Checkpoint web parity through Chromium input tasks

docs/status/M13-02F.md

@@ -0,0 +1,42 @@
+# M13-02F Status
+
+status: done  
+task: signature replay, key-confusion and expiry negative cases  
+updated: 2026-08-18 America/New_York  
+enablingTask: false  
+parityStateChange: false
+
+## Scope
+
+The signature gate now has an independent negative-case matrix covering missing keys, expired and
+not-yet-valid keys, publisher/key confusion, and a signature copied to a different script. Every
+case remains fail-closed with `SCRIPT_POLICY_DENIED` or `SCRIPT_SIGNATURE_INVALID`; no execution
+route is added. Canonical script ordering remains accepted when the script's own signature matches.
+
+## Evidence
+
+- `node --test web/tests/unit/script-signature-negative.test.mjs` passed 2/2.
+- `WEB_TEST_PORT=5522 npm --prefix web run test:script-signature-negative` passed unit 2/2 and
+  production Chromium Worker E2E 1/1.
+- `node tools/web/check-script-signature-negative.mjs` passed:
+  `script-signature-negative-ok missing=SCRIPT_POLICY_DENIED expired=SCRIPT_POLICY_DENIED notYetValid=SCRIPT_POLICY_DENIED swapped=SCRIPT_SIGNATURE_INVALID next=M13-03A`.
+- `npm --prefix web run typecheck`, `npm --prefix web run lint` and `git diff --check` passed.
+
+## Artifact Hashes
+
+- protocol: `6699fc0a19e0736823f164e707a420655803e36019cf0071f7ff9c760d25e9f2`
+- worker: `49b289110a6533fcd1a29ad78be00792fd3c0d251c6027bae0440f5daba929a1`
+- checker: `35f2e6727aef5e6ea2e2623e2effa6ea0356faaf66d417976db7f5bbe671a38c`
+- unit: `8b9c8d63c97fce07299622b9ad261791a97bb91a6ed340e72c24c55e685978bd`
+- e2e: `26c52ef67d6b1ea2994d92637826994e98e5234e042049f8d69a905f5cdb3309`
+- report: `d23a2ae5613b2442ad79420aa344ebfe3767d10ac19b3ea30a62afcccd3a167c`
+- manifest: `283673b21e6c9b89dc6ecb7007f3cecf28d53a84ec84f3f8b52373c055538a74`
+
+## Next Task
+
+`M13-03A`: sandbox capability scope with no DOM, host-worker, OPFS, IndexedDB or network access.
+
+## Rollback
+
+Remove the M13-02F negative-case worker, tests, checker, report, manifest, status entry and package
+command; restore M13-02E as the queue tail and move `nextTask` back to `M13-02F`.