M13-01C Status

status: done
task: default-deny autorun, register, install, and driver execution policy codes
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

Scope

The scripting manifest parser and execution gate reject autorun/register/install/driver execution requests with stable policy codes. The current bounded contract returns SCRIPT_POLICY_DENIED for autorun, DRIVER_EXECUTION_BLOCKED for driver expressions, ADDON_INSTALL_BLOCKED for add-on install/registration, and SCRIPT_SANDBOX_UNAVAILABLE even for a correctly signed script when no isolated sandbox exists. No local eval or script execution is enabled.

Evidence

node --test web/tests/unit/script-policy-codes.test.mjs passed 1/1 and asserts all three denied request codes plus the approved-key sandbox gate.
node tools/web/check-script-policy-codes.mjs passed: script-policy-codes-ok autorun=SCRIPT_POLICY_DENIED driver=DRIVER_EXECUTION_BLOCKED addon=ADDON_INSTALL_BLOCKED sandbox=SCRIPT_SANDBOX_UNAVAILABLE next=M13-01D.
npm --prefix web run typecheck, Node syntax checks and git diff --check passed. The report and manifest bind the transpiled production protocol source hashes.

Artifact Hashes

checker: 22588c2198bc8c425ab8e104e8559f0053654ae778aaea3783ec7d54822bc8f4
unit: b5a52b8e707963545f1cd71f1a148fa9c9b9d1e4b4c5f51c87d33f8bf3777430
report: 956db548ee71688a4b89c9a993259d3e57129cd4abe9efd1b9397b3e30b1bf84

Next Task

M13-01D: ensure UI exposes no direct-eval bypass around the scripting policy.

Rollback

Remove the checker, unit test, report, manifest and this status entry. Restore M13-01B as the queue tail and move the machine queue back to M13-01C. No parity ledger rollback is required.

1.7 KiB Raw Blame History