# M13-02B Status

status: done
task: canonical script manifest serialization
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

## Scope

The scripting protocol now exposes `canonicalizeScriptingManifest` and
`serializeScriptingManifest` as the single canonical signature-input path. Script, permission and
dependency arrays are sorted with locale-independent code-unit ordering; unknown fields are removed
by the parser; canonical JSON has sorted object keys and no whitespace; and security-relevant fields
such as source byte length, source hash, permissions, paths, budgets and policy flags remain in the
serialized input. Schema changes and source declaration mutations produce a different or rejected
input. No signature is accepted and no script is executed by this task.

## Evidence

- `node --test web/tests/unit/script-manifest-canonical.test.mjs` passed 2/2. It proves order
  invariance, unknown-field dropping, security-field binding and schema rejection.
- `WEB_TEST_PORT=5514 npm --prefix web run test:script-manifest-canonical` passed unit 2/2 and
  production Chromium Worker 1/1.
- `node tools/web/check-script-manifest-canonical.mjs` passed:
  `script-manifest-canonical-ok equal=true bytes=1923 unknownDropped=true schemaMutation=blocked next=M13-02C`.
- `npm --prefix web run typecheck`, `npm --prefix web run lint`, `npm --prefix web run build`,
  `node tools/web/check-script-manifest-budgets.mjs`, `node tools/web/check-status-consistency.mjs`
  and `git diff --check` passed. The M13-02A artifact manifest was refreshed to the current protocol
  hash after this additive canonical API change, and its checker was rerun successfully; no prior
  behavior or parity status was changed.

## Artifact Hashes

- protocol: `6699fc0a19e0736823f164e707a420655803e36019cf0071f7ff9c760d25e9f2`
- worker: `de27fdcd6d16e27a07806ac609f908edfdb7a93d653676174cdd5e06ffa394af`
- checker: `5ed344cab6428ae5538a450171ba40c73ff738666515492298e30aaed1394f56`
- unit: `33eae0f3ad2ae7243c9ce2835ab8e42186f65f574ab682099766f1d0f4c481f6`
- e2e: `5342301165ae82a01b46f5fed0cc0ec34b9813a6ecbc8032900d90b89628e064`
- report: `5f4bc0b098ea65de47f1255d30130376d74260e2b912bcd0e28354171fbd07df`
- parent manifest: `7148e0387dadffdb55e94e80dc30cfd5cdd40ebe990d06378e90c376d36ebd51`
- manifest: `605c656780a206a0d3b81d06b0294108b488a62d2b709e886884a2973c6cb091`

## Next Task

`M13-02C`: signer identity, key rotation, revocation and timestamp policy.

## Rollback

Remove the canonical serializer exports, checker, unit/Chromium tests, worker, report, manifest and
this status entry; restore M13-02A as the queue tail and move the machine queue back to M13-02B. No
parity ledger rollback is required.