Community Blocks Security 1.4.0

Manifest validation constrains declared capabilities, while source review remains the host project's responsibility.

Rejected keys

runtimeHooks
externalFetch
externalRequests
freeDom
freeCss
innerHTML
cloudAi
eval
scriptUrl

Normative rules

1. No external requests declared or implied by manifest capability.
2. No arbitrary Adapt hooks.
3. No free DOM or CSS capability.
4. No Tailwind/Radix/Shadcn dependency.
5. Integrity uses SHA-256 hex when present.

Trust boundary

A valid manifest is structurally compatible, not proof that copied source is safe. Review community HTML/CSS/JS before ownership import.

Runtime isolation

Community Blocks do not create a second runtime. Their adaptContract can only narrow actions already recognized by Adapt.