REQ-NFR-064
PWA service worker MUST NOT cache approval-decision-bearing endpoints — only static shell
What
PWA service worker SHALL NOT cache approval-decision-bearing endpoints; only the static shell (CSS, JS, fonts, icons, page HTML) is precached. Every API call is network-only.
Why
Cached approvals risk replays of stale decisions or offline-tampering. Approval responses must always reflect server-side state.
How
Service worker fetch handler routes static assets through cache-first; routes API requests (matching /v1/*) through fetch() unconditionally with no cache.put() calls.
Done when
Manual test: with PWA installed and offline, hitting Submit on a sign-off form fails with "Offline - reconnect to submit"; cache audit shows no entries for /v1/* URLs.
Out of scope
Read-only artifact caching (the artifact body is cached as part of the page, but the decision endpoints are not).
Category
security
established project management guidelines Mapping
Service-worker caching policy mitigates the stale-approval-decision risk.