Yes it should be served from the same origin. That is part of the security model of hosted apps and it is there to prevent abuse of your app. Take a look at manifest page on MDN:
... the paths must be served from the same origin as the app
Frage
Should the manifest file of a hosted Firefox OS app live on the same domain? I'd like to put it on a CDN together with the rest of the static files.
Lösung
Yes it should be served from the same origin. That is part of the security model of hosted apps and it is there to prevent abuse of your app. Take a look at manifest page on MDN:
... the paths must be served from the same origin as the app