in this PR
avoid-redundant-large-asset-downloadscovers the imperativenavigator.crossOriginStorage.requestFileHandle()API: checking COS before a network fetch, treatingNotFoundErroras a cache miss, storing withcreate: true, and choosing anoriginsscope deliberately.load-shared-resources-declarativelycovers the declarative HTMLcrossoriginstorageattribute on<link>/<script>and thecrossOriginStorageJS import attribute.share-web-fonts-across-originscovers the declarative CSScross-origin-storage()request-url-modifier used alongsideintegrity()in@font-face.Each use case now has a
guide.mdwith how-to-implement steps, example code, best practices, and a fallback strategy section; anegative-demo.htmlthat omits COS entirely as the grading counterpart to the existingdemo.html; agrader.tswith Playwright checks derived fromexpectations.md; and atasks/task.mdusing theempty-appbase app, matching the pattern used by the other resource-loading use cases in this repo.Closes #1281
Closes #1282
Closes #1283
Opening as a draft so the grader assertions and task phrasing can get a look before merge.