Checkpoint web parity through Chromium input tasks

docs/status/M13-03A.md

@@ -0,0 +1,42 @@
+# M13-03A Status
+
+status: done  
+task: sandbox capability scope  
+updated: 2026-08-18 America/New_York  
+enablingTask: false  
+parityStateChange: false
+
+## Scope
+
+The production scripting protocol now defines a versioned all-deny sandbox scope. DOM, host-worker,
+OPFS, IndexedDB and network capabilities must each be explicitly `false`; any enabled, missing or
+unknown scope version is rejected with a stable policy/protocol error. This is a capability contract
+only: script execution remains disabled and no sandbox implementation is claimed.
+
+## Evidence
+
+- `node --test web/tests/unit/script-sandbox-scope.test.mjs` passed 2/2.
+- `WEB_TEST_PORT=5523 npm --prefix web run test:script-sandbox-scope` passed unit 2/2 and
+  production Chromium Worker E2E 1/1.
+- `node tools/web/check-script-sandbox-scope.mjs` passed:
+  `script-sandbox-scope-ok dom=SCRIPT_POLICY_DENIED hostWorker=SCRIPT_POLICY_DENIED opfs=SCRIPT_POLICY_DENIED indexedDB=SCRIPT_POLICY_DENIED network=SCRIPT_POLICY_DENIED execution=DISABLED next=M13-03B`.
+- `npm --prefix web run typecheck`, `npm --prefix web run lint` and `git diff --check` passed.
+
+## Artifact Hashes
+
+- protocol: `6699fc0a19e0736823f164e707a420655803e36019cf0071f7ff9c760d25e9f2`
+- worker: `27058fbb602791cbe6691fa14b3bc9c3d6cdea79641ba9c72fe18b6226d2a651`
+- checker: `ad26ea3b078e480ba8f99cbf8dbd0d9b135c7605f4a3958d24845b7f5f8b0f43`
+- unit: `a15da2e645d2d681c7e9ac1380f6b224d196d1d2e78d20f1bacad01e138753d4`
+- e2e: `49930747e6663f79b61093706318b72e59388d79e3e1cc105bc1571693326667`
+- report: `ba5784c751d5a347f38aa522ffcbed270d38fb474f0f10a2d06ea501d0234021`
+- manifest: `76a7ce0fd3a38fb770c9cedccbd05ed566b931caa1782fdae898d3b66c3a20bf`
+
+## Next Task
+
+`M13-03B`: fixed CPU, wall-time, memory, message and output-byte budgets.
+
+## Rollback
+
+Remove the sandbox scope parser, focused worker/tests/checker, report, manifest, status entry and
+package command; restore M13-02F as the queue tail and move `nextTask` back to `M13-03A`.