currently the docs mostly state the following on naming:
The names are preferably in the form of CSDMS Standard Names.
However, this is a "preference". In some systems using BMI (for example remotebmi) things will completely break if users use characters which are not URL safe.
I would prefer it if the wording on (variable) naming was stronger; for example limiting it to alpha-numeric characters and underscores (A-z, 0-9, and _ ).