# M13-02E Status

status: done  
task: permission default-minimization and unknown-permission blocking  
updated: 2026-08-18 America/New_York  
enablingTask: false  
parityStateChange: false

## Scope

`resolveScriptPermissions` now grants an empty set by default and only grants an explicitly
requested permission when it is already declared by the script manifest. Unknown, duplicate or
undeclared requests return `SCRIPT_POLICY_DENIED`; manifest declarations still reject unknown
permissions during parsing. This task adds no execution capability.

## Evidence

- `node --test web/tests/unit/script-permission-policy.test.mjs` passed 2/2.
- `WEB_TEST_PORT=5521 npm --prefix web run test:script-permission-policy` passed unit 2/2 and
  production Chromium Worker E2E 1/1.
- `node tools/web/check-script-permission-policy.mjs` passed:
  `script-permission-policy-ok defaultGranted=0 declared=READ_MAIN escalation=SCRIPT_POLICY_DENIED unknown=SCRIPT_POLICY_DENIED next=M13-02F`.
- `npm --prefix web run typecheck`, `npm --prefix web run lint` and `git diff --check` passed.

## Artifact Hashes

- protocol: `6699fc0a19e0736823f164e707a420655803e36019cf0071f7ff9c760d25e9f2`
- worker: `5df074e676542475009a4980fecaf3fdde009d149de84b9ca146647fb6aa1c02`
- checker: `169ab096295e08c5a630ef09d814da6ce742efd7a7143ff9a17984b4ca20593a`
- unit: `43bb6796616f3f92d71b51ef2a119a4e263864121a03356764e4b9c9241c4043`
- e2e: `dc13412a44f277bbe68315da0d38a2c4aa520d7489c81e7c908f9768c0547b7e`
- report: `8dc41e75620ba5bcb08d0edc52c3994e4f4dbc37ad3633757634bf10fe97b252`
- manifest: `691376d3cd33d3cd339b7195034abaf89cc02fba7e740c40ff051c4496400eef`

## Next Task

`M13-02F`: replay, key-confusion, expiry and multi-signature negative cases.

## Rollback

Remove `resolveScriptPermissions`, the focused worker/unit/E2E/checker, report, manifest, status
entry and package command; restore M13-02D as the queue tail and move `nextTask` back to `M13-02E`.