{# Shell for pages RELAYED to another origin. Fully self-contained: it loads
NOTHING — no same-origin path, no CDN, no webfont.
`action_review.html` is fetched server-side by CareAgents and served from
careagents.cloud (careagents/app.py). That puts it between two rules that
look contradictory until you satisfy both:
- #396: it may not reference a SAME-ORIGIN asset. Extending base.html
sent /static/css/r6-dashboard.css, a five-link HealthClaw navbar and
/_vercel/insights/script.js across the boundary. None of them exist on
careagents.cloud, so the patient got an unstyled page wearing another
product's dead navigation, at the moment they were asked to attest.
- The CSP (app.py) is `default-src 'self'`, so it may not reference a
THIRD-PARTY asset either. The first fix for #396 used Bootstrap and
Font Awesome from CDNs, which the lint gate correctly rejected.
The only thing that satisfies both is a page that fetches nothing. So the
styles below are inlined and the type is a system stack.
WHY IT LOOKS LIKE CAREAGENTS. #395 established that no browser can load
this page from HealthClaw directly — the GET requires an `X-Step-Up-Token`
header and 401s without it, and a navigation cannot set one. The CareAgents
relay is the ONLY consumer. A page served from careagents.cloud, to a
person who signed in to CareAgents, should look like CareAgents. The
palette below is careagents.css's, and the serif is the same `Georgia`
that CareAgents' own `"Fraunces", Georgia, serif` stack falls back to.
BOOTSTRAP IS NOT LOADED. The rules below reimplement, by hand, exactly the
subset of Bootstrap class names `action_review.html` uses. The names were
kept so that fixing this did not mean rewriting every attribute on a
patient-facing clinical form. That is a trap for the next person, so it is
pinned: tests/test_relayed_review_page_is_self_contained.py fails if the
page uses a class this file does not define.
Do not add a , a