# M13-03A Status

status: done
task: sandbox capability scope
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

## Scope

The production scripting protocol now defines a versioned all-deny sandbox scope. DOM, host-worker,
OPFS, IndexedDB and network capabilities must each be explicitly `false`; any enabled, missing or
unknown scope version is rejected with a stable policy/protocol error. This is a capability contract
only: script execution remains disabled and no sandbox implementation is claimed.

## Evidence

- `node --test web/tests/unit/script-sandbox-scope.test.mjs` passed 2/2.
- `WEB_TEST_PORT=5523 npm --prefix web run test:script-sandbox-scope` passed unit 2/2 and
  production Chromium Worker E2E 1/1.
- `node tools/web/check-script-sandbox-scope.mjs` passed:
  `script-sandbox-scope-ok dom=SCRIPT_POLICY_DENIED hostWorker=SCRIPT_POLICY_DENIED opfs=SCRIPT_POLICY_DENIED indexedDB=SCRIPT_POLICY_DENIED network=SCRIPT_POLICY_DENIED execution=DISABLED next=M13-03B`.
- `npm --prefix web run typecheck`, `npm --prefix web run lint` and `git diff --check` passed.

## Artifact Hashes

- protocol: `6699fc0a19e0736823f164e707a420655803e36019cf0071f7ff9c760d25e9f2`
- worker: `27058fbb602791cbe6691fa14b3bc9c3d6cdea79641ba9c72fe18b6226d2a651`
- checker: `ad26ea3b078e480ba8f99cbf8dbd0d9b135c7605f4a3958d24845b7f5f8b0f43`
- unit: `a15da2e645d2d681c7e9ac1380f6b224d196d1d2e78d20f1bacad01e138753d4`
- e2e: `49930747e6663f79b61093706318b72e59388d79e3e1cc105bc1571693326667`
- report: `ba5784c751d5a347f38aa522ffcbed270d38fb474f0f10a2d06ea501d0234021`
- manifest: `76a7ce0fd3a38fb770c9cedccbd05ed566b931caa1782fdae898d3b66c3a20bf`

## Next Task

`M13-03B`: fixed CPU, wall-time, memory, message and output-byte budgets.

## Rollback

Remove the sandbox scope parser, focused worker/tests/checker, report, manifest, status entry and
package command; restore M13-02F as the queue tail and move `nextTask` back to `M13-03A`.