43 lines
2.0 KiB
Markdown
43 lines
2.0 KiB
Markdown
# M13-02F Status
|
|
|
|
status: done
|
|
task: signature replay, key-confusion and expiry negative cases
|
|
updated: 2026-08-18 America/New_York
|
|
enablingTask: false
|
|
parityStateChange: false
|
|
|
|
## Scope
|
|
|
|
The signature gate now has an independent negative-case matrix covering missing keys, expired and
|
|
not-yet-valid keys, publisher/key confusion, and a signature copied to a different script. Every
|
|
case remains fail-closed with `SCRIPT_POLICY_DENIED` or `SCRIPT_SIGNATURE_INVALID`; no execution
|
|
route is added. Canonical script ordering remains accepted when the script's own signature matches.
|
|
|
|
## Evidence
|
|
|
|
- `node --test web/tests/unit/script-signature-negative.test.mjs` passed 2/2.
|
|
- `WEB_TEST_PORT=5522 npm --prefix web run test:script-signature-negative` passed unit 2/2 and
|
|
production Chromium Worker E2E 1/1.
|
|
- `node tools/web/check-script-signature-negative.mjs` passed:
|
|
`script-signature-negative-ok missing=SCRIPT_POLICY_DENIED expired=SCRIPT_POLICY_DENIED notYetValid=SCRIPT_POLICY_DENIED swapped=SCRIPT_SIGNATURE_INVALID next=M13-03A`.
|
|
- `npm --prefix web run typecheck`, `npm --prefix web run lint` and `git diff --check` passed.
|
|
|
|
## Artifact Hashes
|
|
|
|
- protocol: `6699fc0a19e0736823f164e707a420655803e36019cf0071f7ff9c760d25e9f2`
|
|
- worker: `49b289110a6533fcd1a29ad78be00792fd3c0d251c6027bae0440f5daba929a1`
|
|
- checker: `35f2e6727aef5e6ea2e2623e2effa6ea0356faaf66d417976db7f5bbe671a38c`
|
|
- unit: `8b9c8d63c97fce07299622b9ad261791a97bb91a6ed340e72c24c55e685978bd`
|
|
- e2e: `26c52ef67d6b1ea2994d92637826994e98e5234e042049f8d69a905f5cdb3309`
|
|
- report: `d23a2ae5613b2442ad79420aa344ebfe3767d10ac19b3ea30a62afcccd3a167c`
|
|
- manifest: `283673b21e6c9b89dc6ecb7007f3cecf28d53a84ec84f3f8b52373c055538a74`
|
|
|
|
## Next Task
|
|
|
|
`M13-03A`: sandbox capability scope with no DOM, host-worker, OPFS, IndexedDB or network access.
|
|
|
|
## Rollback
|
|
|
|
Remove the M13-02F negative-case worker, tests, checker, report, manifest, status entry and package
|
|
command; restore M13-02E as the queue tail and move `nextTask` back to `M13-02F`.
|