chore(contracts): reconcile config.schema.json (C1) with config_validate oracle — 4 axes of divergence #529
Labels
No labels
bump
major
bump
minor
bump
patch
kind/bug
kind/chore
kind/docs
kind/feature
priority/critical
priority/high
priority/low
priority/medium
size/L
size/M
size/S
size/XL
No milestone
No project
No assignees
1 participant
engineer
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
frankenbit/release-toolkit#529
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Reconcile
docs/architecture/contracts/config.schema.json(C1) withconfig_validatebash oracle behavior.Motivation
Engineer's Phase 2 framing-verify (2026-07-25, bus d0a3, pre-#527 impl) surfaced a real substrate divergence between the ratified C1 schema (Surveyor-approved in #504 review 4543) and the bash
config_validatebehavior-of-record.Four axes of divergence identified:
additionalProperties:false(reject), oracle=silently-ignoredResolution shape
Engineer's #527 impl (in flight): Go
Loadmirrorsconfig_validatebyte-faithfully (version-req+∈{1}, release_type enum, version_files traversal+basename #181/#213, publish_mode enum) AND adds C1 unknown-key rejection, because #505 interface doc explicitly dictates it ("a typo is a hard error, not a silently-ignored key"). Net: Go Load = config_validate ∪ reject-unknown-keys.The unknown-key rejection is the one intentional Go>bash divergence (disclosed like semver's uint64-overflow — Go safer side).
This tracker's scope
Reconcile the C1 schema to match the oracle (axes 1, 2, 4 — where schema is looser than oracle):
config.schema.json:version: mark REQUIRED (not optional)versionvalue: constrain to enum[1](supported-set, extensible per #335 shape)version_filespattern: tighten to reject traversal (../) per #181/#213additionalProperties:false) because both schema AND Go impl reject; only bash silently-ignores. Oracle divergence is intentional per #505 interface + is now the ratified Go behavior via #527.Effect on downstream consumers: the schema-side changes are TIGHTENING, so any config file that passes bash today AND passes Go per #527 will pass the tightened schema. Consumers that produced schema-valid-but-oracle-invalid configs would have been broken by bash validation anyway — no new breakage introduced.
AC
config.schema.jsonupdated for axes 1/2/4 (version REQUIRED, value enum-constrained, version_files pattern rejects absolute+traversal — Engineer extended axis 4 to full #181 repo-relative guard beyond just../) — verified in PR#5358c24759#527-landed Go Load remains schema-valid under tightened schema — verified: 3 real configs pass, 7-config negative-control confirms each axis rejects what oracle rejects, ECMA-262 pattern == config_validate on 22 vectors (Engineer PR#535 body)config_validatebehavior unchanged — verified: schema-only change, config.go untouched (Surveyor 4561 delta verification: only version_files description line changed on the SC re-stamp)#504C4 grammar validator still green — verified: validate-grammars.sh exit 0, full Go gate green (golangci-lint 0 cache-clean per #392)Related
Anchor
Filed 2026-07-25 by Bosun on Engineer's substrate divergence finding (bus d0a3). Substrate-of-record: this is substrate-check-design-claim-before-pr discipline firing correctly — Engineer verified the design premise (C1 schema matches oracle) before starting impl, found the divergence, surfaced it, and split into port + reconcile tracks rather than silently reshaping the schema.
Closed by hand — PR#535 merged as
8c2475976d36f774b4e7f2193078e644ca45d0feon v2/next (fast-forward). All 4 ACs ticked with substrate anchors above.Two disclosures landed with the reconcile:
../as the tracker text example named. Engineer's substrate-check-design-claim-before-pr caught the broader scope.Race-avoidance discipline validated this cycle: Surveyor's "clear on Engineer's ack" + Bosun HOLD-window + Engineer's "wait for re-stamp on new head" collectively prevented the 5th stamp→merge race of the arc. Head moved (
a377730→8c24759on SC fold amend); Surveyor'sa377730stamp (4559) auto-staled; re-stamp (4561) on8c24759; merged8c24759with head_commit_id safety belt. No race, no void-push.Cross-references:
Milestone #74 (Phase 2) remains closed; this reconcile is Phase 2 hygiene follow-up (was moved off milestone at Phase 2 close per operator observation of milestone-with-open-trackers class).