M12-04A Status

status: done task: library source schema accepts declared HTTPS origin, project asset, or user-selected file updated: 2026-08-17 America/New_York enablingTask: false parityStateChange: false

Scope

Schema-1 source admission accepts exactly three declared kinds: HTTPS URLs whose credential-free origin is present in the policy, project-relative asset paths normalized by the existing project-path gate, and user-selected files carrying a stable selection ID, safe file name, bounded byte length, and source SHA-256. Accepted sources receive a canonical locator.

Undeclared origins, credentials, unsafe project paths, empty origin policy, malformed file identity, and undeclared fields fail closed before any library load.

Evidence

npm --prefix web run test:library-source-origin passed 4/4 unit tests.
Declared HTTPS, project asset, and user-selected file cases return READY with canonical locators.
Undeclared HTTPS, credential-bearing URLs, traversal paths, empty policies, malformed selection IDs, and undeclared fields return stable blocking errors.

Artifact Hashes

protocol: 67a1808f225194a09a72987c5340c7494c5fa8d99dffde40664a11a779caedeb
unit: 89b207c9cb13b4fb055a2dfed0237c0f8a00b13a39cc4175a378f5ef2abdb7ae
manifest: af80827d925ddd96d8541e446e0f70c956fd4c56e64ac984d187f5449df4cb0d
package commands: cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c

Next Task

M12-04B: normalize POSIX/Windows separators, ., .., percent encoding, and Unicode names.

Rollback

Remove the source-origin protocol, unit suite, manifest, package command, and this status entry. Restore M12-03N to pending and move the machine queue back to M12-04A. No parity ledger rollback is required.

1.7 KiB Raw Blame History