phase: 91_admin_theme_tab

All verification is complete — this pass needed no code changes. Final report:

**Phase 91 — Admin Theme tab: final verification pass (all 6 tasks already in `complete/`)**

- Verified pre-paint theming end-to-end: `ui_settings` store + resolver, admin `GET/PUT /api/ui-settings`, `CachingMiddleware` inline-`<style id="bor-theme">` injection before `</head>` (incl. `/shared/<token>` prefix branch, unit-pinned), CSP sha256 exemption for the inline tag, Theme tab shell + `theme.js` editor, CSS-file theming fully retired.
- No defects found; zero changes made — working tree left exactly as the task executors left it.
- Tests: `uv run pytest --cov=app` → 1841 passed, 0 failed (TOTAL coverage **99%**; theming/ui_settings/caching all 100%); `uv run pytest tests/e2e/test_admin_theme_tab.py -v --no-cov` → **5 passed** in isolation.
- Lint/types: `uv run ruff check .` → All checks passed; `uv run pyright` → 0 errors, 0 warnings.
- Criteria: (1) unset deployment byte-identical, no `#bor-theme` anywhere — ✓ (unit no-op test + E2E reset byte-compare); `rg "BOR_THEME|themes/"` → single hit is the permitted doc-history comment in `frontend/index.html`. (2) admin-only gate + 403s for anonymous and token users — ✓ (E2E test 3). (3) saved theme inline before `</head>` on every page incl. `/shared/<token>`, computed `--brand` on first paint for admin + anonymous — ✓ (E2E test 2 + unit). (4) reset → byte-identical; 5 contrast pairs warn <4.5:1, non-blocking — ✓ (E2E tests 4–5). (5) suite green, >90% coverage, lint clean — ✓. (6) commit deferred to harness per rules.
- Notable: `.agents/PLAN.md` is absent from the repo — the phase overview's Design section was used as the binding spec; no deviation resulted.
- Next pending phase: **none** — 91 is the last phase in `todo/`.

app/core/security_headers.py

@@ -55,7 +55,16 @@ class SecurityHeadersMiddleware:
     Adds exactly three headers to every HTTP response:
 
     * ``Content-Security-Policy``: the strict same-origin policy above
-      (``frame-ancestors 'none'`` → clickjacking closed, SEC-04);
+      (``frame-ancestors 'none'`` → clickjacking closed, SEC-04) —
+      EXCEPT when an inner layer has already set one: the phase-91
+      (task 05) pre-paint theme tag is an inline ``<style>`` that the
+      A1 policy would block in the browser, so the caching middleware
+      publishes, on themed HTML pages only, the A1 string with
+      ``style-src 'self' 'sha256-<tag-content-hash>'`` appended (the
+      current theme is the only inline style ever permitted — no
+      ``'unsafe-inline'``). A pre-existing CSP is that inner layer's
+      deliberate one and is preserved; every other response (including
+      every untagged page) gets the plain A1 string.
     * ``X-Frame-Options: DENY`` — legacy no-framing fallback;
     * ``X-Content-Type-Options: nosniff`` — MIME-confusion belt.
 
@@ -73,7 +82,12 @@ class SecurityHeadersMiddleware:
         async def send_wrapper(message: Message) -> None:
             if message["type"] == "http.response.start":
                 headers = MutableHeaders(scope=message)
-                headers["Content-Security-Policy"] = CSP
+                # Phase 91 (task 05): preserve a CSP an inner layer set
+                # (the caching middleware's theme-extended policy — see
+                # the class docstring); the A1 string covers every
+                # response without one.
+                if "content-security-policy" not in headers:
+                    headers["Content-Security-Policy"] = CSP
                 headers["X-Frame-Options"] = "DENY"
                 headers["X-Content-Type-Options"] = "nosniff"
             await send(message)