Checkpoint web parity through Chromium input tasks

docs/status/M12-04J.md

@@ -0,0 +1,49 @@
+# M12-04J Status
+
+status: done
+task: keep malicious ZIP/TAR fixtures in the long-term archive security regression
+updated: 2026-08-18 America/New_York
+enablingTask: false
+parityStateChange: false
+
+## Scope
+
+Six deterministic binary fixtures cover ZIP path traversal, compression-ratio abuse, duplicate
+paths, TAR path traversal, symlink escape, and file/directory prefix conflict. The generator fixes
+container fields and timestamps; the checker regenerates every file in a temporary directory and
+requires byte-for-byte equality with the committed fixtures and catalog SHA-256 values.
+
+The checker reads ZIP EOCD/central-directory and USTAR header metadata, verifies local-header
+bindings, TAR checksums, alignment, and end markers, then feeds the actual entry metadata into the
+M12-04D/G link and conflict gates. It never invokes `tar`, `unzip`, or an extraction API. All six
+fixtures fail closed with `IO_ARCHIVE_UNSAFE` and are included in the existing N-023 Chromium grep.
+
+## Evidence
+
+- `node tools/web/check-malicious-archive-fixtures.mjs` passed 6/6 with three ZIP and three TAR
+  fixtures and extraction disabled.
+- `WEB_TEST_PORT=5408 npm --prefix web run test:asset-library` passed 2/2, including the persistent
+  binary-fixture security test and the existing N-023 asset/IO gate.
+- Fixture byte lengths range from 115 to 3,072 bytes and every committed SHA-256 matches the
+  generated catalog.
+
+## Artifact Hashes
+
+- parent manifest: `574afa68a787b9481d0e098d38b94cb810a9827fe185b0df796d62cc160ba7c5`
+- generator: `b372ea8cb2f97b035ffb2cc18666dae9167dcfb349131851ad9f1ff0fc40ba16`
+- checker: `edda2f420f26e55f9990d24b755bb9b4f732ec32c2e072210144b3d0b6634d9b`
+- fixture manifest: `a93834316f6a23b8a0e6c1f1f806ec584d6f03aa339c2680cae2ce8133a40e58`
+- Chromium spec: `f327500808dd67359a152ce28134b58d027aebd6758416b5535b659b9900bbfe`
+- package commands: `cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c`
+- manifest: `989d417ab44e165849c7054f331f7038ec1d779349c39dd4f5b30050bbaecf56`
+
+## Next Task
+
+`M12-05A`: generate the glTF/GLB, OBJ, STL, PLY, USD, and Alembic format inventory from the pinned
+Blender 5.2 build/runtime.
+
+## Rollback
+
+Remove the fixture generator/checker, six binary fixtures and catalog, Chromium spec, golden
+manifest, and this status entry. Restore M12-04I as the queue tail and move the machine queue back to
+`M12-04J`. No parity ledger rollback is required.