41 lines
1.7 KiB
Markdown
41 lines
1.7 KiB
Markdown
# M12-04A Status
|
|
|
|
status: done
|
|
task: library source schema accepts declared HTTPS origin, project asset, or user-selected file
|
|
updated: 2026-08-17 America/New_York
|
|
enablingTask: false
|
|
parityStateChange: false
|
|
|
|
## Scope
|
|
|
|
Schema-1 source admission accepts exactly three declared kinds: HTTPS URLs whose credential-free origin
|
|
is present in the policy, project-relative asset paths normalized by the existing project-path gate,
|
|
and user-selected files carrying a stable selection ID, safe file name, bounded byte length, and
|
|
source SHA-256. Accepted sources receive a canonical locator.
|
|
|
|
Undeclared origins, credentials, unsafe project paths, empty origin policy, malformed file identity,
|
|
and undeclared fields fail closed before any library load.
|
|
|
|
## Evidence
|
|
|
|
- `npm --prefix web run test:library-source-origin` passed 4/4 unit tests.
|
|
- Declared HTTPS, project asset, and user-selected file cases return `READY` with canonical locators.
|
|
- Undeclared HTTPS, credential-bearing URLs, traversal paths, empty policies, malformed selection IDs,
|
|
and undeclared fields return stable blocking errors.
|
|
|
|
## Artifact Hashes
|
|
|
|
- protocol: `67a1808f225194a09a72987c5340c7494c5fa8d99dffde40664a11a779caedeb`
|
|
- unit: `89b207c9cb13b4fb055a2dfed0237c0f8a00b13a39cc4175a378f5ef2abdb7ae`
|
|
- manifest: `af80827d925ddd96d8541e446e0f70c956fd4c56e64ac984d187f5449df4cb0d`
|
|
- package commands: `cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c`
|
|
|
|
## Next Task
|
|
|
|
`M12-04B`: normalize POSIX/Windows separators, `.`, `..`, percent encoding, and Unicode names.
|
|
|
|
## Rollback
|
|
|
|
Remove the source-origin protocol, unit suite, manifest, package command, and this status entry. Restore
|
|
M12-03N to pending and move the machine queue back to `M12-04A`. No parity ledger rollback is required.
|