Source: https://guthlabs.ai/docs/instruments/url-query-string-parser/implementation/

instrument implementation / implementation-contract

# URL / Query String Parser implementation

A source-bound implementation contract for URL / Query String Parser; deployment and executable qualification remain separate.

Status: **VERIFIED_CLEAN**Lifecycle: **implementation-contract**

## Binding contract

This record describes what an executable surface must bind and validate. It does not claim that a public calculator, package, or production route is deployed.

**Record owner**: Guth Instruments

**Lifecycle**: verified-clean

**Evidence ID**: t5-117

**Effect**: Computation or source lookup only

## Input and validation requirements

- No arithmetic or division-by-zero hazard exists because this instrument performs parsing rather than numerical calculation.

- Malformed percent escapes such as '%ZZ' or a trailing '%' must be rejected or reported explicitly; silently decoding them can corrupt data.

- Query parsing can cause security and interoperability problems if '+' handling, duplicate-key handling, empty values, or parameter ordering are inconsistent.

- Host parsing must define IPv6 bracket handling, internationalized domain names, userinfo, case normalization, and percent-encoding rules.

- A syntactically valid port may still be outside the implementation's supported numeric range or unusable by the network stack.

- The empty honest_label is a concern: the catalog entry should explicitly state that this is an RFC 3986 URI parser with an application-defined query-decoding policy, not imply universal URL validation.

## Required corrections

No binding erratum is attached to this unique-name record. Implementers must still preserve the declared units, domain, and failure behavior.

## Inspectable interface fixture

The sample below is evidence for interface and validation tests, not a production implementation.

````
{
  "inputs": {
    "url": "https://example.com:8443/a/b?x=1&name=Alice#section"
  },
  "expected_outputs": {
    "valid": true,
    "scheme": "https",
    "host": "example.com",
    "port": 8443,
    "path": "/a/b",
    "query": "x=1&name=Alice",
    "query_parameters": [
      {
        "key": "x",
        "value": "1"
      },
      {
        "key": "name",
        "value": "Alice"
      }
    ],
    "fragment": "section"
  },
  "working": "1. Identify scheme before ':': 'https'. 2. After '//', authority is 'example.com:8443'; host is 'example.com' and port is 8443. Decimal check: 8×1000 + 4×100 + 4×10 + 3 = 8443. 3. The text before '?' is path '/a/b'. 4. The query is 'x=1&name=Alice'; split at '&' into 'x=1' and 'name=Alice', then split each at '=' to obtain (x, 1) and (name, Alice). 5. The text after '#' is fragment 'section'."
}
````

## Other records

[01**Overview**](<https://guthlabs.ai/docs/instruments/url-query-string-parser/>)[02**Mechanism**](<https://guthlabs.ai/docs/instruments/url-query-string-parser/mechanism/>)[04**Qualification**](<https://guthlabs.ai/docs/instruments/url-query-string-parser/qualification/>)

## Sources and evidence

These pointers bind the page to evidence. They do not grant authority or collapse verification into deployment.

- `VERIFIED_LEDGER.json`

- `evidence-tranche5/tranche5-results.json`