# SD Qualifier HTTP COOP Header Repair Evidence

Status: completed
Type: evidence
Updated: 2026-08-06
Parent: work/tickets/ticket-suppress-ineffective-coop-header-on-http-qualifier.md

## Outcome

The production HTTP route no longer emits an ineffective
`Cross-Origin-Opener-Policy` header. Chromium no longer reports that the COOP
header was ignored because `http://srv-rpi00.local` is an untrustworthy origin.
The repair changed only the web container and did not interrupt Controller A or
replace its qualified command and notification workers.

## Baseline

At the start of the repair, an unauthenticated request to
`http://srv-rpi00.local/sd-qualifier/login/` returned HTTP 200 plus:

```text
Cross-Origin-Opener-Policy: same-origin
```

Django 5.2 supplied that default header through `SecurityMiddleware`. Browsers
cannot honor COOP on the current plain-HTTP non-localhost origin, so Chromium
ignored it and emitted the reported warning.

## Implementation identity

- Source repository: `PC-Redemption/sd-qualification`
- Source branch: `codex/http-coop-header`
- Source commit: `6384539a7c2f65c6e4367e56bf212cf33dfbfc7a`
- Pull request: `https://github.com/PC-Redemption/sd-qualification/pull/35`
- Merge commit on `codex/full-address-scrub-adapter`:
  `a20c00081903b9ea1624571c4af9b9a3f37fddf2`
- Deployed tag: `srv-rpi00-sd-qualifier:http-coop-6384539`
- Deployed image:
  `sha256:62c21673efb450d46d67c5a80f9aea82f37ef69df9f51c12fa66b4f8a5e381cd`

The settings resolver now omits COOP when secure cookies are disabled, defaults
to `same-origin` when secure cookies are enabled, and accepts an explicit
`SDQ_CROSS_ORIGIN_OPENER_POLICY` override. The front-door documentation states
that removing a browser-ignored header is not an HTTPS substitute.

## Validation

- Targeted Linux-container tests: 5/5 passed.
- Exact-image full Linux suite: 239/239 passed in 49.546 seconds.
- Django system check: no issues.
- Production `/sd-qualifier/healthz`: HTTP 200 with database, storage, clock,
  workers, and selected profile contract healthy.
- Production login response: HTTP 200 with no
  `Cross-Origin-Opener-Policy` header.
- Playwright Chromium page title: `Sign in · SD Qualifier`.
- Playwright Chromium console: zero warnings, so the reported COOP warning is
  absent. One unrelated pre-existing `/favicon.ico` HTTP 404 remains.

## Deployment and campaign continuity

The web service was recreated with `docker compose up -d --no-deps --wait web`
during a fresh Controller A observation sleep window. No migration or database
backup was required because this change contains no schema or data mutation.

Post-deployment state at 2026-08-06T14:36Z:

- web image was exact and healthy;
- command and notification workers remained running on
  `sha256:4237e644eec42d742be75942a9ff2f8013812ebc309e0f416f306b70aefbd9c7`;
- all four current Controller A campaign systemd services remained active;
- no observer, programmer, scrub, HPT2-command, or HPT-initialization tool
  container was active during the web switch;
- the same `run-one.sh` process continued S4 AFTER 10080;
- campaign `648ba10c-0bc0-4319-8089-78a0cce287ce` reported 25 completed runs and
  one active run after deployment.

The prior web image remains locally available for rollback.
