Repository navigation
A site may take a content policy on every page that runs a script (#306). The chat keeps a signed-in reader's token in the origin's storage, and GitHub Pages sends no header a site chooses, so a <meta http-equiv="Content-Security-Policy"> in the page is where the page says which scripts are its own. With "csp": true in design.config.json, npm run design writes it after each scripted page's <meta charset>: each inline script by its SHA-256, scripts from files as the origin's own, and requests only to the origin and to the chat host and identity service the page's chat.js tag names. A page that runs no script carries none. design:check is red for a page whose policy no longer names its scripts, and the shared suite fails a page on anything its policy refused while it loaded.
What breaks. Nothing for a site that does not opt in. design.config.json accepts one more key, csp, and only as true.
How to take it. Re-pin, add "csp": true to design.config.json, run npm run design, then npm run og and npm run sitemap, since the scripted pages change, and commit. An inline script edited later needs npm run design again before design:check is green.
Verified: npm test (1127 pass, Playwright included) and conventions-check pass on the release commit; with this tree and "csp": true, the three sites' design:check, pages:check and verify pass.