From 8d3b947c110ffed56165c5c52d3e3f69db3675ff Mon Sep 17 00:00:00 2001
From: Dominic Farolino <domfarolino@gmail.com>
Date: Mon, 24 Jul 2023 17:48:35 +0000
Subject: [PATCH] Fix permissions policy integration step mismatch

SHA: e31e55d6d0087b29945c9b56b858a8105e8f00e3
Reason: push, by domfarolino

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 44 ++++++++++++++++++++++++++------------------
 1 file changed, 26 insertions(+), 18 deletions(-)

diff --git a/index.html b/index.html
index 04d8ea6..46d3a7b 100644
--- a/index.html
+++ b/index.html
@@ -4,9 +4,9 @@
   <title>Fenced Frame</title>
   <meta content="width=device-width, initial-scale=1, shrink-to-fit=no" name="viewport">
   <link href="https://www.w3.org/StyleSheets/TR/2021/cg-draft" rel="stylesheet">
-  <meta content="Bikeshed version 5edf5e459, updated Thu Jun 22 11:28:01 2023 -0700" name="generator">
+  <meta content="Bikeshed version d29f71adb, updated Wed Jul 19 11:08:56 2023 -0700" name="generator">
   <link href="https://wicg.github.io/fenced-frame/" rel="canonical">
-  <meta content="fad7bad6b2459198691d84017476c48551dc2b14" name="document-revision">
+  <meta content="e31e55d6d0087b29945c9b56b858a8105e8f00e3" name="document-revision">
 <style>
 /* Put nice boxes around each algorithm. */
 [data-algorithm]:not(.heading) {
@@ -902,7 +902,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1 class="p-name no-ref" id="title">Fenced Frame</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types#CG-DRAFT">Draft Community Group Report</a>, <time class="dt-updated" datetime="2023-06-24">24 June 2023</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types#CG-DRAFT">Draft Community Group Report</a>, <time class="dt-updated" datetime="2023-07-24">24 July 2023</time></p>
    <div data-fill-with="spec-metadata">
     <dl>
      <dt>This version:
@@ -1033,7 +1033,7 @@ <h2 class="heading settled" data-level="1" id="introduction"><span class="secno"
 between the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document②">Document</a></code> and its embedder.</p>
    <p>This specification defines the new element, its integration with the rest of the web platform,
 including <a href="#html-integration">§ 3 HTML Integration</a> and <a href="#interaction-with-other-specs">§ 4 Interactions with other specifications</a>, and its supporting primitives
-like <code class="idl"><a data-link-type="idl" href="#fencedframeconfig" id="ref-for-fencedframeconfig">FencedFrameConfig</a></code>, which is the major input to the <code><a data-link-type="element" href="#elementdef-fencedframe" id="ref-for-elementdef-fencedframe①">fencedframe</a></code> in place of normal <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url">URLs</a> and "<code>src</code>" attributes. Given that this specification defines a new element and its
+like <code class="idl"><a data-link-type="idl" href="#fencedframeconfig" id="ref-for-fencedframeconfig">FencedFrameConfig</a></code>, which is the major input to the <code><a data-link-type="element" href="#elementdef-fencedframe" id="ref-for-elementdef-fencedframe①">fencedframe</a></code> in place of normal <a data-link-type="dfn" href="https://www.w3.org/TR/pub-manifest/#dfn-url" id="ref-for-dfn-url">URLs</a> and "<code>src</code>" attributes. Given that this specification defines a new element and its
 integration with the rest of the platform, it should be read as largely a monkeypatch to the <a data-link-type="biblio" href="#biblio-html" title="HTML Standard">[HTML]</a>, with its end goal to be merged into that standard, provided there is adequate
 cross-browser support.</p>
    <h2 class="heading settled" data-level="2" id="the-fencedframe-element"><span class="secno">2. </span><span class="content">The <dfn class="dfn-paneled" data-dfn-type="element" data-export id="elementdef-fencedframe"><code>fencedframe</code></dfn> element</span><a class="self-link" href="#the-fencedframe-element"></a></h2>
@@ -1302,7 +1302,7 @@ <h4 class="heading settled" data-level="2.3.2" id="fenced-frame-config-struct"><
      <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list">lists</a> of <a data-link-type="dfn" href="#fencedframetype-pending-event" id="ref-for-fencedframetype-pending-event">pending events</a> (which are used to represent events that need to
  be reported asynchronously, because the metadata has not been finalized yet); or</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map④">maps</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys④">keys</a> are <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string" id="ref-for-string③">strings</a> and whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-values" id="ref-for-map-getting-the-values④">values</a> are <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url①">urls</a> (which are used
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map④">maps</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys④">keys</a> are <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string" id="ref-for-string③">strings</a> and whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-values" id="ref-for-map-getting-the-values④">values</a> are <a data-link-type="dfn" href="https://www.w3.org/TR/pub-manifest/#dfn-url" id="ref-for-dfn-url①">urls</a> (which are used
  to represent the actual metadata once it is finalized).</p>
    </ul>
    <p class="note" role="note"><span class="marker">Note:</span> This representation is meant to allow config-generating APIs to reduce latency by resolving
@@ -1314,7 +1314,7 @@ <h4 class="heading settled" data-level="2.3.2" id="fenced-frame-config-struct"><
 be sent.</p>
    <div class="algorithm" data-algorithm="finalize a reporting destination">
      In order to <dfn class="dfn-paneled" data-dfn-type="dfn" data-export id="finalize-a-reporting-destination">finalize a reporting destination</dfn>, given a <a data-link-type="dfn" href="#fencedframetype-fenced-frame-reporting-map" id="ref-for-fencedframetype-fenced-frame-reporting-map①">fenced
-  frame reporting map</a> <var>reporting map</var>, a <code class="idl"><a data-link-type="idl" href="#enumdef-fencereportingdestination" id="ref-for-enumdef-fencereportingdestination②">FenceReportingDestination</a></code> <var>destination</var>, and a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑤">map</a> <var>destination map</var> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys⑤">keys</a> are <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string" id="ref-for-string④">strings</a> and whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-values" id="ref-for-map-getting-the-values⑤">values</a> are <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url②">urls</a>, run these steps: 
+  frame reporting map</a> <var>reporting map</var>, a <code class="idl"><a data-link-type="idl" href="#enumdef-fencereportingdestination" id="ref-for-enumdef-fencereportingdestination②">FenceReportingDestination</a></code> <var>destination</var>, and a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑤">map</a> <var>destination map</var> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys⑤">keys</a> are <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string" id="ref-for-string④">strings</a> and whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-values" id="ref-for-map-getting-the-values⑤">values</a> are <a data-link-type="dfn" href="https://www.w3.org/TR/pub-manifest/#dfn-url" id="ref-for-dfn-url②">urls</a>, run these steps: 
     <ol>
      <li data-md>
       <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#assert" id="ref-for-assert②">Assert</a> that <var>reporting map</var>[<var>destination</var>] is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list④">list</a> (i.e., that <var>destination</var>’s
@@ -1360,7 +1360,7 @@ <h4 class="heading settled" data-level="2.3.2" id="fenced-frame-config-struct"><
      </dl>
    </dl>
    <div class="algorithm" data-algorithm="send a beacon">
-     In order to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="send-a-beacon">send a beacon</dfn> with a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑥">map</a> <var>destination map</var> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys⑥">keys</a> are <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string" id="ref-for-string⑥">strings</a> and whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-values" id="ref-for-map-getting-the-values⑥">values</a> are <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url③">urls</a>, a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string" id="ref-for-string⑦">string</a> <var>eventType</var>, and a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string" id="ref-for-string⑧">string</a> <var>eventData</var>, run these steps: 
+     In order to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="send-a-beacon">send a beacon</dfn> with a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑥">map</a> <var>destination map</var> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-keys" id="ref-for-map-getting-the-keys⑥">keys</a> are <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string" id="ref-for-string⑥">strings</a> and whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-getting-the-values" id="ref-for-map-getting-the-values⑥">values</a> are <a data-link-type="dfn" href="https://www.w3.org/TR/pub-manifest/#dfn-url" id="ref-for-dfn-url③">urls</a>, a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string" id="ref-for-string⑦">string</a> <var>eventType</var>, and a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#string" id="ref-for-string⑧">string</a> <var>eventData</var>, run these steps: 
     <ol>
      <li data-md>
       <p>If <var>destination map</var>[<var>eventType</var>] does not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑥">exist</a>, return.</p>
@@ -1495,7 +1495,7 @@ <h4 class="heading settled" data-level="2.3.2" id="fenced-frame-config-struct"><
      <dl>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="mapped url" data-dfn-type="dfn" data-export id="mapped-url-value">value</dfn>
       <dd data-md>
-       <p>a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url④">URL</a></p>
+       <p>a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url">URL</a></p>
       <dt data-md><dfn data-dfn-for="mapped url" data-dfn-type="dfn" data-export id="mapped-url-visibility">visibility<a class="self-link" href="#mapped-url-visibility"></a></dfn>
       <dd data-md>
        <p>a <a data-link-type="dfn" href="https://www.w3.org/TR/CSS22/visufx.html#propdef-visibility" id="ref-for-propdef-visibility①">visibility</a></p>
@@ -1600,7 +1600,7 @@ <h4 class="heading settled" data-level="2.3.3" id="fenced-frame-config-instance-
    <dl>
     <dt data-md><dfn class="dfn-paneled" data-dfn-for="fenced frame config instance" data-dfn-type="dfn" data-export id="fenced-frame-config-instance-mapped-url">mapped url</dfn>
     <dd data-md>
-     <p>a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url⑤">URL</a></p>
+     <p>a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url①">URL</a></p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-for="fenced frame config instance" data-dfn-type="dfn" data-export id="fenced-frame-config-instance-container-size">container size</dfn>
     <dd data-md>
      <p>null, or a <a data-link-type="dfn" href="#fencedframetype-size" id="ref-for-fencedframetype-size②">size</a></p>
@@ -2021,7 +2021,7 @@ <h3 class="heading settled" data-level="3.2" id="creating-browsing-contexts-patc
     </ol>
    </div>
    <h3 class="heading settled" data-level="3.3" id="local-scheme-policy-container-inheritance"><span class="secno">3.3. </span><span class="content">Policy container inheritance</span><a class="self-link" href="#local-scheme-policy-container-inheritance"></a></h3>
-   <p>When making a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#navigation-request" id="ref-for-navigation-request③">navigation request</a> to a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#is-local" id="ref-for-is-local">local</a> <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url⑥">URL</a>, <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code>s clone their <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-policy-container" id="ref-for-concept-document-policy-container①">policy container</a> from the <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#navigation-request" id="ref-for-navigation-request④">navigation request</a>'s <em>initiator</em> <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document⑤">Document</a></code>. If <code><a data-link-type="element" href="#elementdef-fencedframe" id="ref-for-elementdef-fencedframe②④">fencedframe</a></code>s were to do the same thing, that would allow information about the initiator’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-policy-container" id="ref-for-concept-document-policy-container②">policy container</a> to leak across a fenced frame boundary. This section patches <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-policy-container" id="ref-for-concept-document-policy-container③">policy container</a> inheritance to close that leak.</p>
+   <p>When making a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#navigation-request" id="ref-for-navigation-request③">navigation request</a> to a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#is-local" id="ref-for-is-local">local</a> <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url②">URL</a>, <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code>s clone their <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-policy-container" id="ref-for-concept-document-policy-container①">policy container</a> from the <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#navigation-request" id="ref-for-navigation-request④">navigation request</a>'s <em>initiator</em> <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document⑤">Document</a></code>. If <code><a data-link-type="element" href="#elementdef-fencedframe" id="ref-for-elementdef-fencedframe②④">fencedframe</a></code>s were to do the same thing, that would allow information about the initiator’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-policy-container" id="ref-for-concept-document-policy-container②">policy container</a> to leak across a fenced frame boundary. This section patches <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-policy-container" id="ref-for-concept-document-policy-container③">policy container</a> inheritance to close that leak.</p>
    <div class="algorithm" data-algorithm="local-policy-inheritance-determine-params">
      Modify the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#determining-navigation-params-policy-container" id="ref-for-determining-navigation-params-policy-container">determine navigation params policy container</a> algorithm to have a new optional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#boolean" id="ref-for-boolean">boolean</a> parameter <var>fenced</var> that defaults to false. 
     <p>Rewrite step 3 to read:</p>
@@ -2533,7 +2533,7 @@ <h4 class="heading settled" data-level="3.7.3" id="navigation-changes"><span cla
        <li data-md>
         <p>Set <var>sourceSnapshotParams</var>’s <a data-link-type="dfn" href="#source-snapshot-params-fenced-frame-config" id="ref-for-source-snapshot-params-fenced-frame-config">fenced frame config</a> to <var>config</var>.</p>
        <li data-md>
-        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#assert" id="ref-for-assert⑤">Assert</a> <var>config</var>’s <a data-link-type="dfn" href="#fenced-frame-config-mapped-url" id="ref-for-fenced-frame-config-mapped-url①">mapped url</a>'s <a data-link-type="dfn" href="#mapped-url-value" id="ref-for-mapped-url-value①">value</a> is a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url⑦">URL</a> whose <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-scheme" id="ref-for-concept-url-scheme①">scheme</a> is "<code>https</code>".</p>
+        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#assert" id="ref-for-assert⑤">Assert</a> <var>config</var>’s <a data-link-type="dfn" href="#fenced-frame-config-mapped-url" id="ref-for-fenced-frame-config-mapped-url①">mapped url</a>'s <a data-link-type="dfn" href="#mapped-url-value" id="ref-for-mapped-url-value①">value</a> is a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url③">URL</a> whose <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-scheme" id="ref-for-concept-url-scheme①">scheme</a> is "<code>https</code>".</p>
        <li data-md>
         <p>Set <var>url</var> to <var>config</var>’s <a data-link-type="dfn" href="#fenced-frame-config-mapped-url" id="ref-for-fenced-frame-config-mapped-url②">mapped url</a>'s <a data-link-type="dfn" href="#mapped-url-value" id="ref-for-mapped-url-value②">value</a>.</p>
       </ol>
@@ -2670,7 +2670,7 @@ <h3 class="heading settled" data-level="4.2" id="csp-integration"><span class="s
    <p><em>This introductory section is non-normative</em>.</p>
    <p>Content Security Policy <a data-link-type="biblio" href="#biblio-csp" title="Content Security Policy Level 3">[CSP]</a> can ordinarily be used by web content associated with a <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document②⓪">Document</a></code> that hosts a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/document-sequences.html#navigable-container" id="ref-for-navigable-container⑥">navigable container</a> to limit the source of navigations in a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/document-sequences.html#child-navigable" id="ref-for-child-navigable⑨">child
 navigable</a>.</p>
-   <p>In order to prevent <a data-link-type="biblio" href="#biblio-csp" title="Content Security Policy Level 3">[CSP]</a> from being used a communication side-channel exposing the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url⑧">URL</a> of
+   <p>In order to prevent <a data-link-type="biblio" href="#biblio-csp" title="Content Security Policy Level 3">[CSP]</a> from being used a communication side-channel exposing the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url④">URL</a> of
 navigations inside a <code><a data-link-type="element" href="#elementdef-fencedframe" id="ref-for-elementdef-fencedframe⑤④">fencedframe</a></code> to the site operating its embedder, the only <a data-link-type="dfn" href="https://w3c.github.io/webappsec-csp/#source-expression" id="ref-for-source-expression">source
 expressions</a> that can influence a <code><a data-link-type="element" href="#elementdef-fencedframe" id="ref-for-elementdef-fencedframe⑤⑤">fencedframe</a></code> navigation are:</p>
    <ul>
@@ -2722,7 +2722,7 @@ <h4 class="heading settled" data-level="4.2.2" id="new-csp-directive"><span clas
 <pre><a data-link-type="http-header" href="https://w3c.github.io/webappsec-csp/#header-content-security-policy" id="ref-for-header-content-security-policy">Content-Security-Policy</a>: <a data-link-type="dfn" href="#fenced-frame-src" id="ref-for-fenced-frame-src">fenced-frame-src</a> https://example.com/
 </pre>
      <p>Fetches for the following code will return a <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-network-error" id="ref-for-concept-network-error②">network error</a>, as the URL provided does not
-    match <code>fenced-frame-src</code>'s <a data-link-type="dfn" href="https://w3c.github.io/webappsec-csp/#source-lists" id="ref-for-source-lists">source list</a>:</p>
+    match <code>fenced-frame-src</code>’s <a data-link-type="dfn" href="https://w3c.github.io/webappsec-csp/#source-lists" id="ref-for-source-lists">source list</a>:</p>
 <pre class="highlight"><c- p>&lt;</c-><c- f>fencedframe</c-> <c- e>src</c-><c- o>=</c-><c- s>"https://example.org/"</c-><c- p>></c->
 <c- p>&lt;/</c-><c- f>fencedframe</c-><c- p>></c->
 </pre>
@@ -2818,7 +2818,7 @@ <h3 class="heading settled" data-level="4.3" id="permissions-policy-changes"><sp
     <li data-md>
      <p>If a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature" id="ref-for-policy-controlled-feature①⓪">feature</a> that <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-contain" id="ref-for-list-contain⑦">exists</a> in the <a data-link-type="dfn" href="#fenced-frame-config-effective-enabled-permissions" id="ref-for-fenced-frame-config-effective-enabled-permissions⑥">effective enabled permissions</a> has a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature-default-allowlist" id="ref-for-policy-controlled-feature-default-allowlist②">default allowlist</a> of <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#default-allowlist-self" id="ref-for-default-allowlist-self①"><code>'self'</code></a>, and the <code><a data-link-type="element" href="#elementdef-fencedframe" id="ref-for-elementdef-fencedframe⑦⓪">fencedframe</a></code>'s <code><a data-link-type="element-sub" href="#element-attrdef-fencedframe-allow" id="ref-for-element-attrdef-fencedframe-allow③">allow</a></code> attribute contains the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature" id="ref-for-policy-controlled-feature①①">feature</a> but no <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#allowlist" id="ref-for-allowlist①">allowlist</a>, the rules
  described in <a href="allow-attribute-fenced-frame">The <code>allow</code> attribute section</a>, the default <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#allowlist" id="ref-for-allowlist②">allowlist</a> for the feature will be <code>'src'</code> which is meant to represent the embedder-supplied
- navigation <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url⑨">URL</a>, for which there is none when navigating a <code><a data-link-type="element" href="#elementdef-fencedframe" id="ref-for-elementdef-fencedframe⑦①">fencedframe</a></code>, as the navigation <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url①⓪">URL</a> is determined by the <a data-link-type="dfn" href="#fenced-frame-config" id="ref-for-fenced-frame-config②①">fenced frame config</a>. The navigation will be blocked.</p>
+ navigation <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url⑤">URL</a>, for which there is none when navigating a <code><a data-link-type="element" href="#elementdef-fencedframe" id="ref-for-elementdef-fencedframe⑦①">fencedframe</a></code>, as the navigation <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url" id="ref-for-concept-url⑥">URL</a> is determined by the <a data-link-type="dfn" href="#fenced-frame-config" id="ref-for-fenced-frame-config②①">fenced frame config</a>. The navigation will be blocked.</p>
     <li data-md>
      <p>If a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature" id="ref-for-policy-controlled-feature①②">feature</a> that <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-contain" id="ref-for-list-contain⑧">exists</a> in the <a data-link-type="dfn" href="#fenced-frame-config-effective-enabled-permissions" id="ref-for-fenced-frame-config-effective-enabled-permissions⑦">effective enabled permissions</a> has a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature-default-allowlist" id="ref-for-policy-controlled-feature-default-allowlist③">default allowlist</a> of <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#default-allowlist-self" id="ref-for-default-allowlist-self②"><code>'self'</code></a> but either the `<a data-link-type="http-header" href="https://w3c.github.io/webappsec-permissions-policy/#permissions-policy-header" id="ref-for-permissions-policy-header②"><code>Permissions-Policy</code></a>` header served on the <code><a data-link-type="element" href="#elementdef-fencedframe" id="ref-for-elementdef-fencedframe⑦②">fencedframe</a></code>'s embedder <em>OR</em> the <code><a data-link-type="element-sub" href="#element-attrdef-fencedframe-allow" id="ref-for-element-attrdef-fencedframe-allow④">allow</a></code> attribute sets that <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature" id="ref-for-policy-controlled-feature①③">feature</a>'s <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#allowlist" id="ref-for-allowlist③">allowlist</a> to <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy#the-special-value" id="ref-for-the-special-value②">the special value *</a>, then the navigation inside the <code><a data-link-type="element" href="#elementdef-fencedframe" id="ref-for-elementdef-fencedframe⑦③">fencedframe</a></code> will succeed, and the
  resulting <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document②⑧">Document</a></code> is <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use①">allowed to use</a> the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature" id="ref-for-policy-controlled-feature①④">feature</a>.</p>
@@ -2848,10 +2848,10 @@ <h4 class="heading settled" data-level="4.3.1" id="permissions-policy-patches"><
      <li data-md>
       <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#assert" id="ref-for-assert⑦">Assert</a>: if not null, <var>container</var> is either a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/document-sequences.html#navigable-container" id="ref-for-navigable-container⑦">navigable container</a> or a <a data-link-type="dfn" href="#fenced-navigable-containers" id="ref-for-fenced-navigable-containers①③">fenced navigable container</a>.</p>
     </ol>
-    <p>Rewrite step 4 to read:</p>
+    <p>Rewrite step 3 to read:</p>
     <ol start="4">
      <li data-md>
-      <p>For each <var>feature</var> supported:</p>
+      <p>For each <var>feature</var> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy#supported-features" id="ref-for-supported-features①">supported</a>:</p>
       <ol>
        <li data-md>
         <p>Let <var>isInherited</var> be the result of running <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-permissions-policy/#define-inherited-policy-in-container" id="ref-for-define-inherited-policy-in-container">Define an inherited policy for feature in
@@ -3553,6 +3553,11 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="4176065d">loading mode</span>
      <li><span class="dfn-paneled" id="0acae8bb">supports-loading-mode</span>
     </ul>
+   <li>
+    <a data-link-type="biblio">[PUB-MANIFEST]</a> defines the following terms:
+    <ul>
+     <li><span class="dfn-paneled" id="273241b0">urls</span>
+    </ul>
    <li>
     <a data-link-type="biblio">[REFERRER-POLICY]</a> defines the following terms:
     <ul>
@@ -3604,6 +3609,8 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dd>Ian Clelland. <a href="https://w3c.github.io/webappsec-permissions-policy/"><cite>Permissions Policy</cite></a>. URL: <a href="https://w3c.github.io/webappsec-permissions-policy/">https://w3c.github.io/webappsec-permissions-policy/</a>
    <dt id="biblio-prerendering-revamped">[Prerendering-Revamped]
    <dd>Domenic Denicola; Dominic Farolino. <a href="https://wicg.github.io/nav-speculation/prerendering.html"><cite>Prerendering Revamped</cite></a>. CG-DRAFT. URL: <a href="https://wicg.github.io/nav-speculation/prerendering.html">https://wicg.github.io/nav-speculation/prerendering.html</a>
+   <dt id="biblio-pub-manifest">[PUB-MANIFEST]
+   <dd>Matt Garrish; Ivan Herman. <a href="https://w3c.github.io/pub-manifest/"><cite>Publication Manifest</cite></a>. URL: <a href="https://w3c.github.io/pub-manifest/">https://w3c.github.io/pub-manifest/</a>
    <dt id="biblio-referrer-policy">[REFERRER-POLICY]
    <dd>Jochen Eisinger; Emily Stark. <a href="https://w3c.github.io/webappsec-referrer-policy/"><cite>Referrer Policy</cite></a>. URL: <a href="https://w3c.github.io/webappsec-referrer-policy/">https://w3c.github.io/webappsec-referrer-policy/</a>
    <dt id="biblio-rfc8941">[RFC8941]
@@ -4236,16 +4243,17 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['0e3ba2bf'] = {"dfnID": "0e3ba2bf", "url": "https://w3c.github.io/webappsec-permissions-policy/#permissions-policy-header", "dfnText": "permissions-policy", "refSections": [{"refs": [{"id": "ref-for-permissions-policy-header"}, {"id": "ref-for-permissions-policy-header\u2460"}, {"id": "ref-for-permissions-policy-header\u2461"}, {"id": "ref-for-permissions-policy-header\u2462"}], "title": "4.3. Permissions Policies"}], "external": true};
 window.dfnpanelData['cc890cc1'] = {"dfnID": "cc890cc1", "url": "https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature", "dfnText": "policy-controlled feature", "refSections": [{"refs": [{"id": "ref-for-policy-controlled-feature"}, {"id": "ref-for-policy-controlled-feature\u2460"}, {"id": "ref-for-policy-controlled-feature\u2461"}], "title": "2.3.2. The fenced frame config struct"}, {"refs": [{"id": "ref-for-policy-controlled-feature\u2462"}], "title": "2.3.3. The fenced frame config instance struct"}, {"refs": [{"id": "ref-for-policy-controlled-feature\u2463"}, {"id": "ref-for-policy-controlled-feature\u2464"}, {"id": "ref-for-policy-controlled-feature\u2465"}, {"id": "ref-for-policy-controlled-feature\u2466"}, {"id": "ref-for-policy-controlled-feature\u2467"}, {"id": "ref-for-policy-controlled-feature\u2468"}, {"id": "ref-for-policy-controlled-feature\u2460\u24ea"}, {"id": "ref-for-policy-controlled-feature\u2460\u2460"}, {"id": "ref-for-policy-controlled-feature\u2460\u2461"}, {"id": "ref-for-policy-controlled-feature\u2460\u2462"}, {"id": "ref-for-policy-controlled-feature\u2460\u2463"}], "title": "4.3. Permissions Policies"}], "external": true};
 window.dfnpanelData['afef6e87'] = {"dfnID": "afef6e87", "url": "https://w3c.github.io/webappsec-permissions-policy#serialized-permissions-policy", "dfnText": "serialized permissions policy", "refSections": [{"refs": [{"id": "ref-for-serialized-permissions-policy"}], "title": "2. The fencedframe element"}], "external": true};
-window.dfnpanelData['7e36d255'] = {"dfnID": "7e36d255", "url": "https://w3c.github.io/webappsec-permissions-policy#supported-features", "dfnText": "supported features", "refSections": [{"refs": [{"id": "ref-for-supported-features"}], "title": "4.3.1. Algorithm patches"}], "external": true};
+window.dfnpanelData['7e36d255'] = {"dfnID": "7e36d255", "url": "https://w3c.github.io/webappsec-permissions-policy#supported-features", "dfnText": "supported features", "refSections": [{"refs": [{"id": "ref-for-supported-features"}, {"id": "ref-for-supported-features\u2460"}], "title": "4.3.1. Algorithm patches"}], "external": true};
 window.dfnpanelData['d47cadd5'] = {"dfnID": "d47cadd5", "url": "https://w3c.github.io/webappsec-permissions-policy#the-special-value", "dfnText": "the special value *", "refSections": [{"refs": [{"id": "ref-for-the-special-value"}, {"id": "ref-for-the-special-value\u2460"}, {"id": "ref-for-the-special-value\u2461"}], "title": "4.3. Permissions Policies"}, {"refs": [{"id": "ref-for-the-special-value\u2462"}], "title": "4.3.1. Algorithm patches"}], "external": true};
 window.dfnpanelData['1ce22483'] = {"dfnID": "1ce22483", "url": "https://wicg.github.io/nav-speculation/prerendering.html#get-the-supported-loading-modes", "dfnText": "get the supported loading modes", "refSections": [{"refs": [{"id": "ref-for-get-the-supported-loading-modes"}], "title": "3.7.1. The `Supports-Loading-Mode` HTTP response header"}], "external": true};
 window.dfnpanelData['4176065d'] = {"dfnID": "4176065d", "url": "https://wicg.github.io/nav-speculation/prerendering.html#navigable-loading-mode", "dfnText": "loading mode", "refSections": [{"refs": [{"id": "ref-for-navigable-loading-mode"}], "title": "2. The fencedframe element"}, {"refs": [{"id": "ref-for-navigable-loading-mode\u2460"}], "title": "4.1. Prerendering"}], "external": true};
 window.dfnpanelData['0acae8bb'] = {"dfnID": "0acae8bb", "url": "https://wicg.github.io/nav-speculation/prerendering.html#http-headerdef-supports-loading-mode", "dfnText": "supports-loading-mode", "refSections": [{"refs": [{"id": "ref-for-http-headerdef-supports-loading-mode"}, {"id": "ref-for-http-headerdef-supports-loading-mode\u2460"}, {"id": "ref-for-http-headerdef-supports-loading-mode\u2461"}], "title": "3.7.1. The `Supports-Loading-Mode` HTTP response header"}], "external": true};
+window.dfnpanelData['273241b0'] = {"dfnID": "273241b0", "url": "https://www.w3.org/TR/pub-manifest/#dfn-url", "dfnText": "urls", "refSections": [{"refs": [{"id": "ref-for-dfn-url"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-dfn-url\u2460"}, {"id": "ref-for-dfn-url\u2461"}, {"id": "ref-for-dfn-url\u2462"}], "title": "2.3.2. The fenced frame config struct"}], "external": true};
 window.dfnpanelData['bb0c2ce5'] = {"dfnID": "bb0c2ce5", "url": "https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-no-referrer", "dfnText": "\"no-referrer\"", "refSections": [{"refs": [{"id": "ref-for-referrer-policy-no-referrer"}], "title": "2. The fencedframe element"}], "external": true};
 window.dfnpanelData['e8409d67'] = {"dfnID": "e8409d67", "url": "https://www.rfc-editor.org/rfc/rfc8941.html#name-tokens", "dfnText": "token", "refSections": [{"refs": [{"id": "ref-for-name-tokens"}, {"id": "ref-for-name-tokens\u2460"}], "title": "3.7.1. The `Supports-Loading-Mode` HTTP response header"}], "external": true};
 window.dfnpanelData['959ad97b'] = {"dfnID": "959ad97b", "url": "https://url.spec.whatwg.org/#concept-url-origin", "dfnText": "origin", "refSections": [{"refs": [{"id": "ref-for-concept-url-origin"}, {"id": "ref-for-concept-url-origin\u2460"}, {"id": "ref-for-concept-url-origin\u2461"}], "title": "2.4. The Fence interface"}, {"refs": [{"id": "ref-for-concept-url-origin\u2462"}], "title": "4.3.1. Algorithm patches"}], "external": true};
 window.dfnpanelData['3a711be7'] = {"dfnID": "3a711be7", "url": "https://url.spec.whatwg.org/#concept-url-scheme", "dfnText": "scheme", "refSections": [{"refs": [{"id": "ref-for-concept-url-scheme"}], "title": "3.7.1. The `Supports-Loading-Mode` HTTP response header"}, {"refs": [{"id": "ref-for-concept-url-scheme\u2460"}], "title": "3.7.3. Actual navigation changes"}], "external": true};
-window.dfnpanelData['dcffbccd'] = {"dfnID": "dcffbccd", "url": "https://url.spec.whatwg.org/#concept-url", "dfnText": "url", "refSections": [{"refs": [{"id": "ref-for-concept-url"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-concept-url\u2460"}, {"id": "ref-for-concept-url\u2461"}, {"id": "ref-for-concept-url\u2462"}, {"id": "ref-for-concept-url\u2463"}], "title": "2.3.2. The fenced frame config struct"}, {"refs": [{"id": "ref-for-concept-url\u2464"}], "title": "2.3.3. The fenced frame config instance struct"}, {"refs": [{"id": "ref-for-concept-url\u2465"}], "title": "3.3. Policy container inheritance"}, {"refs": [{"id": "ref-for-concept-url\u2466"}], "title": "3.7.3. Actual navigation changes"}, {"refs": [{"id": "ref-for-concept-url\u2467"}], "title": "4.2. Content Security Policy"}, {"refs": [{"id": "ref-for-concept-url\u2468"}, {"id": "ref-for-concept-url\u2460\u24ea"}], "title": "4.3. Permissions Policies"}], "external": true};
+window.dfnpanelData['dcffbccd'] = {"dfnID": "dcffbccd", "url": "https://url.spec.whatwg.org/#concept-url", "dfnText": "url", "refSections": [{"refs": [{"id": "ref-for-concept-url"}], "title": "2.3.2. The fenced frame config struct"}, {"refs": [{"id": "ref-for-concept-url\u2460"}], "title": "2.3.3. The fenced frame config instance struct"}, {"refs": [{"id": "ref-for-concept-url\u2461"}], "title": "3.3. Policy container inheritance"}, {"refs": [{"id": "ref-for-concept-url\u2462"}], "title": "3.7.3. Actual navigation changes"}, {"refs": [{"id": "ref-for-concept-url\u2463"}], "title": "4.2. Content Security Policy"}, {"refs": [{"id": "ref-for-concept-url\u2464"}, {"id": "ref-for-concept-url\u2465"}], "title": "4.3. Permissions Policies"}], "external": true};
 window.dfnpanelData['8855a9aa'] = {"dfnID": "8855a9aa", "url": "https://webidl.spec.whatwg.org/#idl-DOMString", "dfnText": "DOMString", "refSections": [{"refs": [{"id": "ref-for-idl-DOMString"}, {"id": "ref-for-idl-DOMString\u2460"}, {"id": "ref-for-idl-DOMString\u2461"}], "title": "2. The fencedframe element"}, {"refs": [{"id": "ref-for-idl-DOMString\u2462"}], "title": "2.3.4. The FencedFrameConfig interface"}, {"refs": [{"id": "ref-for-idl-DOMString\u2463"}, {"id": "ref-for-idl-DOMString\u2464"}, {"id": "ref-for-idl-DOMString\u2465"}, {"id": "ref-for-idl-DOMString\u2466"}], "title": "2.4. The Fence interface"}], "external": true};
 window.dfnpanelData['889e932f'] = {"dfnID": "889e932f", "url": "https://webidl.spec.whatwg.org/#Exposed", "dfnText": "Exposed", "refSections": [{"refs": [{"id": "ref-for-Exposed"}], "title": "2. The fencedframe element"}, {"refs": [{"id": "ref-for-Exposed\u2460"}], "title": "2.3.4. The FencedFrameConfig interface"}, {"refs": [{"id": "ref-for-Exposed\u2461"}], "title": "2.4. The Fence interface"}], "external": true};
 window.dfnpanelData['b0d7f3c3'] = {"dfnID": "b0d7f3c3", "url": "https://webidl.spec.whatwg.org/#idl-USVString", "dfnText": "USVString", "refSections": [{"refs": [{"id": "ref-for-idl-USVString"}], "title": "2.3.4. The FencedFrameConfig interface"}], "external": true};