M13-02B Status

status: done
task: canonical script manifest serialization
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

Scope

The scripting protocol now exposes canonicalizeScriptingManifest and serializeScriptingManifest as the single canonical signature-input path. Script, permission and dependency arrays are sorted with locale-independent code-unit ordering; unknown fields are removed by the parser; canonical JSON has sorted object keys and no whitespace; and security-relevant fields such as source byte length, source hash, permissions, paths, budgets and policy flags remain in the serialized input. Schema changes and source declaration mutations produce a different or rejected input. No signature is accepted and no script is executed by this task.

Evidence

node --test web/tests/unit/script-manifest-canonical.test.mjs passed 2/2. It proves order invariance, unknown-field dropping, security-field binding and schema rejection.
WEB_TEST_PORT=5514 npm --prefix web run test:script-manifest-canonical passed unit 2/2 and production Chromium Worker 1/1.
node tools/web/check-script-manifest-canonical.mjs passed: script-manifest-canonical-ok equal=true bytes=1923 unknownDropped=true schemaMutation=blocked next=M13-02C.
npm --prefix web run typecheck, npm --prefix web run lint, npm --prefix web run build, node tools/web/check-script-manifest-budgets.mjs, node tools/web/check-status-consistency.mjs and git diff --check passed. The M13-02A artifact manifest was refreshed to the current protocol hash after this additive canonical API change, and its checker was rerun successfully; no prior behavior or parity status was changed.

Artifact Hashes

protocol: 6699fc0a19e0736823f164e707a420655803e36019cf0071f7ff9c760d25e9f2
worker: de27fdcd6d16e27a07806ac609f908edfdb7a93d653676174cdd5e06ffa394af
checker: 5ed344cab6428ae5538a450171ba40c73ff738666515492298e30aaed1394f56
unit: 33eae0f3ad2ae7243c9ce2835ab8e42186f65f574ab682099766f1d0f4c481f6
e2e: 5342301165ae82a01b46f5fed0cc0ec34b9813a6ecbc8032900d90b89628e064
report: 5f4bc0b098ea65de47f1255d30130376d74260e2b912bcd0e28354171fbd07df
parent manifest: 7148e0387dadffdb55e94e80dc30cfd5cdd40ebe990d06378e90c376d36ebd51
manifest: 605c656780a206a0d3b81d06b0294108b488a62d2b709e886884a2973c6cb091

Next Task

M13-02C: signer identity, key rotation, revocation and timestamp policy.

Rollback

Remove the canonical serializer exports, checker, unit/Chromium tests, worker, report, manifest and this status entry; restore M13-02A as the queue tail and move the machine queue back to M13-02B. No parity ledger rollback is required.

2.7 KiB Raw Blame History