docs(ADR-010)+fix(spike/#41): record the CORS-mode requirement, emit lint-clean results

Closes #40 alongside the #41 harness work, so one CI round covers both.

ADR-010 gained a "measured constraint" section: under
`blocked-destinations=(script style)` a same-origin script with a *valid*
SHA-256 integrity attribute is still refused unless the request is also made
in CORS mode. Measured on Electron 43.2.0 / Chromium while making the #11
exfil probe execute (PR #39). The dangerous part is the failure mode, not the
requirement -- refusal is silent, with no CSP-violation event and no console
error attributable to the cause, so "did not execute" and "executed and was
blocked" share an observable. The packaging work (#24) must therefore emit
`crossorigin` alongside the hash; the Open section records that.

The harness now emits lint-clean Markdown. Its result documents violated
MD007/MD012/MD032/MD036, and docs:lint runs over every .md in the tree -- so
the first measurement run that landed in a commit would have turned CI red.
Lists are flush-left and preceded by a blank line, the verdict block no longer
collapses into consecutive blanks when nothing failed, and the trailing
provenance line is a blockquote rather than a whole-line emphasis.

Verified: one document from the previous generator produces 7 lint errors
(measured by re-linting a retained pre-fix document); the tree now reports
0 issues over 58 files, a count that includes a freshly generated document
from a real Electron run. npm test 254 tests / 253 pass / 1 skipped / 0 fail,
exit 0; docs:governance passed. That run reproduced HARNESS_EXIT=4
independently of the authoring agent.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: marcohost33-maker

docs/adr/ADR-010-integrity-policy-same-origin-sri.md

@@ -77,6 +77,33 @@ unverified one.
 hash-and-substitute step, but it is a real build-pipeline requirement that did not
 exist before, and it lands on whoever introduces the first script.
 
+**Measured constraint — a correct hash alone is not enough (issue #40).** Observed on
+Electron 43.2.0 / Chromium while making the issue #11 exfil probe actually execute
+(PR #39): under `blocked-destinations=(script style)` a **same-origin** script carrying
+a **valid** SHA-256 `integrity` attribute is still refused. It executes only when the
+request is additionally made in CORS mode:
+
+```html
+<!-- blocked, despite a valid hash -->
+<script src="app.js" integrity="sha256-..."></script>
+
+<!-- executes -->
+<script src="app.js" integrity="sha256-..." crossorigin="anonymous"></script>
+```
+
+This is a property of the policy adopted here, not of the test fixture. **Every
+same-origin script and stylesheet in a future T1 application must therefore be loaded
+in CORS mode with integrity metadata**, and anything that generates or packages T1
+application HTML must emit both the hash *and* `crossorigin`, keeping the hash in sync
+with the bytes it ships.
+
+The dangerous part is the failure mode, not the requirement: refusal is **silent**.
+There is no CSP-violation event and no console error attributable to the cause. In the
+probe it presented as a payload that simply never ran — which let a downstream
+discrimination test pass vacuously, because "did not execute" and "executed and was
+blocked" produced the same observable. Any harness relying on this policy must be able
+to tell those two apart before it reports a result.
+
 **Rejected alternative — `Integrity-Policy-Report-Only` first.** The usual advice is
 to stage a new enforcing header through report-only. It is rejected here because the
 app has **zero** scripts and styles today: there is nothing to break, so there is
@@ -103,3 +130,7 @@ the policy is in force — then the ordering advice applies again.
 - Whether a future build step emits SRI hashes automatically or fails the build when
   an asset lacks one is an implementation decision for the first script-shipping
   change, not for this ADR.
+- The CORS-mode requirement recorded above lands in the package/verifier work
+  (issue #24), which is where hash-to-bytes binding is actually implemented. That work
+  must emit `crossorigin` alongside the hash; emitting only the hash produces assets
+  that fail silently at runtime.

spike/runtime-eval/harness/electron/main.js

@@ -581,14 +581,17 @@ const mdCell = lib.mdCell;
 
 function writeResultsMd(s, comparison) {
   const now = new Date().toISOString();
+  // Markdown lists are emitted flush-left and with a blank line before them: the repo's
+  // docs:lint gate (MD007/MD032) runs over every .md in the tree, so a result document
+  // that lands in a commit must satisfy it or it turns CI red for a measurement run.
   const memLines = Object.entries(s.memByTypeKB)
-    .map(([t, kb]) => `  - ${t}: ${(kb / 1024).toFixed(1)} MiB (${kb} KB)`).join('\n');
+    .map(([t, kb]) => `- ${t}: ${(kb / 1024).toFixed(1)} MiB (${kb} KB)`).join('\n');
   const probeVerdictLabel = (v) => (v === 'as-expected' ? 'OK' : (v === 'MISSING' ? '**MISSING (not measured)**' : `**${v}**`));
   const probeRows = comparison.map((c) =>
     `| ${c.index === null ? '—' : c.index} | \`${c.id}\` | ${c.category} | ${c.status} | ${c.expected && c.expected.length ? c.expected.join('/') : '—'} | ${probeVerdictLabel(c.verdict)} | ${mdCell(c.detail)} |`).join('\n');
   const blockedRows = s.egress.blockedList.length
-    ? s.egress.blockedList.map((b) => `  - ${b.method} ${b.scheme}: ${b.url} (${b.resourceType})`).join('\n')
-    : '  - (none — no external request was ever attempted)';
+    ? s.egress.blockedList.map((b) => `- ${b.method} ${b.scheme}: ${b.url} (${b.resourceType})`).join('\n')
+    : '- (none — no external request was ever attempted)';
 
   // The #status terminal state depends on whether ANY probe FAILed. With the
   // cachestorage payload fix in place, a clean run settles at state=done.
@@ -637,8 +640,10 @@ Generated by \`main.js\` from a live run; every number below is straight from th
       ? '**a control was exercised and FAILED** (see the verdict list below).'
       : '**NOT MEASURED** — at least one claimed control was absent, incomplete or inconclusive; this row must not be read as a pass.'}
 
-${s.verdict.failed.length ? s.verdict.failed.map((r) => `- FAILED CONTROL: ${mdCell(r)}`).join('\n') : ''}
-${s.verdict.notMeasured.length ? s.verdict.notMeasured.map((r) => `- NOT MEASURED: ${mdCell(r)}`).join('\n') : ''}
+${[
+    ...s.verdict.failed.map((r) => `- FAILED CONTROL: ${mdCell(r)}`),
+    ...s.verdict.notMeasured.map((r) => `- NOT MEASURED: ${mdCell(r)}`),
+  ].join('\n') || '- (no failed or unmeasured control)'}
 
 - Run timestamp (wall clock, informational only): ${now}
 - Runtime: **Electron ${s.electron}** (Chromium ${s.chromium}, Node ${s.node}, V8 ${s.v8})
@@ -667,6 +672,7 @@ ${s.verdict.notMeasured.length ? s.verdict.notMeasured.map((r) => `- NOT MEASURE
 | Local (app://) requests served | ${s.egress.allowedLocal} |
 
 Per-process idle memory (workingSetSize):
+
 ${memLines}
 
 ${stateNote}
@@ -742,7 +748,7 @@ measured (exit 4). No fixture outcome is prose-only any more.
 - ADR-006 stays PROPOSED. This file is one measured row of evidence, not a runtime selection.
 
 ---
-*ADR-006 Electron harness · isolated spike · ${s.platformLabel} runtime execution ${s.runDate}*
+> ADR-006 Electron harness · isolated spike · ${s.platformLabel} runtime execution ${s.runDate}
 `;
   // #41 P2: 'wx' fails if the file exists. resolveResultsPath already picks an
   // unused name; the flag is the second lock so no rerun can ever silently