Validadoras: preserve CSP nonce on all routes

Sub-tickets

Activity

• wi-cli-venus created · 7w ago
  parent=#3053
• wi-cli-venus progress · 7w ago
  coder02 delivered audited CSP layout a5fe24f9; integrated into MOVILBA-140 checkout for combined DEV deploy after DB/app audit.
• wi-cli-venus note · 7w ago
  Audit-PASS one-file CSP fix commit a5fe24f9 handed to release coder and integrated into current MOVILBA-140 three-event correction. Combined DEV deployment will follow DB/app audit. Required live check: authenticated /validadoras response CSP nonce matches rendered script nonces and report-only warnings disappear. No independent deploy needed.
• wi-cli-venus statusChanged · 7w ago
  coder02 audited CSP force-dynamic layout integrated into combined MOVILBA-140 checkout; awaiting DB/app audit and DEV deploy.
• wi-cli-venus progress · 7w ago
  CSP force-dynamic layout shipped combined in DEV commit 5975691b / v5.4.62. Authenticated nonce verification assigned back to coder02; shipped audit pending.
• wi-cli-venus verified · 7w ago
  Independent shipped-diff audit PASS on commit 5975691b/v5.4.62. Remaining gate: authenticated browser nonce/script match requested from coder02.
• wi-cli-venus blocked · 7w ago
  Authenticated CSP verification requires a fresh interactive dev01 session on this host; the only stored browser token is expired. Code is shipped and independently diff-audited; no code defect established.
• wi-cli-venus note · 7w ago
  2026-08-28: investigating confirmed Report-Only nonce violations. Root app layout is client-only; audit requested for a server-root/client-shell refactor to force request-time rendering and restore nonce propagation before any code change.
• wi-cli-venus unblocked · 7w ago
  Implemented and committed 76b7c61d: root is server-rendered and calls headers(); client providers moved to RootLayoutClient. Lint and typecheck pass. Build/dev validation is blocked only by this temporary checkout's pre-existing node_modules symlink escaping Turbopack root; deploy verification remains required.
• wi-cli-venus blocked · 7w ago
  DEPLOY REGRESSION: 8af06f64 achieves nonce matching but causes /user/login 500 (digest 819141881; root layout default missing from React Client Manifest). Waiting on audit-mba-l-ca for a safe Next-16-compatible correction; dev deploy also held by schema drift reported by coder02-mba-l-cc.
• wi-cli-venus unblocked · 7w ago
  Fresh post-deploy verification from coder-mba-l-ca: dev01 /user/login, /validadoras, and /vehiculos/6619 all return 200; CSP response nonce matches the initial script nonce. The transient 500 was during deployment restart/build settling; no corrective source change required.
• wi-cli-venus completed · 7w ago
  Delivered in 8af06f64/v5.4.69. Audit static PASS; runtime verification passed on dev01: login, Validadoras, and vehicle-detail routes return 200, and the Validadoras CSP nonce matches the initial script nonce.