MediaPipe is loaded from the app's own origin in source, not rewritten by the
build: Rust passes the vendored base into the binding, and
third_party/mediapipe/vendor.sh vendors tasks-vision + the face landmarker for
both builds (prerender-static.sh now too), with its Apache-2.0 LICENSE and
NOTICE, and patches out the library's telemetry flush so turning on eye gaze
makes no third-party request. The vendor directory is versioned by content.
capabilities.rs probes the device once after hydration (never in SSR):
WebGPU adapter, limits and subgroups; JSPI; cross-origin isolation; memory,
storage and persistence; Background Fetch; setSinkId on AudioContext and media
elements; speech synthesis, with local voice languages normalised from
Android's es_ES form. WebGPU inference is blocked on Samsung Xclipse and
Imagination PowerVR (Chromium's own blocklist and driver crashes). ai_tier
picks Minimal / WasmOnly / WebGpuSmall / WebGpuLarge; <html data-ai-tier> and
Settings → This device show it.
model_store.rs keeps voice and model packs in the Cache API ('aac-models-v1',
which both service workers now spare on update), verifies SHA-256 before
storing, retries, and asks for persistent storage. The service worker adds
COOP/COEP to the shell it serves, so the app stays cross-origin isolated
offline.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
de1243ce71