37 lines
1.4 KiB
Markdown
37 lines
1.4 KiB
Markdown
# M13-01D Status
|
|
|
|
status: done
|
|
task: UI direct-eval bypass gate
|
|
updated: 2026-08-18 America/New_York
|
|
enablingTask: false
|
|
parityStateChange: false
|
|
|
|
## Scope
|
|
|
|
The production app, Workers, and protocol TypeScript sources contain no direct `eval(` or
|
|
`new Function(` bypass. The scan covers 176 non-vendor `.ts/.tsx` files and records the only
|
|
declared scripting policy entry points: `gateScriptExecution`, `gateServerScriptJob`, and
|
|
`parseScriptSourceInventory`. Execution remains `DENY`; this static gate does not claim a sandbox.
|
|
|
|
## Evidence
|
|
|
|
- `node tools/web/check-script-ui-bypass.mjs` passed:
|
|
`script-ui-bypass-ok scanned=176 violations=0 policyEntrypoints=3 report=8e234e128b90036548ab709b86b063de404250da2c5c0a6e25e28969b5cd5c73 next=M13-01E`.
|
|
- `git diff --check` passed. Vendor-generated Emscripten/Three.js sources are outside the scan;
|
|
no application or protocol source is allowed to introduce a direct eval constructor.
|
|
|
|
## Artifact Hashes
|
|
|
|
- checker: `f34cb64891c2b22bc3da353f6b864ba3e558d3c286cf716bcb778d9a542cb3d9`
|
|
- report: `6b050092088508ebd5d769d95a2e66f0cd4020c97f3407724a19b9707f51f6dd`
|
|
- manifest: `6b28688b3ebcce5629bcfc437d4ca903d0b1e053b32a796690ee4e021726c75b`
|
|
|
|
## Next Task
|
|
|
|
`M13-01E`: preserve Text data and unknown script sources through save/reopen.
|
|
|
|
## Rollback
|
|
|
|
Remove the checker, report, manifest, and this status entry. Restore M13-01C as the queue tail and
|
|
move the machine queue back to M13-01D. No parity ledger rollback is required.
|