M13-04B Status

status: done
task: server source read-only and output isolation
updated: 2026-08-19 America/New_York
enablingTask: false
parityStateChange: false

Scope

Each allocated server job now gets a source/ directory and a separate output/ directory. The source directory is 0555 and the staged .blend is 0444; a source overwrite fails with EACCES. The output directory is 0700 and accepts result bytes. Cleanup temporarily restores the source directory permission so the one-shot job directory can be removed without residue. This task does not claim OS/container CPU, memory or process limits.

Evidence

node --test web/tests/unit/server-job-isolation.test.mjs passed 3/3.
npm --prefix web run test:server-job-workspace passed unit 3/3 and the independent checker.
node tools/web/check-server-job-workspace.mjs passed: server-job-workspace-ok sourceDir=0555 sourceFile=0444 sourceWrite=EACCES outputDir=0700 outputWrite=OK distinct=1 residual=0 next=M13-04C.
npm --prefix web run typecheck, npm --prefix web run lint and git diff --check passed.

Artifact Hashes

protocol: 3aa5678a2c2769e4db5bb8f5c755b97e23045c4106e5636459748ab9b41929cd
checker: 9490c2eeb9980073fc1fe77fdba1fb6e4ef528de8eb666d9eaf1fb582ba658c2
unit: b1ac3324332180f7b3522f135520e7b5dace334dc461c92f2bce48fbcba2e147
package: 3df02b6049ac5d7185c23aef7764933ee460fedeb6595b3861272b0d49da5ecd
report: 650a643cc92617d068cb96d8bd4303429ef169ea89e3d4cb63e3ce5e2428e6d2
manifest: 9bc906b9e4c9751229f03271ef45a5925122b89b15bfe775591775f121ce1a4c

Next Task

M13-04C: enforce CPU, memory, process, file, wall-time and output budgets at the server boundary.

Rollback

Remove the workspace protocol additions, focused tests/checker, report, manifest, package command and this status entry; restore M13-04A as the queue tail and move nextTask back to M13-04B.

1.9 KiB Raw Blame History