# M13-04B Status

status: done  
task: server source read-only and output isolation  
updated: 2026-08-19 America/New_York  
enablingTask: false  
parityStateChange: false

## Scope

Each allocated server job now gets a `source/` directory and a separate `output/` directory. The
source directory is `0555` and the staged `.blend` is `0444`; a source overwrite fails with
`EACCES`. The output directory is `0700` and accepts result bytes. Cleanup temporarily restores
the source directory permission so the one-shot job directory can be removed without residue.
This task does not claim OS/container CPU, memory or process limits.

## Evidence

- `node --test web/tests/unit/server-job-isolation.test.mjs` passed 3/3.
- `npm --prefix web run test:server-job-workspace` passed unit 3/3 and the independent checker.
- `node tools/web/check-server-job-workspace.mjs` passed:
  `server-job-workspace-ok sourceDir=0555 sourceFile=0444 sourceWrite=EACCES outputDir=0700 outputWrite=OK distinct=1 residual=0 next=M13-04C`.
- `npm --prefix web run typecheck`, `npm --prefix web run lint` and `git diff --check` passed.

## Artifact Hashes

- protocol: `3aa5678a2c2769e4db5bb8f5c755b97e23045c4106e5636459748ab9b41929cd`
- checker: `9490c2eeb9980073fc1fe77fdba1fb6e4ef528de8eb666d9eaf1fb582ba658c2`
- unit: `b1ac3324332180f7b3522f135520e7b5dace334dc461c92f2bce48fbcba2e147`
- package: `3df02b6049ac5d7185c23aef7764933ee460fedeb6595b3861272b0d49da5ecd`
- report: `650a643cc92617d068cb96d8bd4303429ef169ea89e3d4cb63e3ce5e2428e6d2`
- manifest: `9bc906b9e4c9751229f03271ef45a5925122b89b15bfe775591775f121ce1a4c`

## Next Task

`M13-04C`: enforce CPU, memory, process, file, wall-time and output budgets at the server boundary.

## Rollback

Remove the workspace protocol additions, focused tests/checker, report, manifest, package command and
this status entry; restore M13-04A as the queue tail and move `nextTask` back to `M13-04B`.