# WBV2-P6-001 status

- task: `WBV2-P6-001`
- parent: `WBV2-P5-003`
- parity: `SECURITY.SCRIPTING`
- implementationClass: `EXCLUDED`
- status: `done`
- fixture: `tests/files/web/generated/WBV2-P6-001-SECURITY.SCRIPTING.blend`

## Evidence

- Blender desktop and WASM/Main expose the same read-only scripting policy receipt: autorun, network, add-on, driver-expression and module execution default to `DENY`.
- The receipt records a disabled sandbox, cancellation code `SCRIPT_SANDBOX_CANCELLED`, idempotent disposal state `RELEASED`, bounded budgets, and blocked DOM/worker/storage/network scope.
- A malicious Text source remains metadata-only; module autorun, unsigned execution, approved-key sandbox execution, late sandbox results, and filesystem escape are all rejected without publishing or changing Main.
- The policy Text and script source survive desktop and WASM save/reopen exactly. The updated C++ reader defines a typed `scriptingPolicy` snapshot field; the checked-in vendor WASM exposes the same canonical receipt through `texts` until rebuilt.

## Commands

- `build_blender_5.2.0/bin/blender -b --factory-startup --python tools/web/generated/WBV2-P6-001.py -- tests/files/web/generated/WBV2-P6-001-SECURITY.SCRIPTING.blend`
- `build_blender_5.2.0/bin/blender -b --factory-startup --python tools/web/check-wbv2-p6-001-desktop.py -- tests/files/web/generated/WBV2-P6-001-SECURITY.SCRIPTING.blend tests/golden/WBV2-P6-001/scripting-desktop-report.json`
- `node --check tools/web/check-generated-gap.mjs`
- `npm --prefix web run test:generated-gap -- --task WBV2-P6-001`
- `node tools/web/check-generated-gap.mjs --task WBV2-P6-001`

## Handoff

- nextTask: `WBV2-P6-002`
- queue mutation: allowed after manifest and parent hash validation