M12-04B Status

status: done task: normalize POSIX/Windows separators, dot segments, percent encoding, and Unicode names updated: 2026-08-17 America/New_York enablingTask: false parityStateChange: false

Scope

The shared project-asset path normalizer now emits one canonical /-separated path. It accepts equivalent POSIX/Windows separators, removes . segments, resolves bounded .. segments without allowing project-root escape, decodes percent-encoded UTF-8 once, and applies Unicode NFC normalization. Residual percent octets, malformed encoding, controls, absolute paths, URI schemes, and traversal beyond the project remain fail-closed.

Evidence

npm --prefix web run test:library-path-normalization passed 4/4 unit tests.
Separator and dot aliases converge to one idempotent canonical path.
Percent-encoded separators/dot segments and decomposed Unicode names match the canonical project asset locator used by the M12-04A source admission path.
Re-decoding, malformed percent encoding, and project-root escape return stable path errors.
npm --prefix web run typecheck passed after closing the prior library wrapper/parser type errors.

Artifact Hashes

parent manifest: af80827d925ddd96d8541e446e0f70c956fd4c56e64ac984d187f5449df4cb0d
normalizer: 6109d05251fc7355ac32d4c0d8298f85ea8b731767c76c394577c4e44652a6bf
source admission: 67a1808f225194a09a72987c5340c7494c5fa8d99dffde40664a11a779caedeb
unit: abde64c60397541e92a83dd9e4a24e65faf340a8d046650604c101a21037c777
manifest: 8cd29c3f5281082584fc6aefe2ec385a2eedf8116e837a4db54c391391ff8f98
package commands: cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c

Next Task

M12-04C: reject absolute paths, UNC, drive paths, NUL, control characters, and origin escape.

Rollback

Remove the path normalizer changes, unit suite, manifest, package command, and this status entry. Restore M12-04A to pending and move the machine queue back to M12-04B. No parity ledger rollback is required.

2.0 KiB Raw Blame History