Add repoint rule 5: wasm reads need a CORS-clean URL form - #47
Merged
Conversation
lecture-wasm executes cells in the reader's browser, where CORS applies to every redirect hop; the github.com/*/raw/ form 302s with an empty access-control-allow-origin header and fails there, while raw.githubusercontent.com and media.githubusercontent.com (LFS) serve ACAO * and work. The set 1/2 wasm repoints normalised wasm URLs to the one form its runtime cannot fetch — found by the #45 validation, tracked in #46, fixed in QuantEcon/lecture-wasm#54. Also records the Phase 4 consequence: data.quantecon.org must serve ACAO * before lecture-wasm can cut over (#37). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Documents an additional “repoint rule” in PLAN.md to prevent CORS regressions when repointing datasets consumed by lecture-wasm, where reads occur in the reader’s browser and redirect-based URL forms can fail CORS checks.
Changes:
- Updates the “Repoint rules” intro to reflect five rules (adding URL-form considerations).
- Adds Rule 5 describing why
lecture-wasmmust use CORS-clean hosts (e.g.,raw.githubusercontent.com, andmedia.githubusercontent.comfor LFS) for in-browser data reads. - Notes why CI/audit cannot enforce this and records the Phase 4 implication for
data.quantecon.orgCORS headers.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
38 tasks
mmcky
added a commit
that referenced
this pull request
Aug 6, 2026
) * Audit: fail strict on wasm reads via the github.com/*/raw/ URL form Makes repoint rule 5 machine-checked: lecture-wasm executes code cells in the reader's browser, where the github.com/*/raw/ redirect fails CORS, so any wasm code-cell read via a github.com form is now a migration inconsistency — it fails --strict and renders in the dashboard's problems box. Only code-cell reads are scanned, so {download} and prose links (navigations, CORS-exempt) cannot trip it. This is a post-merge net, not a gate: the scan reads each lecture repo's main, so a violation turns the weekly/push audit red rather than blocking the offending PR. PLAN rule 5 updated to match. Negative-tested against a doctored lecture-wasm clone whose origin/main reverts mpd2020.xlsx to the github.com form: strict exits 1 with "mpd2020.xlsx: lecture-wasm reads via github.com/{org}/{repo}/raw/{ref}/… — fails CORS in the browser (repoint rule 5)". Current real repos pass clean. Follows up #46/#47; the empirical basis is recorded there. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Name the lecture in the rule-5 warning Addresses Copilot review: with only the file named, two wasm lectures reading the same file via a bad form would produce identical messages. Negative test now reports "mpd2020.xlsx: lecture-wasm long_run_growth reads via github.com/{org}/{repo}/raw/{ref}/…". Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
mmcky
added a commit
that referenced
this pull request
Aug 18, 2026
Measured 2026-08-19 while writing the #47 record: the course fork's french_rev.md fetches all three xlsx through a stale base_url pointing at lecture-python-intro's deleted datasets/ copies -- 404 today, so the breakage is current, not prospective as QuantEcon/workspace-lectures#47 assumed. Its published Pages site is unaffected (committed _build); only re-execution breaks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
mmcky
added a commit
that referenced
this pull request
Aug 19, 2026
….myst (#105) * Record the #47 consumers: tom-econ370-2025 and python-lecture-sandpit.myst The sweep recorded in QuantEcon/workspace-lectures#47 found a fifth consumer of caron.npy/nom_balances.npy outside the #46 list -- tom-econ370-2025, a frozen course fork with a live Pages site reading its own blob-identical copies -- plus python-lecture-sandpit.myst as a public holder. Both accepted as-is rather than repointed; these manifest notes are the documentation half of that decision. One correction to the sweep's grouped phrasing, verified today: no sandpit file references its dataBHS.mat copy at all (holder only, orphan), and only sandpit's french_rev.md npy reads actually resolve. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fig_3/dette/assignat: record tom-econ370-2025 as a broken reader Measured 2026-08-19 while writing the #47 record: the course fork's french_rev.md fetches all three xlsx through a stale base_url pointing at lecture-python-intro's deleted datasets/ copies -- 404 today, so the breakage is current, not prospective as QuantEcon/workspace-lectures#47 assumed. Its published Pages site is unaffected (committed _build); only re-execution breaks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Record the tom-econ370-2025 archival decision in the five notes Owner decision on QuantEcon/workspace-lectures#47 (2026-08-19): the course fork will be archived, so its broken xlsx re-execution reads are accepted rather than repointed. Archived repos keep serving raw and Pages URLs, so nothing changes at archival time. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Writes down the rule behind #46 so no future repoint reintroduces it:
lecture-wasmexecutes code cells in the reader's browser, where CORS is checked on every redirect hop — so its data reads must useraw.githubusercontent.com(ormedia.githubusercontent.comfor LFS files), never thegithub.com/<org>/<repo>/raw/redirect form, whose 302 carries an emptyaccess-control-allow-originheader.{download}and prose links are navigations and keep thegithub.comform.The rule notes why no existing guardrail covers it (the audit deliberately treats all URL spellings of one org/repo as the same pattern, and CI can't see a browser-only failure), gives the one-line browser-console test, and records the Phase 4 consequence:
data.quantecon.orgmust serveaccess-control-allow-origin: *beforelecture-wasmcan cut over — also being noted on #37 as an acceptance criterion.The code fix is QuantEcon/lecture-wasm#54 (five reads flipped, browser-verified). The two PRs are independent — either can merge first.
Resolves the rule half of #46 together with the code half in QuantEcon/lecture-wasm#54 — since completion spans two repos, #46 stays open for manual close once both have landed. (No closing keyword here on purpose.)
🤖 Generated with Claude Code