Review finding
Composition-level audioBed.src is not validated against the production asset URL policy. Hardened deployments can pass assets: { baseUrl, allowedSchemes: ['https:'] } to validation and preloading, but composition beds are outside scene.assets and currently use the audio service's hardcoded default URL policy.
Evidence
docs/asset-url-policy.md:35 documents the hardened production profile with baseUrl and allowedSchemes: ['https:'].src/runtime/validation.ts:379 checkCompositionAudioBed() calls only assertAudioBedDeclaration(), which validates shape but not URL scheme or base URL resolution.src/runtime/audio.ts:990 validates audio URLs with resolveAssetUrl(url, undefined, DEFAULT_ALLOWED_SCHEMES), not the deployment's supplied asset policy.src/runtime/scene-loader.ts:1315 passes the bed directly to createAudioService() after scene preloading; the preloader never sees composition-level bed URLs.
Impact
A production entrypoint that tightens scene assets to https: can still accept and attempt to play composition beds declared as http:, data:, or blob: URLs. That bypasses the documented transport and inline-payload controls for hardened deployments.
Recommended fix
Thread the same asset URL policy used by validateRuntime() and the preloader into composition audio-bed validation and runtime audio-bed source checks.
Acceptance checks
validateRuntime({ assets: { baseUrl, allowedSchemes: ['https:'] } }) reports findings for composition beds whose src resolves to http:, data:, blob:, file:, or another disallowed scheme.createAudioService() or the loader receives the effective asset URL policy and rejects bed sources that violate it if validation was skipped.- Tests cover string and array
audioBed.src values.
- Current permissive authoring defaults continue to work when no explicit production policy is supplied.
Review finding
Composition-level
audioBed.srcis not validated against the production asset URL policy. Hardened deployments can passassets: { baseUrl, allowedSchemes: ['https:'] }to validation and preloading, but composition beds are outsidescene.assetsand currently use the audio service's hardcoded default URL policy.Evidence
docs/asset-url-policy.md:35documents the hardened production profile withbaseUrlandallowedSchemes: ['https:'].src/runtime/validation.ts:379checkCompositionAudioBed()calls onlyassertAudioBedDeclaration(), which validates shape but not URL scheme or base URL resolution.src/runtime/audio.ts:990validates audio URLs withresolveAssetUrl(url, undefined, DEFAULT_ALLOWED_SCHEMES), not the deployment's supplied asset policy.src/runtime/scene-loader.ts:1315passes the bed directly tocreateAudioService()after scene preloading; the preloader never sees composition-level bed URLs.Impact
A production entrypoint that tightens scene assets to
https:can still accept and attempt to play composition beds declared ashttp:,data:, orblob:URLs. That bypasses the documented transport and inline-payload controls for hardened deployments.Recommended fix
Thread the same asset URL policy used by
validateRuntime()and the preloader into composition audio-bed validation and runtime audio-bed source checks.Acceptance checks
validateRuntime({ assets: { baseUrl, allowedSchemes: ['https:'] } })reports findings for composition beds whosesrcresolves tohttp:,data:,blob:,file:, or another disallowed scheme.createAudioService()or the loader receives the effective asset URL policy and rejects bed sources that violate it if validation was skipped.audioBed.srcvalues.