NUB-CLASS-1: Strict baseline posture (sub-track)

[dskvr]

Status: Draft
Parent: NUB-CLASS
Class number: 1

Summary

NUB-CLASS-1 is the strict baseline posture for napplets that do not declare any class-contributing NUB capabilities. Shells emit a restrictive Content Security Policy with connect-src 'none', show no consent prompt, and send class.assigned with class: 1.

CSP Posture

connect-src 'none'

Shells emitting the NUB-CLASS-1 posture MUST include connect-src 'none' in the runtime CSP served with the napplet's HTML. Other directives in the baseline CSP (script-src, default-src, img-src, etc.) are shell-policy concerns and are NOT specified by NUB-CLASS-1 — only the connect-src value is the class's defining characteristic.

Scope

• Manifest Prerequisites — default posture; reached when no other class-contributing NUB's trigger conditions are met. Future NUB-CLASS-$N ($N > 1) MUST document their own triggers.
• Shell Responsibilities — emit baseline CSP with connect-src 'none', skip consent prompt, send terminal class.assigned with class: 1.
• User Consent — no consent state; resolves to NUB-CLASS-1 at first load, every subsequent load, under every shell that implements the base protocol, independent of user action.
• Security Considerations — zero direct-network surface; napplet cannot fetch/WebSocket/EventSource any host. Indirect network still available via shell-mediated NUBs (e.g., NUB-RESOURCE).

Non-Goals

• Dynamic promotion — a napplet that starts as NUB-CLASS-1 stays NUB-CLASS-1 for its lifecycle; promotion to a higher class requires manifest change + aggregateHash change + new iframe.
• Defining shell CSP policies beyond connect-src — not in scope.

Implementations

(none yet)