|
| 1 | +# Stack-Wide Single-Slash URI Scheme Policy |
| 2 | + |
| 3 | +## Goal |
| 4 | +Define and enforce one canonical URI scheme policy across the full Forge stack: |
| 5 | + |
| 6 | +- `res:/...` |
| 7 | +- `appRes:/...` |
| 8 | +- `user:/...` |
| 9 | + |
| 10 | +and reject double-slash variants in Forge-controlled URI parsing paths: |
| 11 | + |
| 12 | +- `res://...` |
| 13 | +- `appRes://...` |
| 14 | +- `user://...` |
| 15 | + |
| 16 | +## Why |
| 17 | +- Keep path syntax simple and consistent for users and AI-generated content. |
| 18 | +- Prevent ambiguity with network-like URL mental models. |
| 19 | +- Ensure deterministic path handling behavior across Runner, Designer, Poser, docs, and tooling. |
| 20 | + |
| 21 | +## Scope |
| 22 | +### Policy and specification |
| 23 | +- Document the canonical URI scheme policy in public docs and internal implementation notes. |
| 24 | +- Define normalization behavior for legacy content: |
| 25 | + - read/compat path may auto-normalize double-slash to single-slash where safe |
| 26 | + - write/output path must emit only single-slash canonical form |
| 27 | + |
| 28 | +### Runtime and tooling alignment |
| 29 | +- Audit and update URI/path resolvers in: |
| 30 | + - ForgeRunner runtime systems (SML/SMS/asset resolvers) |
| 31 | + - ForgeDesigner path and template outputs |
| 32 | + - ForgePoser path handling |
| 33 | + - related tools/scripts that generate or transform paths |
| 34 | +- Ensure diagnostics clearly explain invalid double-slash inputs when strict mode is enabled. |
| 35 | + |
| 36 | +### Migration and compatibility |
| 37 | +- Add an explicit migration note for existing projects using `://` forms. |
| 38 | +- Provide deterministic conversion rules with no traversal/security regression. |
| 39 | + |
| 40 | +## Non-Goals |
| 41 | +- No change to HTTP/HTTPS URL handling for network APIs that are not Forge URI schemes. |
| 42 | +- No relaxation of existing sandbox/root-jail security constraints. |
| 43 | + |
| 44 | +## Deliverables |
| 45 | +- Canonical policy doc updates (including SMS/SML-relevant docs). |
| 46 | +- Runtime and tooling updates to enforce single-slash canonical paths. |
| 47 | +- Test coverage for parse/normalize/reject behavior. |
| 48 | +- Migration note for existing `://`-based content. |
| 49 | + |
| 50 | +## Acceptance Criteria |
| 51 | +- All Forge-owned resource URI outputs are canonical single-slash (`res:/`, `appRes:/`, `user:/`). |
| 52 | +- No Forge-owned parser/resolver emits `res://`, `appRes://`, or `user://`. |
| 53 | +- Legacy double-slash inputs follow documented compatibility behavior and never bypass security checks. |
| 54 | +- Managed/native and editor/runtime path behavior are consistent for covered cases. |
| 55 | + |
| 56 | +## Dependencies |
| 57 | +- Depends on: |
| 58 | + - `CWUP/tasks/sms_language_spec_2026_native.md` |
0 commit comments