# M12-05F Status

status: done
task: reject forged, stale, or cross-version runtime receipts before use
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

## Scope

The schema-1 freshness envelope is derived from the M12-05E bound receipt set. It carries the
M12-05E byte identity, a canonical digest of the complete bound receipt set, and a canonical digest
of the pinned Blender runtime identity. Before a route can be used, the parent binding hash,
inventory hash, runtime identity, runtime hash, and receipt-set hash must all match the trusted
expectation. The route resolver re-validates this gate on every use and only then returns `READY`.

Forged receipt content returns `RECEIPT_FORGED`; an older parent or inventory returns
`RECEIPT_STALE`; a different Blender version/build identity returns `RECEIPT_CROSS_VERSION`.
Malformed or unavailable routes remain fail-closed as `IO_FORMAT_UNSUPPORTED`. The App GLB export and
format-tagged operator search now consume the freshness envelope rather than the unbound M12-05D set.

## Evidence

- `node --test web/tests/unit/io-format-receipt-freshness.test.mjs` passed 4/4: exact trusted route,
  canonical digest verification, forged content, stale parent, and cross-version negatives.
- `node tools/web/check-io-format-receipt-freshness.mjs` passed; 14 receipts, App artifact parity,
  independent canonical digest verification, deterministic regeneration, and all three negative
  classes passed.
- Existing M12-05D/M12-05E unit and checker commands passed unchanged.
- `npm --prefix web run typecheck` and `npm --prefix web run build` passed; `git diff --check` passed.

## Artifact Hashes

- parent manifest: `2fbaaf39c6acd9f55fbdbadccc0b027e9e7763bf069c954a96ca49b193648990`
- protocol: `111a630c7beccd31989dc4f78932b7d7b741fb6bef03e45cb39a8139f774d235`
- generator: `6a1e798ce46e1d14d833091d4d7ae452dccb13efe583594277785465eb725bbf`
- checker: `7a8fe69ea1aa2c1e121be008a9fb60fc236f7ef776d2088a7b00b14f46fe3fba`
- unit: `cd1c2adca81653f98f9a1c6c7d104ad0e3052283213fb7166dac827c956928fe`
- freshness receipts: `0187ad0d9ea05fc4b152b7abd4945191dbe9ec24dfde4ca7dbe4aadfd1230efe`
- App freshness receipts: `0187ad0d9ea05fc4b152b7abd4945191dbe9ec24dfde4ca7dbe4aadfd1230efe`
- App expected identity: `8d65f78aa774ff252871cb1cc09e69b4ff04fbb45e61200eaf67534c9d2651b2`
- App: `043ff3a2f39ef3a1303791081b80851b427e7db5dfd9af2161926dd6f1ea9ca4`
- package commands: `cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c`
- manifest: `63e1506801ddee2f1eaf64cad68a9d5c918405f642ca237c6a1ec249ff297623`

## Next Task

`M12-06A`: desktop generate the bounded Mesh/PBR/UV/skin/animation GLB fixture group.

## Rollback

Remove the freshness protocol, generator/checker, freshness artifacts, unit test, App imports/route
gate, manifest, and this status entry. Restore M12-05E as the queue tail and move the machine queue
back to `M12-05F`. No parity ledger rollback is required.