# M13-01B Status

status: done  
task: read script metadata on `.blend` open without executing arbitrary content  
updated: 2026-08-18 America/New_York  
enablingTask: false  
parityStateChange: false

## Scope

The real `script_scene.blend` open path reads all three Text sources, verifies source bytes and
SHA-256, preserves read-only metadata, and keeps every source `executionStatus=BLOCKED`. A
`use_module` autorun request remains `SCRIPT_POLICY_DENIED`; no Python Console, driver, handler,
or add-on code executes during open. This task does not add a script execution route.

## Evidence

- `node tools/web/check-script-open-metadata.mjs` ran the production WASM Main reader against the
  real fixture and passed `script-open-metadata-ok blend=opened textMetadata=read sourceHash=verified execution=DENY autorun=DENY next=M13-01C`.
- `CHROME_PATH=/usr/bin/google-chrome-stable WEB_TEST_PORT=5495 node_modules/.bin/playwright test
  --config playwright.config.ts --workers=1 tests/e2e/script-open-metadata.spec.ts` passed 1/1.
  Chromium opened the fixture through `WebEngineClient`, saw three read-only blocked sources and
  the explicit autorun denial.
- `npm --prefix web run typecheck` and `git diff --check` passed. The checker emits the deterministic
  report `tests/golden/M13-01B/open-metadata-report.json` bound to the fixture hash.

## Artifact Hashes

- checker: `66396d5c9a5294021ae077bb162278c74d46de8b52ac8a444a5de4f6d84cfe05`
- e2e: `df6412cda113c830996e08c3d66a035dc1ac309e392f5946a762d11121b1926c`
- report: `f92470e57c048452134664f7f6208e50b6f087dbcbc33369e6b882c51813990c`
- fixture: `2b8fbdb05419e1e61d64777998d6a3b2562f726c17f548cd1852efc723e1a037`

## Next Task

`M13-01C`: default-deny autorun, register, install, and driver execution policy codes.

## Rollback

Remove the checker, report, manifest, e2e test, and this status entry. Restore M13-01A as the
queue tail and move the machine queue back to M13-01B. No parity ledger rollback is required.