fix(release): restore v1.28.0 release truth (#444)

* fix(release): restore v1.28.0 truth

* fix(release): harden candidate truth checks

* fix: close release gate coverage and security hygiene

* fix: harden release gate correction paths

* fix(csp): enforce policy and restore patch coverage

* chore(csp): add shared origin source

* fix(csp): classify blocked local endpoints

* fix(csp): close review gaps in endpoint policy

Author: qnbs

.github/workflows/ci.yml

@@ -171,6 +171,9 @@ jobs:
       - name: Doc metrics drift gate (locale/key counts, stale PLANNED status)
         run: pnpm run docs:check
 
+      - name: CSP source synchronization and parity
+        run: pnpm run csp:verify
+
       - name: Native-readiness roadmap policy gate
         run: pnpm run native-readiness:check
 
@@ -183,11 +186,10 @@ jobs:
       - name: Typecheck (tsgo)
         run: npx tsgo --project tsconfig.tsgo.json --noEmit --checkers 4
 
-      # QNBS-v3: Vitest mit --retry=2 für stabile Runs + NODE_OPTIONS für Node 24 Kompatibilität.
-      # --no-experimental-webstorage deaktiviert native Node 24+ Web Storage API (verhindert localStorage.clear() Fehler).
-      # Best Practice 2026: Retry-Logik fängt transiente Fehler ab, die bei CI-Runner-Überlastung auftreten können.
-      - name: Unit tests (Vitest)
-        run: pnpm exec vitest run --coverage --reporter=json --outputFile=test-results.json --retry=2
+      # QNBS-v3: no retry — a first-attempt failure remains visible instead of being masked as a pass.
+      # --no-experimental-webstorage disables Node 24's native Web Storage API for deterministic setup.
+      - name: Unit tests (Vitest, no retry)
+        run: pnpm exec vitest run --coverage --reporter=json --outputFile=test-results.json
         env:
           NODE_OPTIONS: "--no-experimental-webstorage --max-old-space-size=4096"
           CI: "true"

AGENTS.md

@@ -294,6 +294,7 @@ hooks are not installed.
   repository lint/tests, E2E, coverage, Lighthouse, and mutation testing are cloud-CI work unless
   the user explicitly requests a narrowly scoped local run.
 - **Vitest watch-mode hard rule:** Never invoke `pnpm test`, `npm run test`, or a bare Vitest wrapper; use an explicit targeted `pnpm exec vitest run <path>` command so constrained hardware never waits on watch mode.
+- **First-attempt CI evidence:** The required Vitest job intentionally has no `--retry`; a first-attempt failure remains authoritative. Do not hide a suspected flake with `skip`/`todo` or retries. Temporary quarantine requires a `flaky-test` issue, owner, reproduction evidence, adjacent QNBS-v3 issue/expiry comment, visible CI summary, and removal or explicit renewal within 14 days; see `docs/CI.md`.
 - **Heavy tier (CI):** Vitest with coverage thresholds, Playwright E2E (desktop + mobile emulation), Lighthouse CI, Stryker mutation, Storybook static build, bundle budget + analyze.
 
 ### Unit Tests (Vitest)
@@ -353,7 +354,7 @@ deploy (main, non-PR) needs: ci-success ──► GitHub Pages
 | Job | Purpose |
 |-----|---------|
 | `security` | `pnpm audit --audit-level=high`, OSV scanner (pnpm + `src-tauri/` + `crates/` Cargo lockfiles), gitleaks secrets scan, dependency review on PRs |
-| `quality` | Node 22 + 24 matrix → Biome lint, suppression-debt ratchet, `i18n:check`, `parity:check`, `tsgo --noEmit`, Storybook build, Vitest + coverage, Codecov upload |
+| `quality` | Node 22 + 24 matrix → Biome lint, suppression-debt ratchet, `i18n:check`, `docs:check`, `csp:verify`, `parity:check`, `tsgo --noEmit`, Storybook build, Vitest + coverage, Codecov upload |
 | `rust-tauri` | `fmt`/`check`/`clippy`/`test` for `src-tauri/`; path-scoped (skips on PRs that don't touch it), needs GTK/WebKit apt-get steps |
 | `core-rust` | Same `fmt`/`check`/`clippy`/`test` for `crates/worldscript-project` (renderer-neutral Rust Core); path-scoped, no GUI deps so no apt-get steps needed |
 | `build` | Production build, smoke-test prod build in Chromium, bundle budget, rollup analyze artifact; on `main`: SLSA build provenance attestation + Pages artifact |
@@ -407,9 +408,7 @@ Never commit directly to `main` — always a feature branch + PR, even for a sin
 ## Security Considerations
 
 - **No build-time secrets.** API keys are entered via Settings UI and stored encrypted in IndexedDB (AES-256-GCM via Web Crypto API). Do not put AI keys in `.env` or host environment variables for inference.
-- **CSP:**
-  - Web (`index.html`): `connect-src` includes `https:` scheme-source to support BYOK custom base URLs, plus explicit localhost endpoints for Ollama/LM Studio/local AI and explicit `wss://` signaling endpoints. See ADR-0004 for the web-vs-Tauri rationale.
-  - Tauri (`src-tauri/tauri.conf.json`): strict `connect-src` with enumerated cloud provider endpoints, no `https:` blanket.
+- **CSP:** Web and Tauri use the same explicit `connect-src` origin allowlist from `config/csp-connect-src.json`; arbitrary `https:`, `http:`, and `ws:` scheme wildcards are forbidden. Run `pnpm run csp:sync` followed by `pnpm run csp:check` after changing a provider, local service, or signaling endpoint; CI enforces the non-mutating `pnpm run csp:verify` drift check. Runtime preflight rejects unlisted browser BYOK endpoints with an actionable error.
 - **No `dangerouslySetInnerHTML` without DOMPurify.** Biome flags `noDangerouslySetInnerHtml` as error.
 - **Never log API keys, IVs, or plaintext payloads.** Use `services/logger.ts` (`createLogger(module)` factory — IDB + Tauri JSONL + DEV console sinks; GDPR `sanitizeLogContext`). `console.log` is blocked by Biome in production paths.
 - **Service Worker:** AI hosts are network-only (`public/sw.js`). WASM/ONNX chunks are excluded from precache.

AUDIT.md

@@ -2,7 +2,7 @@
 
 **Date:** 2026-04-17 (baseline); **follow-up chain:** … → 2026-05-28 (v1.19.0 — Security/Voice/RTL/Logger B-1..B-8) → **2026-05-30 (B-1 passphrase UX + CI unblock)** → **2026-05-31 (i18n audit + settings features + CI stabilization)** → **2026-05-31 (Edge-AI Perfection Cycle — Phases 0-7 complete)** → **2026-06-01 (Post-crash session: CI stabilisation + 14 CodeAnt AI fixes + E2E hardening)** → **2026-06-02 (Perf Phase 2.3 — pipeline-LRU unification + PR #69 CodeAnt fixes)** → **2026-06-03 (WorkerBus v2 Phase 3 — Rust TaskSupervisor + Tauri-build unblock)** → **2026-06-06 (Phase 3 i18n Expansion — ja/zh/pt/el + Intl APIs)** → **2026-06-09 (v1.21 Deep Audit Correction — Whisper WASM download UI + 3 CodeAnt fixes + CloudSync LWW)** → **2026-06-09 (feat/deep-audit-v1.21 — CSP hardening, zh locale ≤5% EN, coverage Batches A/B/C, VoiceActivityCoordinator B-2 bridge)** → **2026-06-11 (Ultimate Copilot v2 Phase 2+3 — markdown, sidebar, Apply-to-chapter, InlineAnnotation, ProForge chip; PR #110+#111)** → **2026-06-11 (v1.22.0 release — OpenRouter Cloud 5 provider, AI Execution Modes hybrid/cloud/local/eco, AiModeIndicator, SW cache-invalidation fix)** → **2026-06-13/14 (v1.23 perfection batch — OpenRouter + AI-Execution-Mode settings sections localized/modernized, i18n single-brace interpolation bug-class fix + `i18nPlaceholders` regression guard, bundle split + budget tightening PR #130)** → **2026-06-16 (v1.23.0 release — rebrand StoryCraft → WorldScript Studio, local-first data foundation ADR-0008, Tauri blank-screen + asset-URL fixes, AI error taxonomy + retry hardening, command-palette & local-AI settings localization, WorldScript W monogram icons)** → **2026-06-16 (post-release documentation perfection pass — corpus sync, metric reconciliation, history archival, dependabot hardening)** → **2026-06-17 (Language expansion — +6 locales fi/sv/hu/is/eu/fa (RTL); PR #174 merged; `LanguageSelector` exonym localization via `portal.language.names.*`; portal chrome 100 % for the 6 new langs; README/AUDIT/CHANGELOG docs sync)** → **2026-07-28 (v1.24.1 — Local-AI reliability fixes #266, Dependabot backlog triage, Issue #60 audit closeout, security/build hardening)** → **2026-07-29 (v1.24.2, PR #284 — CSP functional-truth, desktop crypto, and doc-truth hardening; the local-inference stack had been silently non-functional in production for two months; merged and tagged)** → **2026-07-30 (v1.24.3, WorkerBus v2 worker-generation consolidation — 5 stacked PRs #286–288/#290–291 + independent #289 recovered after an interrupted merge queue; ADR-0015; merged and tagged)** → **2026-08-12 (encryption lifecycle + desktop reliability + recovery journal — stacked PRs #335/#336/#337 merged into `main`; fail-closed IDB encryption lifecycle, desktop AI/Python provider hardening for #332/#333, durable resumable migration journal with secondary-store adapters; PR #339 closes the write-vs-migration TOCTOU race CodeRabbit and Qodo independently found on #337; PR #310 closed as superseded; Phase-4 production wiring for disable/rotate tracked as issue #338)** → **2026-08-13 (v1.27.0 — Phase 4 encryption disable/rotate production wiring + i18n (#342/#343 close issue #338), Tauri desktop boot-hydration + flush-on-quit + Settings re-render perf fixes (#332, PR #345), AI Writing Studio unreadable-text fix (#341, PR #344), download-progress bytes/speed for voice + WebLLM models (#333 item 1, PR #346); all 5 PRs' correction loops ran to full quiescence — codebase-wide QNBS-v3/i18n fixes, a real data-integrity bug found and fixed in the rekey-recovery try/catch scoping, and sequential main-reconciliation merges across the whole 5-PR stack)** → **2026-08-14 (v1.27.1 — desktop persistence/security stabilization; #363: atomic writes across every Tauri fs-backed store, unified fail-closed desktop API-key routing, factory-reset UI/logic consolidated into `useFactoryReset` + `FactoryResetDangerZone`, packaged-build factory-reset capability-scope fix, `#[cfg(desktop)]`-gated menu-event handler + re-wired native menu-action bridge, `rust-tauri`/`e2e`/`vrt` promoted to required CI gates; plus the nanoid security-advisory patch, PR #362)**
 **Scope:** Full application, repository configuration, CI/CD, documentation, release validation
-**Current version:** **v1.27.1** — Desktop persistence/security stabilization (#363: atomic writes, fail-closed key routing, factory-reset consolidation, packaged-build capability fix, Rust/E2E/VRT promoted to required CI gates) plus the nanoid security-advisory patch (#362). **2919 keys × 19 locales**. Historical release sections below remain historical.
+**Current version:** **v1.28.0 release candidate** — tag pending the dedicated release merge; includes the post-v1.27.1 diagnostics, Core-boundary, CI/Stryker-plumbing, and release-truth work. **6870 Vitest source-declared tests across 564 files · 2923 keys × 19 locales**. Historical release sections below remain historical.
 
 **Quality gate (2026-08-14 — v1.27.1):** lint ✅ · typecheck ✅ (tsgo) · i18n:check ✅ (**2919 keys × 19 locales**) — verified locally per the CI-cloud-first workflow; full CI suite (Quality Gate Node 22+24, rust-tauri, Build, E2E, E2E Deep Coverage, Storybook, Lighthouse, Visual Regression) tracked on the `release/v1.27.1` → `main` PR before merge/tag.
 

App.tsx

@@ -32,7 +32,7 @@ import {
 import { Header } from './components/Header';
 import { Sidebar } from './components/Sidebar';
 import { EncryptionRecoveryModal } from './components/settings/EncryptionRecoveryModal';
-import { IdbUnlockModal } from './components/settings/IdbUnlockModal';
+import { IdbUnlockModalGate } from './components/settings/IdbUnlockModalGate';
 import { Button } from './components/ui/Button';
 import { DuckDbMigrationBanner } from './components/ui/DuckDbMigrationBanner';
 import { ErrorBoundary } from './components/ui/ErrorBoundary';
@@ -59,6 +59,7 @@ import { projectActions } from './features/project/projectSlice';
 import { statusActions } from './features/status/statusSlice';
 import { useApp } from './hooks/useApp';
 import { useGlobalKeyboardShortcuts } from './hooks/useGlobalKeyboardShortcuts';
+import { useIdbUnlockStartupGuard } from './hooks/useIdbUnlockStartupGuard';
 import { useNativeNotifications } from './hooks/useNativeNotifications';
 import { usePushToTalk } from './hooks/usePushToTalk';
 import { useTranslation } from './hooks/useTranslation';
@@ -77,10 +78,7 @@ import {
   type EncryptionMigrationJournal,
   readEncryptionMigrationJournal,
 } from './services/storage/encryptionMigrationJournal';
-import {
-  hasPassphraseSentinel,
-  isIdbEncryptionReady,
-} from './services/storage/storageEncryptionService';
+import { isIdbEncryptionReady } from './services/storage/storageEncryptionService';
 import { initTauriDeepLink } from './services/tauriDeepLink';
 import {
   registerTauriMenuHandler,
@@ -382,21 +380,14 @@ const App: FC<AppProps> = ({ isNewUser }) => {
     })();
   }, []);
 
-  // QNBS-v3: B-1 sentinel guard (async) — skips if flag off/unlocked/recovery-pending, auto-disables on a missing sentinel, else shows the unlock modal.
-  useEffect(() => {
-    if (!featureFlags.enableIdbAtRestEncryption || isIdbEncryptionReady() || recoveryJournal)
-      return;
-    void (async () => {
-      const hasSentinel = await hasPassphraseSentinel();
-      if (!hasSentinel) {
-        dispatch(featureFlagsActions.setEnableIdbAtRestEncryption(false));
-        return;
-      }
-      // QNBS-v3 (CodeAnt #342): re-check via the ref, not the closed-over `recoveryJournal`, since the sibling journal-check effect may have resolved mid-await.
-      if (recoveryJournalRef.current) return;
-      setIdbUnlockOpen(true);
-    })();
-  }, [featureFlags.enableIdbAtRestEncryption, recoveryJournal, dispatch, setIdbUnlockOpen]);
+  // QNBS-v3: desktop project files remain plaintext until R-15; the startup guard is web-only.
+  useIdbUnlockStartupGuard({
+    isDesktop: desktopPlatform.runtime.isDesktop,
+    encryptionEnabled: featureFlags.enableIdbAtRestEncryption,
+    encryptionReady: isIdbEncryptionReady(),
+    hasRecoveryJournal: Boolean(recoveryJournal),
+    dispatch,
+  });
 
   // QNBS-v3: PWA share_target GET params → toast + stash for Writer paste flows; strip query to avoid leaking shared text in URL bar.
   useEffect(() => {
@@ -907,11 +898,11 @@ const App: FC<AppProps> = ({ isNewUser }) => {
                   />
                 </ErrorBoundary>
               )}
-              {isIdbUnlockOpen && !recoveryJournal && (
-                <ErrorBoundary onReset={() => setIdbUnlockOpen(false)}>
-                  <IdbUnlockModal onUnlocked={() => setIdbUnlockOpen(false)} />
-                </ErrorBoundary>
-              )}
+              <IdbUnlockModalGate
+                isOpen={isIdbUnlockOpen}
+                encryptionEnabled={featureFlags.enableIdbAtRestEncryption}
+                hasRecoveryJournal={Boolean(recoveryJournal)}
+              />
             </div>
           </AppContext.Provider>
         </ToastProvider>

CHANGELOG.md

@@ -7,12 +7,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+<!-- release-candidate: v1.28.0 — the tag is created only after the release PR merges. -->
+
+## [1.28.0] — 2026-08-21
+
 ### Added
 
 - **Cloud model catalog defense-in-depth:** current Anthropic, OpenAI, and xAI model IDs now
   share one typed catalog across settings, fallbacks, and the Claude proxy allowlist.
 - **Native bundle and translation-quality floors:** bundle budgets now distinguish entry, vendor,
   regular JS, and WASM assets; CI also enforces the existing translation coverage/outlier floor.
+- **Renderer-neutral Rust Core seed:** `crates/worldscript-project` now provides headless project
+  schema, validation, migration, plain JSON I/O, and a test/CLI harness, with one narrow Tauri
+  validation command wired through the cross-workspace path dependency.
+- **Rust TaskSupervisor bounded text proof:** adds bounded renderer-neutral `text.analyze` and
+  `text.diff` tasks, typed qualification wrappers, deterministic LCS/whitespace contracts, and
+  explicit fallback to the existing TypeScript path; no production caller is switched yet.
 
 ### Fixed
 
@@ -21,23 +31,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   tagless or shallow checkouts as a false failure.
 - **Spotlight tour theme:** the post-rebrand driver.js popover now binds to its WorldScript CSS
   selector, with a regression test protecting the binding.
+- **Desktop encryption scope truth:** desktop project files remain explicitly documented as
+  plaintext until the renderer-neutral R-15 storage work ships; the IndexedDB passphrase flow no
+  longer presents itself as a project-file encryption gate on Tauri.
+- **CI authority closure:** Core path changes now select the Tauri consumer gate, workflow-policy tests protect local path-dependency coverage and aggregate deployment gating, and Pages deployment waits for `ci-success`.
+- **Accessibility contrast:** command-palette heading contrast was corrected to meet the intended
+  WCAG threshold.
 
 ### Deprecated
 
 - **`storycraft://` deep links:** the legacy scheme remains accepted for this release and displays
   a migration notice; it is scheduled for removal in the next release.
 
-- **Renderer-neutral Rust Core seed:** `crates/worldscript-project` now provides headless project
-  schema, validation, migration, plain JSON I/O, and a test/CLI harness, with one narrow Tauri
-  validation command wired through the cross-workspace path dependency.
+### Changed
+
+- **CSP egress parity:** Web/PWA and Tauri now use one explicit provider, local-service, and Yjs
+  signaling origin allowlist; arbitrary HTTPS egress and the contradictory loopback upgrade policy
+  are no longer accepted. New BYOK endpoints require an explicit CSP policy update.
 - **Qt Early Killer-Gate qualification:** the native roadmap now requires cheap, evidence-backed
   lifecycle, accessibility/input, packaging/update-trust, crash/recovery, and security checks
   before substantial Qt UI work can create sunk cost.
-- **Rust TaskSupervisor bounded text proof:** adds bounded renderer-neutral `text.analyze` and
-  `text.diff` tasks, typed qualification wrappers, deterministic LCS/whitespace contracts, and
-  explicit fallback to the existing TypeScript path; no production caller is switched yet.
-
-### Changed
 
 - **Diagnostics sink boundary:** structured log construction and recursive redaction now remain
   portable before serialized IDB, Tauri JSONL, and development-console adapters receive the record;
@@ -55,17 +68,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   versions before native execution (#437, #439, #440).
 - **Native maturity evidence:** the G1 qualification ledger now records the partial, evidence-backed
   status of the native migration without claiming a production authority switch (#438).
-
-### Fixed
-
-- **CI authority closure:** Core path changes now select the Tauri consumer gate, workflow-policy tests protect local path-dependency coverage and aggregate deployment gating, and Pages deployment waits for `ci-success`.
-- **Accessibility contrast:** command-palette heading contrast was corrected to meet the intended
-  WCAG threshold.
+- **Mutation-test plumbing:** the manual Stryker workflow now uses explicit per-module incremental
+  files, preserves module report identity, validates aggregate metrics, fails closed on missing
+  shards, and propagates aggregation failures through the summary pipeline.
+- **Quality-gate truth:** Vitest CI no longer retries the suite, the suppression ratchet was
+  reduced from 52 to 48 through real test-mock cleanup, and docs checks now validate README test
+  file/case metrics against the current Vitest source set.
 
 ### Security
 
 - **CI supply-chain policy:** CodeQL action references and token permissions were hardened and
   Dependabot grouping was corrected so related action paths move together.
+- **Diagnostics redaction:** sensitive nested diagnostic context is recursively redacted before
+  serialized IDB, Tauri JSONL, or development-console sinks receive it.
 
 ## [1.27.1] — 2026-08-14