[PRF.11] Blazor WebAssembly production build and generated C# SDK proof (offline units and local live run)

[deku2026]

Claim: PRF.11 epoch 1 (w-deku-20261009-prf-11)

Task record: runtime-proofs lane, task-prf-11. Authority:

• brief S20(d): offline units, plus the local opt-in live run against the proof origin once CLOUD.85 is deployed. Parts needing CLOUD.21 or CLOUD.22 are "blocked on CLOUD.21/CLOUD.22, not proven";
• S25, S27(b) (base href "/"), S28(i) (the successor of the WEB.40 app-proof row), and S36;
• plan defaults D1 to D12; D3 is resolved by fix6.

This PR delivers the Blazor WebAssembly production build and generated C# SDK proof on its offline units U1 to U9, plus the local opt-in live run.

Offline (U1-U9)

• the start record;
• the exact CSP token set and the profile serving contract on the published output;
• exact int64, uint64 and decimal fixtures, and the CON.92 decode limits;
• server-stream framing fixtures and the transport decision record: binary first, with no choice made before an observed run;
• the Site no-script reading and determinism evidence;
• the AL-06 budgets re-baseline: ceilings stay at the WEB.40 values, interactionBudgets stays re-baseline-pending (D8), and the largest file (dotnet.native.wasm, 3,001,422 bytes) is recorded;
• the inline-style audit and the in-browser CSP check;
• the live proof specs, which are opt-in and skip in CI;
• the proof record and handoff. U8 (admission) is not needed: the NuGet closure is unchanged.

S36 resolution. PRF.11's review found the profile CSP base-uri 'none' defect. Web #38 fixed it, and this branch merges main and pins base-uri 'self' in its exact-policy tests.

Live run (local opt-in)

• Target: https://proof.arcforges.com.
• Deployment: the CLOUD.85 follow-up Cloud #82; proof deploy run 38009326285; web-0.1.0-ci.117.1.
• Browser: the installed Chrome 156.0.8078.12 by path, with no download. Only anonymous GETs were made.

Result: 4 specs, 2 passed and 2 skipped. On /account/ and /chat/ the shell specs confirmed:

• the exact profile CSP;
• one <base href="/">;
• the root framework path returns 200;
• 0 CSP violations;
• the app heading rendered.

The greeting and INP specs are blocked on CLOUD.21/CLOUD.22, not proven, and so are the exact-value calls, typed failures, cancellation, session and CSRF, and the binary server stream. This record cites CLOUD.85 as its deployed proof-origin same-origin and base-href evidence.

Validation (author, and independent reviewer under CI conditions)

• locked restores; Release builds with 0 warnings;
• tests: Tooling 56, Site 76 (1 skip by design), Ui 15, App 96, Operations 6, Policy 108;
• format; publish;
• the twice-built candidate is identical and verifies (20 members); the profile bundle (175 members) verifies; budgets pass;
• npm test 94/94; audit 0; gitleaks 0; actionlint pass.

Mutation checks: the exact-policy pins and the HelloProbe send bound discriminate. The receive bound equals the library default and is recorded as a value pin, not proven.

Not run locally: npm run policy, which stops at the Node 24.20 vs 24.21 pin (hosted is authoritative).

Status

delivered (offline plus live shells). Completion waits on CLOUD.21 and CLOUD.22.

🤖 Generated with Claude Code

[deku2026]

Reviewed 7c668b8 for [PRF.11] epoch 1: approved. This is an independent exact-head review over the full change, with a delta focus on the live round.

Reviewer: independent session w-deku-20261008-rev-prf-11. Approvals are comments under one GitHub account, so independence is by session only.

Rounds:

• r1 found the material base-uri 'none' defect (reproduced in Chrome 156). It was escalated, ruled S36 and fixed in Web [WEB.40] Profile CSP base-uri 'self' and plain profile stylesheets (completion follow-up) #38.
• r2 found the status wording. It was fixed.
• Approved at 2643127, with six non-blocking notes.
• The live round at 7c668b8 addressed all six. Budget ceilings are restored to the WEB.40 values, byte-identical to c5a5f2e.

At 7c668b8, re-run independently:

• Gates under CI conditions: Tooling 56, Site 76 + 1 skip, Ui 15, App 96, Operations 6, Policy 108; format; Release builds with 0 warnings; publish; budgets pass (head values listed in the record); the twice-built candidate is identical and verifies; the bundle (175 members) verifies; npm test 94; audit 0.
• Mutations:
  • removing the explicit send bound fails the new test;
  • removing the receive bound changes nothing (the library default), as the record states;
  • the framing kind assertion discriminates.
• Live specs against https://proof.arcforges.com with Chrome 156 by path: 2 passed and 2 skipped, matching the author's run. An anonymous GET confirms base-uri 'self' on the profiles and 'none' on the Site.
• The record claims nothing that needs CLOUD.21 or CLOUD.22.

Non-blocking, carried:

• the budgets doc line 62 wording;
• the S25 reviewedOn pre-fill date (2026-10-09; ratified by this review, S25);
• the StreamFramingTests line 25 comment.
• npm run policy stops at the local Node pin (hosted is authoritative).