# M12-04C Status

status: done
task: reject absolute paths, UNC/drive paths, controls, and origin escape
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

## Scope

The project-asset path gate rejects absolute POSIX paths, UNC and drive-shaped paths, NUL/control
characters, malformed or residual percent encoding, and URI/origin-shaped escapes before a locator is
accepted. HTTPS source policy entries are now strict credential-free origins: path, query, fragment,
encoded controls, and backslash smuggling are rejected instead of being silently reduced to
`URL.origin`. HTTPS resource paths retain the declared-origin check and reject unsafe decoded bytes.

## Evidence

- `npm --prefix web run test:library-path-security` passed 4/4 unit tests.
- Absolute, UNC, drive, raw/encoded NUL and control characters, and origin-style project paths return
  stable `ASSET_PATH_OUTSIDE_PROJECT`/`ASSET_PATH_INVALID` errors.
- Raw and encoded backslashes, controls, malformed percent sequences, credentials, undeclared origins,
  and policy origin smuggling return `IO_EXTERNAL_URI_BLOCKED`.
- Declared `https://assets.example.test/library/main.blend` remains accepted; policy declarations with
  a path, query, fragment, encoded control, or duplicate canonical origin fail closed.
- `WEB_TEST_PORT=5323 npm --prefix web run test:asset-library` passed the N-023 Chromium asset/IO gate 1/1.
- `npm --prefix web run typecheck` passed.

## Artifact Hashes

- parent manifest: `8cd29c3f5281082584fc6aefe2ec385a2eedf8116e837a4db54c391391ff8f98`
- path normalizer: `6109d05251fc7355ac32d4c0d8298f85ea8b731767c76c394577c4e44652a6bf`
- source-origin protocol: `67a1808f225194a09a72987c5340c7494c5fa8d99dffde40664a11a779caedeb`
- unit: `ab302cacb24634a3225dda5cb8f5282cb80b3bd81ed5c8900ddf4ff18267b7e2`
- manifest: `a7f3a45eb7f68d022f38185a1c1409e1db1b27647fef587d66d2ffa52d78f98e`
- package commands: `cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c`

## Next Task

`M12-04D`: resolve symlink/hardlink entries before writing and constrain them to the temporary root.

## Rollback

Remove the C path-security assertions, manifest, status entry, and strict origin validation. Restore
M12-04B to pending and move the machine queue back to `M12-04C`. No parity ledger rollback is required.