M13-01D Status

status: done
task: UI direct-eval bypass gate
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

Scope

The production app, Workers, and protocol TypeScript sources contain no direct eval( or new Function( bypass. The scan covers 176 non-vendor .ts/.tsx files and records the only declared scripting policy entry points: gateScriptExecution, gateServerScriptJob, and parseScriptSourceInventory. Execution remains DENY; this static gate does not claim a sandbox.

Evidence

node tools/web/check-script-ui-bypass.mjs passed: script-ui-bypass-ok scanned=176 violations=0 policyEntrypoints=3 report=8e234e128b90036548ab709b86b063de404250da2c5c0a6e25e28969b5cd5c73 next=M13-01E.
git diff --check passed. Vendor-generated Emscripten/Three.js sources are outside the scan; no application or protocol source is allowed to introduce a direct eval constructor.

Artifact Hashes

checker: f34cb64891c2b22bc3da353f6b864ba3e558d3c286cf716bcb778d9a542cb3d9
report: 6b050092088508ebd5d769d95a2e66f0cd4020c97f3407724a19b9707f51f6dd
manifest: 6b28688b3ebcce5629bcfc437d4ca903d0b1e053b32a796690ee4e021726c75b

Next Task

M13-01E: preserve Text data and unknown script sources through save/reopen.

Rollback

Remove the checker, report, manifest, and this status entry. Restore M13-01C as the queue tail and move the machine queue back to M13-01D. No parity ledger rollback is required.

1.4 KiB Raw Blame History