M12-06F Status

status: done task: GLB sparse accessor, extension, external URI and over-budget negative cases updated: 2026-08-18 America/New_York enablingTask: false parityStateChange: false

Scope

The bounded GLB importer now enforces a 512 KiB input budget, JSON/table budgets, rejects sparse accessors, rejects all extensions outside the pinned allowlist (currently empty), and blocks external buffer/image URIs. Errors are stable and fail before semantic/Main publication: GLB_SPARSE_ACCESSOR_UNSUPPORTED, GLB_EXTENSION_UNSUPPORTED, GLB_EXTERNAL_URI_BLOCKED, and GLB_IMPORT_BUDGET_EXCEEDED.

Evidence

node --test web/tests/unit/glb-negative-cases.test.mjs passed 2/2 for sparse, extension, external URI, byte-budget and table-count cases.
CHROME_PATH=/usr/bin/google-chrome-stable WEB_TEST_PORT=5450 node_modules/.bin/playwright test --config playwright.config.ts --workers=1 tests/e2e/glb-negative-cases.spec.ts passed 1/1 in a production Chromium Worker with all four stable codes.
node tools/web/check-glb-negative-cases.mjs passed the schema-1 negative report and artifact hashes: glb-negative-cases-ok cases=4 budget=524288 deterministic=true next=M12-06G.
npm --prefix web run typecheck and git diff --check passed. The package manifest remains unchanged.

Artifact Hashes

parent manifest: 3d3b13fd54a314fd6f6907fc2d314e66ef74e8ca770a8accd823370d272737fc
protocol: 0b6329c08e6f3cd9af6f27ef7c463b037a7cab94192afb4538d3d6c4cfcbc147
unit: 9af1c155143a0c685a62f569f705afd9fcc3bb49e0d724ebf3ad2c6356d63d6d
Worker: d84a6b884ce1bfedd598b2602d803493bf10f6ad62fdfac49d64fca3f30f3931
Chromium test: c6694689ce04ff2faea2c20be648f438a9f7eb25cdfd2f714b94c1f556ea1510
checker: 08377c306fd7d1082f7fd734e37809960c9798d29d626681fe9ad3f94cb7a29e
negative report: 7367a624b562a9613b4b908c894ab04c731ae0a348a3b58689075f4a9decd90c
package: cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c
manifest: 27b42da0683dab11a884553440088c30cf58d51364268fdaac86668786aaedd4

Next Task

M12-06G: import/export cancellation, Worker restart and OPFS quota recovery.

Rollback

Remove the GLB negative-case budget/protocol changes, Worker, tests, checker, report, manifest, and this status entry. Restore M12-06E as the queue tail and move the machine queue back to M12-06F. No parity ledger rollback is required.

2.3 KiB Raw Blame History