# M12-06F Status

status: done
task: GLB sparse accessor, extension, external URI and over-budget negative cases
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

## Scope

The bounded GLB importer now enforces a 512 KiB input budget, JSON/table budgets, rejects sparse
accessors, rejects all extensions outside the pinned allowlist (currently empty), and blocks external
buffer/image URIs. Errors are stable and fail before semantic/Main publication:
`GLB_SPARSE_ACCESSOR_UNSUPPORTED`, `GLB_EXTENSION_UNSUPPORTED`, `GLB_EXTERNAL_URI_BLOCKED`, and
`GLB_IMPORT_BUDGET_EXCEEDED`.

## Evidence

- `node --test web/tests/unit/glb-negative-cases.test.mjs` passed 2/2 for sparse, extension, external
  URI, byte-budget and table-count cases.
- `CHROME_PATH=/usr/bin/google-chrome-stable WEB_TEST_PORT=5450 node_modules/.bin/playwright test
  --config playwright.config.ts --workers=1 tests/e2e/glb-negative-cases.spec.ts` passed 1/1 in a
  production Chromium Worker with all four stable codes.
- `node tools/web/check-glb-negative-cases.mjs` passed the schema-1 negative report and artifact
  hashes: `glb-negative-cases-ok cases=4 budget=524288 deterministic=true next=M12-06G`.
- `npm --prefix web run typecheck` and `git diff --check` passed. The package manifest remains
  unchanged.

## Artifact Hashes

- parent manifest: `3d3b13fd54a314fd6f6907fc2d314e66ef74e8ca770a8accd823370d272737fc`
- protocol: `0b6329c08e6f3cd9af6f27ef7c463b037a7cab94192afb4538d3d6c4cfcbc147`
- unit: `9af1c155143a0c685a62f569f705afd9fcc3bb49e0d724ebf3ad2c6356d63d6d`
- Worker: `d84a6b884ce1bfedd598b2602d803493bf10f6ad62fdfac49d64fca3f30f3931`
- Chromium test: `c6694689ce04ff2faea2c20be648f438a9f7eb25cdfd2f714b94c1f556ea1510`
- checker: `08377c306fd7d1082f7fd734e37809960c9798d29d626681fe9ad3f94cb7a29e`
- negative report: `7367a624b562a9613b4b908c894ab04c731ae0a348a3b58689075f4a9decd90c`
- package: `cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c`
- manifest: `27b42da0683dab11a884553440088c30cf58d51364268fdaac86668786aaedd4`

## Next Task

`M12-06G`: import/export cancellation, Worker restart and OPFS quota recovery.

## Rollback

Remove the GLB negative-case budget/protocol changes, Worker, tests, checker, report, manifest, and
this status entry. Restore M12-06E as the queue tail and move the machine queue back to M12-06F. No
parity ledger rollback is required.