43 lines
1.9 KiB
Markdown
43 lines
1.9 KiB
Markdown
# M13-02E Status
|
|
|
|
status: done
|
|
task: permission default-minimization and unknown-permission blocking
|
|
updated: 2026-08-18 America/New_York
|
|
enablingTask: false
|
|
parityStateChange: false
|
|
|
|
## Scope
|
|
|
|
`resolveScriptPermissions` now grants an empty set by default and only grants an explicitly
|
|
requested permission when it is already declared by the script manifest. Unknown, duplicate or
|
|
undeclared requests return `SCRIPT_POLICY_DENIED`; manifest declarations still reject unknown
|
|
permissions during parsing. This task adds no execution capability.
|
|
|
|
## Evidence
|
|
|
|
- `node --test web/tests/unit/script-permission-policy.test.mjs` passed 2/2.
|
|
- `WEB_TEST_PORT=5521 npm --prefix web run test:script-permission-policy` passed unit 2/2 and
|
|
production Chromium Worker E2E 1/1.
|
|
- `node tools/web/check-script-permission-policy.mjs` passed:
|
|
`script-permission-policy-ok defaultGranted=0 declared=READ_MAIN escalation=SCRIPT_POLICY_DENIED unknown=SCRIPT_POLICY_DENIED next=M13-02F`.
|
|
- `npm --prefix web run typecheck`, `npm --prefix web run lint` and `git diff --check` passed.
|
|
|
|
## Artifact Hashes
|
|
|
|
- protocol: `6699fc0a19e0736823f164e707a420655803e36019cf0071f7ff9c760d25e9f2`
|
|
- worker: `5df074e676542475009a4980fecaf3fdde009d149de84b9ca146647fb6aa1c02`
|
|
- checker: `169ab096295e08c5a630ef09d814da6ce742efd7a7143ff9a17984b4ca20593a`
|
|
- unit: `43bb6796616f3f92d71b51ef2a119a4e263864121a03356764e4b9c9241c4043`
|
|
- e2e: `dc13412a44f277bbe68315da0d38a2c4aa520d7489c81e7c908f9768c0547b7e`
|
|
- report: `8dc41e75620ba5bcb08d0edc52c3994e4f4dbc37ad3633757634bf10fe97b252`
|
|
- manifest: `691376d3cd33d3cd339b7195034abaf89cc02fba7e740c40ff051c4496400eef`
|
|
|
|
## Next Task
|
|
|
|
`M13-02F`: replay, key-confusion, expiry and multi-signature negative cases.
|
|
|
|
## Rollback
|
|
|
|
Remove `resolveScriptPermissions`, the focused worker/unit/E2E/checker, report, manifest, status
|
|
entry and package command; restore M13-02D as the queue tail and move `nextTask` back to `M13-02E`.
|