jason.woltje
8ebddd6f93
Rocko-authored, Filbert-reviewed inspector (r6 manifest a4a44930...) with full review/build/verdict evidence under docs/plans/reviews. 43/0 selftests, oracle zero-disagreement, foundation checker PASS. Owner A9 acceptance recorded separately.
85 lines
5.2 KiB
Markdown
85 lines
5.2 KiB
Markdown
# FI-C2-1 — proposed schema/profile clarification
|
|
|
|
Author: darkwing. Status: frozen proposal for independent review, not yet approved
|
|
or authority to edit code. Scope: resolve FI-ROCKO-4 C2 without a mismatch waiver or
|
|
weaker CLI admission. No live permissions, new dependencies or source-schema changes.
|
|
|
|
## Bound context
|
|
|
|
Charter candidate 3 SHA-256:
|
|
19b6721128a627a2032ffdb95ece2d50abe69a8f6d521e9eff8bbdaff22798b6.
|
|
Pinned schema/checker baseline: d4696d09eb1b5dcf1028f30db2cd63735f51cb16.
|
|
Rocko r2 report SHA-256:
|
|
0dabd82fffdc3a56ebf9a1d8b851832c3acee2cb9332892bde9dbb13151d5e19.
|
|
Frozen r2 manifest SHA-256:
|
|
2e8b5f1998a3be6cc7fcc3fba308724d2a29ca166c08f005e1bca88ddbc14196.
|
|
The coordinator verified all 239 file identities/modes/sizes, aggregates and pinned
|
|
inputs. This establishes the candidate identity, not functional acceptance.
|
|
|
|
## Problem
|
|
|
|
Python re's end anchor permits matching immediately before a final LF; the
|
|
inspector's ECMAScript patterns reject it. Four shape-oracle cases therefore
|
|
currently disagree. The earlier waiver was removed and the gate correctly fails.
|
|
The choice is not limited to permitting unsafe identifiers or waiving disagreements:
|
|
the charter already distinguishes schema-only verdicts from strict input profiles.
|
|
|
|
## Proposed normative clarification
|
|
|
|
1. Keep the pinned Python/jsonschema oracle and schema/checker bytes unchanged.
|
|
The Node schema-only validator must reproduce the pinned shape verdict,
|
|
including its pattern semantics. Every schema-column disagreement still fails;
|
|
no named exceptions, suppressed mutations or green artifact-difference class.
|
|
2. Define an explicit stricter inspector profile for values using candidate
|
|
$defs/id, $defs/runtimeId and $defs/digest: the entire string must satisfy the
|
|
declared grammar under strict end-of-string semantics. A final LF must fail the
|
|
profile even if the schema-only oracle accepts it. This covers all occurrences
|
|
of those types, including scopes, actors, record/registry/artifact references,
|
|
authorizations and simulation wrapper fields—not merely the four current probes.
|
|
3. Preserve the original value throughout both checks. Do not trim, normalize,
|
|
silently substitute or create an identity index from a newline-stripped value.
|
|
No schema-only pass can bypass the profile before graph/admission evaluation.
|
|
4. A well-decoded, schema-valid but profile-invalid value returns process exit 2,
|
|
invalid-request, a fixed documented profile-pattern-mismatch rule, and safe
|
|
pre-admission output. No newline-bearing identifier/authority/digest reaches
|
|
a permitted preview. Existing closed output fields/disclaimers remain unchanged.
|
|
5. The test bridge exposes schema and profile verdicts independently. For the four
|
|
reported cases: Python schema true, Node schema true, inspector profile false,
|
|
actual CLI refusal. These are schema AGREEMENTS plus tested profile refusals,
|
|
not allowed schema disagreements under another label. Other stricter documented
|
|
lexical/byte/Unicode profile rules retain their separate expected columns.
|
|
6. Implement schema-pattern compatibility as real bounded validator behavior, not
|
|
case-name/path whitelisting or a harness-only answer adjustment. A copied oracle
|
|
answer is not an independent Node shape verdict. The production admission path
|
|
must actually enforce the profile, not rely on a test-only wrapper to reject it.
|
|
|
|
This clarification changes validation-layer classification, not the CLI's accepted
|
|
identity grammar. It does not introduce a broader accepted record profile, change
|
|
a runtime policy, or require Jason to adjudicate regex dialect details. Independent
|
|
review must confirm that this remains within the authorized offline build scope.
|
|
|
|
## Required evidence
|
|
|
|
- Preserve all four existing disagreement witnesses; do not delete/rename them out
|
|
of coverage. Test valid values, one/two final LF, CRLF, interior LF and relevant
|
|
Unicode line separators across every affected type family, with independent
|
|
expected shape/profile/CLI outcomes. Do not assume all separators share semantics.
|
|
- Include both records and wrapper/reference inventories, including unselected
|
|
records and declared inputs. Reject before identity lookup or permission result;
|
|
tests must distinguish profile refusal from a later missing-reference mismatch.
|
|
- Ordinary free-form text that legitimately permits escaped newlines must not be
|
|
blanket-rejected by this targeted identifier profile. Path/time custom formats
|
|
keep their existing semantics and separate tests.
|
|
- Differential oracle has zero unapproved schema disagreements; strict-only/profile
|
|
refusals are visibly counted and asserted. All other mandatory tests remain green.
|
|
- No normalization, extra output fields, dependency install, modified pinned inputs
|
|
or exceptions to required gates. Retain actual toolchain/platform receipts.
|
|
|
|
## Gate
|
|
|
|
Filbert reviews this exact proposal as a non-author. Rocko keeps code frozen pending
|
|
that verdict and coordinator instruction. If approved, record it as an explicit
|
|
addendum to the unchanged charter, update bound test identities deliberately, then
|
|
implement only within existing source/test paths and return a new frozen candidate.
|
|
Full independent CODE review and Jason's demo remain subsequent separate gates.
|