feat: publish av-tools 0.2.0

docs/PORTAL_REQUIREMENTS.md

@@ -18,7 +18,7 @@ X-Content-Type-Options: nosniff
 
 Serve `.wasm` as `application/wasm`, JavaScript modules as a JavaScript MIME
 type and JSON as `application/json`. Test real responses under
-`/apps/av/vendor/ffmpeg/0.12.10/...`; a file-extension allowlist alone does not
+`/apps/av/vendor/ffmpeg/0.12.10-reviewed-stack5m.1/...`; a file-extension allowlist alone does not
 prove the MIME type.
 
 Suggested CSP:
@@ -43,45 +43,36 @@ form-action 'none';
 `'unsafe-eval'` is unnecessary. `worker-src blob:` covers the wrapper-created
 worker path. `media-src blob:` permits local source/result previews.
 
-## Immutable reference and active-worktree state
+## Reviewed Portal state
 
-Portal revision `bda9da044d61c109afd9969d357cc27f76648938` already sends COOP
-`same-origin`, COEP `require-corp`, CORP `same-origin`, `script-src 'self'
-'wasm-unsafe-eval'`, and `worker-src 'self' blob:`. Its packaged nginx CSP does
-**not** declare `media-src`; `default-src 'self'` therefore blocks local
-`blob:` audio/video URLs. The expected browser diagnostic is equivalent to:
+Portal revision `5c052bc6d1073a66600cfddc44c0e16da34bede8` (tag `v0.6.0`)
+already sends COOP `same-origin`, COEP `require-corp`, CORP `same-origin`,
+`script-src 'self' 'wasm-unsafe-eval'`, `worker-src 'self' blob:` and
+`media-src 'self' blob:`. Its nginx profile also maps `.wasm` explicitly to
+`application/wasm`. Local source and result Blob previews therefore require no
+CSP exception beyond that reviewed narrow media directive.
 
-```text
-Refused to load media from 'blob:…' because it violates
-"default-src 'self'".
-```
+As inspected on 2026-07-26, the active
+`/mnt/DATA/git/toolbox-portal/deploy/nginx.conf` has an additional worktree
+patch that extends the immutable FFmpeg cache rule from plain semantic versions
+to the one exact reviewed build profile
+`0.12.10-reviewed-stack5m.1`. The corresponding deployment tests accept the
+five reviewed core files and `version.json` while rejecting mutable-looking
+suffixes, malformed versions and unexpected paths. A clean temporary clone
+containing that exact patch passed the AV release assembly smoke without a
+known-header-gap override.
 
-Smallest required Portal change: append exactly
-`media-src 'self' blob:;` to that CSP. This permits only same-origin and
-in-memory Blob media; it does not permit remote media hosts, inline script or
-eval. If the Portal is not changed, conversion/download can remain available
-but Blob source/result preview must show a clear disabled reason.
-
-As inspected on 2026-07-24, the active
-`/mnt/DATA/git/toolbox-portal/deploy/nginx.conf` contains that exact directive
-as a local worktree patch. The worktree still resolves to the immutable
-revision above, so the patch is useful for local deployment testing but is not
-a committed Portal revision and must not be cited as published release
-evidence. The clean-reference assembly smoke therefore continues to require
-`--allow-known-header-gap` until a reviewed Portal commit contains the fix.
-
-The nginx profile includes `.wasm` in its static allowlist/gzip types but
-relies on the base image `mime.types`. Verify `Content-Type:
-application/wasm` against the pinned image; add an explicit mapping if the
-response differs.
+Until the cache extension is committed, cite it only as staged integration
+evidence, not as a published Portal revision. The clean `v0.6.0` rule leaves
+the reviewed profile at `no-cache`; that affects performance, not loading,
+MIME type, isolation or preview correctness.
 
 ## Caching
 
-The immutable Portal reference's cache map makes Vite content-hashed assets
-immutable but leaves versioned FFmpeg cores at `no-cache`. Correctness is
-unaffected.
-For performance, the exact directory
-`apps/av/vendor/ffmpeg/0.12.10/{st,mt}/` may receive:
+The staged Portal cache map makes Vite content-hashed assets, plain semantic
+versions and the explicitly reviewed profile immutable. For performance, the
+exact directory
+`apps/av/vendor/ffmpeg/0.12.10-reviewed-stack5m.1/{st,mt}/` may receive:
 
 ```text
 Cache-Control: public, max-age=31536000, immutable