# M13-01C Status

status: done  
task: default-deny autorun, register, install, and driver execution policy codes  
updated: 2026-08-18 America/New_York  
enablingTask: false  
parityStateChange: false

## Scope

The scripting manifest parser and execution gate reject autorun/register/install/driver execution
requests with stable policy codes. The current bounded contract returns `SCRIPT_POLICY_DENIED` for
autorun, `DRIVER_EXECUTION_BLOCKED` for driver expressions, `ADDON_INSTALL_BLOCKED` for add-on
install/registration, and `SCRIPT_SANDBOX_UNAVAILABLE` even for a correctly signed script when no
isolated sandbox exists. No local eval or script execution is enabled.

## Evidence

- `node --test web/tests/unit/script-policy-codes.test.mjs` passed 1/1 and asserts all three denied
  request codes plus the approved-key sandbox gate.
- `node tools/web/check-script-policy-codes.mjs` passed:
  `script-policy-codes-ok autorun=SCRIPT_POLICY_DENIED driver=DRIVER_EXECUTION_BLOCKED addon=ADDON_INSTALL_BLOCKED sandbox=SCRIPT_SANDBOX_UNAVAILABLE next=M13-01D`.
- `npm --prefix web run typecheck`, Node syntax checks and `git diff --check` passed. The report and
  manifest bind the transpiled production protocol source hashes.

## Artifact Hashes

- checker: `22588c2198bc8c425ab8e104e8559f0053654ae778aaea3783ec7d54822bc8f4`
- unit: `b5a52b8e707963545f1cd71f1a148fa9c9b9d1e4b4c5f51c87d33f8bf3777430`
- report: `956db548ee71688a4b89c9a993259d3e57129cd4abe9efd1b9397b3e30b1bf84`

## Next Task

`M13-01D`: ensure UI exposes no direct-eval bypass around the scripting policy.

## Rollback

Remove the checker, unit test, report, manifest and this status entry. Restore M13-01B as the queue
tail and move the machine queue back to M13-01C. No parity ledger rollback is required.