[hivecommons-hive]

Summary

Adds a sandbox allowlist to the GitHub Universe talk player on index.html (added in #307) and makes scripts/featured-video.test.mjs assert the exact token set, so navigation/forms/modals/downloads tokens cannot be added later without failing the gate. README's description of the gate is updated to match.

Why: the youtube-nocookie frame is the only third-party-controlled frame on a site whose CSP is otherwise default-src 'none'; the player serves third-party creatives, and an unsandboxed frame can navigate the top-level page on user activation. The allowlist (allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox allow-presentation) is what the embed needs to play, open "Watch on YouTube" in a new tab, and cast. Fullscreen is governed by allow/allowfullscreen, not sandbox, and is unchanged.

Please confirm playback in the Pages preview before merging — this is behavioural for the player, not just markup.

Closes #308

Screenshots

No visible change at rest; player chrome is identical.

Checks run locally

• node --test scripts/*.test.mjs (809 pass; the new assertion fails on main with "missing sandbox attribute")
• scripts/check-links.sh --external-warn (no link changes)
• scripts/check-links.test.sh
• scripts/check-redirects.test.sh
• scripts/check-redirects.sh

Checklist

• Shortcut redirects untouched
• No inline <script> edited (no CSP hash update needed)
• No new top-level page
• No integration/sponsor list change
• Commits are signed off (git commit -s)

---

Filed by sec-check agent (ACMM L6 — full mode)

— hive: agent=sec-check backend=copilot model=claude-fable-5.1 copilot=1.0.88

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kellyaa for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[hivecommons-hive]

Read index.html:405-410 and scripts/featured-video.test.mjs at 5d90d1d. Looks correct to me.

• The sandbox token set (allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox allow-presentation) is what the youtube-nocookie embed needs: scripts + same-origin for the player itself (cross-origin to this page, so same-origin here is youtube's origin, not ours), popups to open "Watch on YouTube" in a new tab, presentation for cast. No allow-top-navigation*, so a creative cannot navigate the top-level page; fullscreen stays governed by allow="fullscreen"/allowfullscreen, which the existing test at featured-video.test.mjs:41-42 already pins.
• The new test uses the existing attribute() helper (featured-video.test.mjs:11-15), which asserts the attribute is present, so it fails on main as the body says. The exact-set deepEqual plus the negative-prefix loop means any later addition of navigation/forms/modals/downloads tokens trips the gate.
• CSP (index.html:5, frame-src https://www.youtube-nocookie.com) is unchanged; no inline script touched, so no hash update needed.

One thing I could not verify statically: actual playback under the sandbox in the Pages preview, as the body itself asks. That is a two-click check for whoever merges.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Hive status — updated in place; edits do not notify. Full history is in the Activity Monitor.

Review findings from reviewer (folded here because this head already carries its hive review):

Read index.html:407-410 and scripts/featured-video.test.mjs at 5d90d1d, and ran the test on both sides: the new assertion fails on main with missing sandbox attribute (featured-video.test.mjs:13) and the suite passes 5/5 on this head. The frame is cross-origin (youtube-nocookie.com), so allow-scripts allow-same-origin together does not let the embedded document reach the embedding page — the spec's warning about that pair applies only to same-origin embeds. Fullscreen stays on allow/allowfullscreen (index.html:410), which sandbox does not govern, and the existing CSP frame-src (index.html:5) is untouched. Looks correct to me.

The one thing I cannot verify statically is the body's own caveat: that the player still plays and casts under this token set in the Pages preview. That check belongs to whoever merges.

Evidence bundle `#3095d90d1d` sha256:48a28a765886ad8e037db1b74339257e2451b4c968f6f3826bc88102b3bb285d — download from the dashboard or `hivectl review evidence #309`.