# M13-01D Status

status: done  
task: UI direct-eval bypass gate  
updated: 2026-08-18 America/New_York  
enablingTask: false  
parityStateChange: false

## Scope

The production app, Workers, and protocol TypeScript sources contain no direct `eval(` or
`new Function(` bypass. The scan covers 176 non-vendor `.ts/.tsx` files and records the only
declared scripting policy entry points: `gateScriptExecution`, `gateServerScriptJob`, and
`parseScriptSourceInventory`. Execution remains `DENY`; this static gate does not claim a sandbox.

## Evidence

- `node tools/web/check-script-ui-bypass.mjs` passed:
  `script-ui-bypass-ok scanned=176 violations=0 policyEntrypoints=3 report=8e234e128b90036548ab709b86b063de404250da2c5c0a6e25e28969b5cd5c73 next=M13-01E`.
- `git diff --check` passed. Vendor-generated Emscripten/Three.js sources are outside the scan;
  no application or protocol source is allowed to introduce a direct eval constructor.

## Artifact Hashes

- checker: `f34cb64891c2b22bc3da353f6b864ba3e558d3c286cf716bcb778d9a542cb3d9`
- report: `6b050092088508ebd5d769d95a2e66f0cd4020c97f3407724a19b9707f51f6dd`
- manifest: `6b28688b3ebcce5629bcfc437d4ca903d0b1e053b32a796690ee4e021726c75b`

## Next Task

`M13-01E`: preserve Text data and unknown script sources through save/reopen.

## Rollback

Remove the checker, report, manifest, and this status entry. Restore M13-01C as the queue tail and
move the machine queue back to M13-01D. No parity ledger rollback is required.