# Shared panel alpha consumer checks — 2026-09-26

Brandstorm's adoption review found that the shared panel's inline styles were
incompatible with Companion's `style-src 'self'`, and that provider removal was
missing. The 0.2.0 alpha candidate addresses both in the shared SDK.

The component now installs a constructed shadow stylesheet and uses CSS classes
instead of inline attributes. Its browser asset remains identical across
TypeScript, Python, Go and Rust. The standalone loopback panel also serves its
page CSS externally and has removed `unsafe-inline` from its style policy.

The T3 collaborative browser exercised a synthetic local fixture under
`default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'`,
with the remaining image/base/form/frame restrictions matching Companion.
At 1920×1080 the computed layout was a two-column grid; at 390×844 the page stayed
390 pixels wide and switched to one column. Both screens were visually inspected.
No style-policy violations occurred. The shadow root contained no inline style
elements or attributes. These checks used synthetic state and no real credentials.

Browser interactions verified:

- Removal asks for confirmation and initially focuses **Keep provider**.
- Cancelling leaves the instance present.
- A concurrent revision change returns 409 and preserves the instance.
- Refresh followed by confirmation removes the selected instance.
- Older-host metadata without `removalSupported`, and read-only connections,
  omit the removal control.

The native desktop smoke now installs an additional `style-src 'self'` policy,
checks the rendered grid and policy-violation events, and exercises cancellation
and confirmed removal through the real desktop IPC/backend. Its successful
receipt includes `providerRemovalUi: true` and `strictStyleCsp: true` alongside
the existing sign-in UI and renderer-isolation checks. Prometheus repeats this
against the packaged Linux archive.

Local validation passed: 338 SDK tests, seven desktop tests, native desktop smoke,
and installed TypeScript, Python sync/async, Go and Rust blocking/async clients
over HTTP and certificate-verified HTTPS, including their panel bridges. Tests
cover removal's revision/authorization checks, stored key and grant preservation,
empty management hosts, and active-run account/usage continuity. A provider
referenced by a static host grant fails with `PROVIDER_IN_USE`; no grant or
operator-owned account policy is silently rewritten. Extensions stay operator-owned.

This report qualifies component behavior, not model availability or inference.
There were no new real-provider requests. Release-source identity, immutable
artifacts and final Prometheus evidence belong to the alpha release manifest
and publication receipt; the earlier `f76801f` candidate predates these fixes.