Captured External Assets Are Not Permission for Live Fetches

Scope: Engineering or methodology note based on a September 17, 2026 snapshot. Source-level behavior is not a public availability or universal compatibility claim. Any scenarios are illustrative, not customer outcomes.

A frontend may depend on assets from more than one origin. A captured font, script, or image can remain relevant to a later comparison even when the original host should not be contacted again.

KodeBack’s current cassette-parity composition can declare captured foreign resources and fulfill them from the admitted response bodies. The browser does not need to fetch those resources from the live internet in that guarded path.

Keep origin identity without live dependency

In a synthetic page, a stylesheet may refer to a captured asset on a separate host. The comparison needs to understand which resource that request represents. It should not silently satisfy the request by asking the live host, whose content may have changed since capture.

Kalu’s projection and observation policy connect the captured resource to its replay identity. The report can identify the authorized origins relevant to the comparison without treating authorization as permission for arbitrary network access.

Missing capture evidence stays missing

If a required response body was never captured, a live fallback would change the experiment. It might make the page appear healthy while destroying the claim that the replay used the sealed evidence.

A denial or incomplete result is therefore useful. It identifies the missing closure instead of replacing it with whatever happens to be available online at measurement time.

Do not generalize the guarded path to every browser

This boundary is particularly important when discussing manual serving. The loopback server does not forward unmatched requests, but an ordinary browser opened by the operator does not inherit the isolated qualification browser’s full network protection.

A marketing claim that says “no network egress” without naming the guarded product path would be broader than the current source supports. The browser owner and interception coverage belong in the explanation.

This article describes source-level behavior under the supported cassette-parity composition, not universal offline replay for every application.

For an evaluator, ask whether external resources were served from captured bytes or fetched live. The page may look the same in both cases. The evidence claim is different. A recovery baseline should remain tied to the deployment that was observed, not quietly borrow the current state of the internet.