anti-slop-frontend-securelisted

# anti-slop-frontend-secure <!-- Provenance: materialized 2026-08-09 (S228) from the operator's Notion Skills Library page (v1.2.0, "1% Skill Engine v1.0" anatomy, page 6f67647aeef947919b0fa291c06db09e). Faithful transcription of the page's Core Execution Flow; not re-authored. The page's deliverables table lists scanner scripts (scan_emoji.js, scan_external_hosts.js, scan_dom_sinks.js, emit_netlify_headers.js) in a ZIP that is NOT attached to the Notion row - retrieval is an operator step. 2026-09-06: those scanners are superseded rather than retrieved. The gates below are implemented in this folder, in Python, on the standard library. --> **Security may block completion; subjective beauty may not.** That line is the contract. Everything in this card is the security half: safe DOM construction, network allowlists, content-security policy, secret exclusion. It is deterministic and it is checkable. A frontend taste provider is optional, scoped to eligible surfaces, read-only and advisory; this card reproduces no provider's doctrine and requires nobody to install one. ## The scripts this card asks you to run Both live in this folder, so an install delivers them and you can read them before you run them. They import nothing outside the Python standard library. - `audit_frontend.py` - the deterministic oracle. Six gates over one document. - `emit_csp.py` - derive a content-security policy for the deployment mode, or check one that alread