## Summary
Enforces Fabro's CSP by switching from
`Content-Security-Policy-Report-Only` to `Content-Security-Policy` while
preserving the SPA sources we know are required. The policy now hashes
the install-mode inline bootstrap and allows `ws:`/`wss:` connections so
terminal WebSockets do not regress under enforcement.
The security headers integration test now asserts enforced CSP behavior,
and the public security docs now describe the default headers Fabro
emits.
## Verification
- `cargo +nightly-2026-04-14 fmt --check --all`
- `cargo test -p fabro-server csp::tests --lib`
- `cargo test -p fabro-server security_headers::tests --lib`
- `cargo test -p fabro-server --features test-support --test it
security_headers_are_applied_to_all_responses`
- Browser QA against an enforced local server: login, runs list,
settings, and automation diagram rendered with no CSP console violations
or page errors.
- Live listener on `127.0.0.1:32276` restarted and verified to emit
`content-security-policy` with no report-only header.
---
[](https://github.com/EveryInc/compound-engineering-plugin)
🤖 Generated with GPT-5 via [Codex](https://openai.com/codex)
535cbda355