# M13-01F Status

status: done
task: malicious Text, driver, handler, and embedded-module fixtures
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

## Scope

Pinned Blender 5.2 generated a malicious fixture containing four source bodies: OS command text,
driver import, handler subprocess, and an embedded `register()` module. Chromium opened the file
through the production Main reader and kept every source read-only/`BLOCKED`; the embedded module
returned `SCRIPT_POLICY_DENIED`. No filesystem marker or execution path is exposed by the test.

## Evidence

- `build_blender_5.2.0/bin/blender -b --factory-startup --python
  tools/web/generate-malicious-script-fixture.py -- tests/files/web/m13_malicious_script_v1
  tests/golden/M13-01F/malicious-report.json` generated four deterministic source hashes and one
  `use_module` request.
- `node tools/web/check-malicious-script-fixture.mjs` passed:
  `malicious-script-fixture-ok sources=4 module=1 execution=BLOCKED fixtureSha256=7b1921931afc5bb74a2b73e90b175017c583ea878cdbb66f131718b2d8cd23b5 next=M13-02A`.
- `CHROME_PATH=/usr/bin/google-chrome-stable WEB_TEST_PORT=5499 node_modules/.bin/playwright test
  --config playwright.config.ts --workers=1 tests/e2e/malicious-script.spec.ts` passed 1/1.
- `git diff --check` passed.

## Artifact Hashes

- generator: `013285befeb59de21a887cefd377adf8cf53ff1c785b28a9c87d29f76f092731`
- checker: `36608da893ae59e2e03856a62866ea6e7c349ec4a63200f042b2329e5f61caa9`
- e2e: `98fbde6728ddf55cce5262522197a5b4db1dfce618e52259bf0b0c9e0e9165f2`
- report: `a628b73411d6f9a761f659ae28867ea9b0c0df30d47668353278b70d4b44180c`
- fixture: `7b1921931afc5bb74a2b73e90b175017c583ea878cdbb66f131718b2d8cd23b5`
- manifest: `9a0b7c4097b3755365a9fb92b4848e6ac2ddd36ee2c7e9df3cb8808ce247cf3d`

## Next Task

`M13-02A`: bounded script manifest limits.

## Rollback

Remove the generator, checker, fixture, report, manifest, e2e test, and this status entry. Restore
M13-01E as the queue tail and move the machine queue back to M13-01F. No parity ledger rollback is required.