workinf_Blender_Wasm/docs/status/WBV2-P6-001.md

WBV2-P6-001 status

• task: WBV2-P6-001
• parent: WBV2-P5-003
• parity: SECURITY.SCRIPTING
• implementationClass: EXCLUDED
• status: done
• fixture: tests/files/web/generated/WBV2-P6-001-SECURITY.SCRIPTING.blend

Evidence

• Blender desktop and WASM/Main expose the same read-only scripting policy receipt: autorun, network, add-on, driver-expression and module execution default to DENY.
• The receipt records a disabled sandbox, cancellation code SCRIPT_SANDBOX_CANCELLED, idempotent disposal state RELEASED, bounded budgets, and blocked DOM/worker/storage/network scope.
• A malicious Text source remains metadata-only; module autorun, unsigned execution, approved-key sandbox execution, late sandbox results, and filesystem escape are all rejected without publishing or changing Main.
• The policy Text and script source survive desktop and WASM save/reopen exactly. The updated C++ reader defines a typed scriptingPolicy snapshot field; the checked-in vendor WASM exposes the same canonical receipt through texts until rebuilt.

Commands

• build_blender_5.2.0/bin/blender -b --factory-startup --python tools/web/generated/WBV2-P6-001.py -- tests/files/web/generated/WBV2-P6-001-SECURITY.SCRIPTING.blend
• build_blender_5.2.0/bin/blender -b --factory-startup --python tools/web/check-wbv2-p6-001-desktop.py -- tests/files/web/generated/WBV2-P6-001-SECURITY.SCRIPTING.blend tests/golden/WBV2-P6-001/scripting-desktop-report.json
• node --check tools/web/check-generated-gap.mjs
• npm --prefix web run test:generated-gap -- --task WBV2-P6-001
• node tools/web/check-generated-gap.mjs --task WBV2-P6-001

Handoff

• nextTask: WBV2-P6-002
• queue mutation: allowed after manifest and parent hash validation