M13-01B Status

status: done
task: read script metadata on .blend open without executing arbitrary content
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

Scope

The real script_scene.blend open path reads all three Text sources, verifies source bytes and SHA-256, preserves read-only metadata, and keeps every source executionStatus=BLOCKED. A use_module autorun request remains SCRIPT_POLICY_DENIED; no Python Console, driver, handler, or add-on code executes during open. This task does not add a script execution route.

Evidence

node tools/web/check-script-open-metadata.mjs ran the production WASM Main reader against the real fixture and passed script-open-metadata-ok blend=opened textMetadata=read sourceHash=verified execution=DENY autorun=DENY next=M13-01C.
CHROME_PATH=/usr/bin/google-chrome-stable WEB_TEST_PORT=5495 node_modules/.bin/playwright test --config playwright.config.ts --workers=1 tests/e2e/script-open-metadata.spec.ts passed 1/1. Chromium opened the fixture through WebEngineClient, saw three read-only blocked sources and the explicit autorun denial.
npm --prefix web run typecheck and git diff --check passed. The checker emits the deterministic report tests/golden/M13-01B/open-metadata-report.json bound to the fixture hash.

Artifact Hashes

checker: 66396d5c9a5294021ae077bb162278c74d46de8b52ac8a444a5de4f6d84cfe05
e2e: df6412cda113c830996e08c3d66a035dc1ac309e392f5946a762d11121b1926c
report: f92470e57c048452134664f7f6208e50b6f087dbcbc33369e6b882c51813990c
fixture: 2b8fbdb05419e1e61d64777998d6a3b2562f726c17f548cd1852efc723e1a037

Next Task

M13-01C: default-deny autorun, register, install, and driver execution policy codes.

Rollback

Remove the checker, report, manifest, e2e test, and this status entry. Restore M13-01A as the queue tail and move the machine queue back to M13-01B. No parity ledger rollback is required.

1.9 KiB Raw Blame History