Speculation Rules API Prerender Sandbox & Credential Isolation Standard

--- description: Speculation Rules API Prerender Sandbox & Credential Isolation Standard - Enforces strict origin isolation, side-effect gating, and ephemeral partition boundaries for Speculation Rules API prerender candidates. Prevents side-channel timing attacks, cross-origin unpartitioned credential exfiltration, and premature invocation of stateful mutations during hidden speculative rendering. globs: src/**/*.{ts,tsx,js,jsx}, app/**/*.{ts,tsx,js,jsx}, public/**/*.html alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/speculation-rules-prerender-isolation-standard" --- # Speculation Rules API Prerender Sandbox & Credential Isolation Standard > **Severity**: CRITICAL | **Category**: frontend > **Anti-Pattern Warning**: Unbounded Cross-Origin Prerender Injection and Ungated Lifecycle Mutation Side-Effects ## System Constraints You are a Principal Engineer enforcing the Speculation Rules API Prerender Sandbox & Credential Isolation Standard. You must mandate strict state isolation during speculative execution, enforce lifecycle checks on document.prerendering, ensure anonymous-client-ip constraints for cross-origin candidates, and prohibit stateful side-effects prior to activation. ## Strict Guidelines - Engineers MUST ALWAYS verify 'document.prerendering' state before executing non-idempotent operations, stateful DOM writes, analytics dispatches, or storage mutations. - Engineers MUST defer non-read-only background tasks and sensitive telemetry until the 'prerenderingchange' event fires on the Document object. - Speculation rules MUST explicit declare 'requires: ["anonymous-client-ip-when-cross-origin"]' whenever prerender candidate rule sets target or match cross-origin resources. - Speculation rules MUST NEVER use overly broad catch-all wildcards without negative predicate constraints (e.g., excluding '/auth/*', '/logout', '/api/*', and checkout paths). - Dynamic rule injectors MUST sanitize and strictly validate candidate hrefs against an allowed-origin allowlist before appending '<script type="speculationrules">' blocks. - Components NEVER execute write operations to IndexedDB, LocalStorage, or cross-document broadcast channels while running inside an unactivated prerender context. ## Bad vs Good Implementations ### Speculative Prerender Rules Injection and Lifecycle Gating #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Prerendering mutating routes (/checkout, /account/settings) and cross-origin endpoints without anonymous-client-ip requirements exposes session state and leaks unauthenticated cookies via side-channel timing attacks. Furthermore, trackPageView executes immediately in an unactivated prerendered tab, polluting analytics and mutating storage before the user actually commits the navigation. ```typescript // BAD: Indiscriminate prerendering of wildcards without origin constraints, // and execution of analytics and mutation side-effects in unactivated contexts. export function setupSpeculativeNavigation(): void { const rules = { prerender: [ { source: 'list', urls: ['/checkout', '/account/settings', 'https://partner.com/dashboard'], eagerness: 'immediate' } ] }; const script = document.createElement('script'); script.type = 'speculationrules'; script.textContent = JSON.stringify(rules); document.head.appendChild(script); } export function trackPageView(pageId: string): void { // Anti-pattern: Triggers state mutation and network beacon before user navigates navigator.sendBeacon('/api/telemetry/view', JSON.stringify({ pageId, ts: Date.now() })); sessionStorage.setItem('lastViewedPage', pageId); } ``` #### Production Standard (Correct) > **Standard**: Validates candidate targets against a strict origin policy, mandates 'anonymous-client-ip-when-cross-origin' to prevent cross-origin tracking vectors, and gates telemetry and storage side-effects behind document.prerendering and the 'prerenderingchange' lifecycle transition. ```typescript // GOOD: Strict negative predicates, credential isolation, and prerendering lifecycle gating. interface SafePrerenderOptions { readonly candidateUrls: readonly string[]; readonly allowedOrigin: string; } export function registerSafeSpeculationRules(options: SafePrerenderOptions): void { if (!HTMLScriptElement.supports?.('speculationrules')) { return; } const sanitizedUrls = options.candidateUrls.filter((rawUrl) => { try { const parsed = new URL(rawUrl, window.location.origin); return parsed.origin === options.allowedOrigin && !parsed.pathname.startsWith('/api/'); } catch { return false; } }); const rules = { prerender: [ { source: 'list', urls: sanitizedUrls, eagerness: 'moderate', requires: ['anonymous-client-ip-when-cross-origin'] } ] }; const script = document.createElement('script'); script.type = 'speculationrules'; script.textContent = JSON.stringify(rules); document.head.appendChild(script); } export function executeOnPrerenderActivation(callback: () => void): void { if (document.prerendering) { document.addEventListener('prerenderingchange', () => callback(), { once: true }); } else { callback(); } } export function trackPageViewSafely(pageId: string): void { executeOnPrerenderActivation(() => { navigator.sendBeacon('/api/telemetry/view', JSON.stringify({ pageId, ts: Date.now() })); sessionStorage.setItem('lastViewedPage', pageId); }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Speculation Rules API Prerender Sandbox & Credential Isolation Standard

Speculation Rules API Prerender Sandbox & Credential Isolation Standard defines an industrial-grade behavioral standard for frontend engineering. Enforces strict origin isolation, side-effect gating, and ephemeral partition boundaries for Speculation Rules API prerender candidates. Prevents side-channel timing attacks, cross-origin unpartitioned credential exfiltration, and premature invocation of stateful mutations during hidden speculative rendering. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unbounded Cross-Origin Prerender Injection and Ungated Lifecycle Mutation Side-Effects Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unbounded Cross-Origin Prerender Injection and Ungated Lifecycle Mutation Side-Effects	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS verify 'document.prerendering' state before executing non-idempotent operations, stateful DOM writes, analytics dispatches, or storage mutations.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.