43 lines
1.9 KiB
Markdown
43 lines
1.9 KiB
Markdown
# M13-03A Status
|
|
|
|
status: done
|
|
task: sandbox capability scope
|
|
updated: 2026-08-18 America/New_York
|
|
enablingTask: false
|
|
parityStateChange: false
|
|
|
|
## Scope
|
|
|
|
The production scripting protocol now defines a versioned all-deny sandbox scope. DOM, host-worker,
|
|
OPFS, IndexedDB and network capabilities must each be explicitly `false`; any enabled, missing or
|
|
unknown scope version is rejected with a stable policy/protocol error. This is a capability contract
|
|
only: script execution remains disabled and no sandbox implementation is claimed.
|
|
|
|
## Evidence
|
|
|
|
- `node --test web/tests/unit/script-sandbox-scope.test.mjs` passed 2/2.
|
|
- `WEB_TEST_PORT=5523 npm --prefix web run test:script-sandbox-scope` passed unit 2/2 and
|
|
production Chromium Worker E2E 1/1.
|
|
- `node tools/web/check-script-sandbox-scope.mjs` passed:
|
|
`script-sandbox-scope-ok dom=SCRIPT_POLICY_DENIED hostWorker=SCRIPT_POLICY_DENIED opfs=SCRIPT_POLICY_DENIED indexedDB=SCRIPT_POLICY_DENIED network=SCRIPT_POLICY_DENIED execution=DISABLED next=M13-03B`.
|
|
- `npm --prefix web run typecheck`, `npm --prefix web run lint` and `git diff --check` passed.
|
|
|
|
## Artifact Hashes
|
|
|
|
- protocol: `6699fc0a19e0736823f164e707a420655803e36019cf0071f7ff9c760d25e9f2`
|
|
- worker: `27058fbb602791cbe6691fa14b3bc9c3d6cdea79641ba9c72fe18b6226d2a651`
|
|
- checker: `ad26ea3b078e480ba8f99cbf8dbd0d9b135c7605f4a3958d24845b7f5f8b0f43`
|
|
- unit: `a15da2e645d2d681c7e9ac1380f6b224d196d1d2e78d20f1bacad01e138753d4`
|
|
- e2e: `49930747e6663f79b61093706318b72e59388d79e3e1cc105bc1571693326667`
|
|
- report: `ba5784c751d5a347f38aa522ffcbed270d38fb474f0f10a2d06ea501d0234021`
|
|
- manifest: `76a7ce0fd3a38fb770c9cedccbd05ed566b931caa1782fdae898d3b66c3a20bf`
|
|
|
|
## Next Task
|
|
|
|
`M13-03B`: fixed CPU, wall-time, memory, message and output-byte budgets.
|
|
|
|
## Rollback
|
|
|
|
Remove the sandbox scope parser, focused worker/tests/checker, report, manifest, status entry and
|
|
package command; restore M13-02F as the queue tail and move `nextTask` back to `M13-03A`.
|