Checkpoint web parity through Chromium input tasks

docs/status/M13-02D.md

@@ -0,0 +1,46 @@
+# M13-02D Status
+
+status: done  
+task: signature verification binds declared content  
+updated: 2026-08-18 America/New_York  
+enablingTask: false  
+parityStateChange: false
+
+## Scope
+
+`verifyScriptManifestSignature` now verifies the canonical per-script manifest input with the
+trusted ED25519 key. The input includes the declared source SHA-256 and all policy-relevant fields,
+while excluding only the signature field itself. A source hash or signature mutation therefore
+returns `SCRIPT_SIGNATURE_INVALID`; revoked or otherwise ineligible keys return
+`SCRIPT_POLICY_DENIED`. Verification remains a policy gate and does not enable script execution.
+
+## Evidence
+
+- `node --test --test-name-pattern=M13-02D web/tests/unit/script-trust-policy.test.mjs` passed the
+  M13-02D case (1 passed, 3 unrelated cases skipped).
+- `WEB_TEST_PORT=5520 npm --prefix web run test:script-signature` passed the focused Node case and
+  production Chromium Worker E2E (1/1).
+- `node tools/web/check-script-signature.mjs` passed:
+  `script-signature-ok verified=SCRIPT_SIGNATURE_VERIFIED sourceHashChanged=SCRIPT_SIGNATURE_INVALID revoked=SCRIPT_POLICY_DENIED next=M13-02E`.
+- `npm --prefix web run typecheck`, `npm --prefix web run lint`, `npm --prefix web run build` and
+  `git diff --check` passed.
+
+## Artifact Hashes
+
+- protocol: `6699fc0a19e0736823f164e707a420655803e36019cf0071f7ff9c760d25e9f2`
+- worker: `f4e8ff45d06efcfa9e634ef28e654241d70554ed05dfe9c3fecd9f6eef166ce0`
+- checker: `2d6e7b403dd6d401eb1a41978016b40bd1fb86120464e09f185de4445c177fa4`
+- unit: `aac3ff0a1c7ae27e35112614bedabc02bb248882ec9b0b52d65f9794d06830d8`
+- e2e: `8a882fc8fa2c0c4e2eab3660810cec0f60d2f7475f62a1bb406fc3b2bdf60882`
+- report: `957daf8e5899714cc5ce253b1f0fb2b258f1cc966238fff31e2626f8f56feb3a`
+- manifest: `c6b79a77e4b7ffe5f4a9ba785a30305f9cf6e86caf89b38a4b303a86ab662a31`
+
+## Next Task
+
+`M13-02E`: permission default-minimization and unknown-permission blocking.
+
+## Rollback
+
+Remove the M13-02D checker, report, manifest, status entry and focused package command; restore
+M13-02C as the queue tail and move the machine queue back to `M13-02D`. No parity ledger rollback
+is required.