From 82841db0668c26401591433e7a49e8da308dcef1 Mon Sep 17 00:00:00 2001
From: Ronald Tse <ronald.tse@ribose.com>
Date: Tue, 1 Sep 2026 14:22:54 +0200
Subject: [PATCH] =?UTF-8?q?docs:=20E3=20finding=20=E2=80=94=20GH=20Release?=
 =?UTF-8?q?s=20assets=20are=20not=20CORS-fetchable=20from=20browsers?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 TODO.client-work/13-cors-asset-channel.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 TODO.client-work/13-cors-asset-channel.md

diff --git a/TODO.client-work/13-cors-asset-channel.md b/TODO.client-work/13-cors-asset-channel.md
new file mode 100644
index 0000000..aca2bd0
--- /dev/null
+++ b/TODO.client-work/13-cors-asset-channel.md
@@ -0,0 +1,13 @@
+# 13-cors-asset-channel
+
+E3 bench finding (2026-09-01): browsers CANNOT fetch GH Releases assets
+cross-origin — the github.com/releases/download redirect hop lacks
+Access-Control-Allow-Origin. The live /neural demo fails with
+"Failed to fetch" before any download.
+
+Fix (scoped): the api worker serves `/v1/assets/{tag}/{file}` as a
+streaming CORS-enabled proxy to the GH Release asset (workers stream
+pass-through; no memory concern). The demo passes that index URL
+explicitly to imf.resolve/IMFModel.load. Re-run E3 after.
+
+Status: FOUND (blocking item 12 and the live demo's model path).