40 lines
1.7 KiB
Markdown
40 lines
1.7 KiB
Markdown
# M13-01C Status
|
|
|
|
status: done
|
|
task: default-deny autorun, register, install, and driver execution policy codes
|
|
updated: 2026-08-18 America/New_York
|
|
enablingTask: false
|
|
parityStateChange: false
|
|
|
|
## Scope
|
|
|
|
The scripting manifest parser and execution gate reject autorun/register/install/driver execution
|
|
requests with stable policy codes. The current bounded contract returns `SCRIPT_POLICY_DENIED` for
|
|
autorun, `DRIVER_EXECUTION_BLOCKED` for driver expressions, `ADDON_INSTALL_BLOCKED` for add-on
|
|
install/registration, and `SCRIPT_SANDBOX_UNAVAILABLE` even for a correctly signed script when no
|
|
isolated sandbox exists. No local eval or script execution is enabled.
|
|
|
|
## Evidence
|
|
|
|
- `node --test web/tests/unit/script-policy-codes.test.mjs` passed 1/1 and asserts all three denied
|
|
request codes plus the approved-key sandbox gate.
|
|
- `node tools/web/check-script-policy-codes.mjs` passed:
|
|
`script-policy-codes-ok autorun=SCRIPT_POLICY_DENIED driver=DRIVER_EXECUTION_BLOCKED addon=ADDON_INSTALL_BLOCKED sandbox=SCRIPT_SANDBOX_UNAVAILABLE next=M13-01D`.
|
|
- `npm --prefix web run typecheck`, Node syntax checks and `git diff --check` passed. The report and
|
|
manifest bind the transpiled production protocol source hashes.
|
|
|
|
## Artifact Hashes
|
|
|
|
- checker: `22588c2198bc8c425ab8e104e8559f0053654ae778aaea3783ec7d54822bc8f4`
|
|
- unit: `b5a52b8e707963545f1cd71f1a148fa9c9b9d1e4b4c5f51c87d33f8bf3777430`
|
|
- report: `956db548ee71688a4b89c9a993259d3e57129cd4abe9efd1b9397b3e30b1bf84`
|
|
|
|
## Next Task
|
|
|
|
`M13-01D`: ensure UI exposes no direct-eval bypass around the scripting policy.
|
|
|
|
## Rollback
|
|
|
|
Remove the checker, unit test, report, manifest and this status entry. Restore M13-01B as the queue
|
|
tail and move the machine queue back to M13-01C. No parity ledger rollback is required.
|