feat(schema): SEAM 6 — the autonomy datum, device {none|ro|rw} in the warrant-bounds schema (#703) - #706
Merged
Conversation
…warrant bounds, rejection pinned (#703) SEAM 6, amicode's half of the one-autonomy-doctrine (codesign spec spec-20260831-120000, issue #703): - $defs.bounds.device — the enum {none, ro, rw} — now carries the datum's documented semantics: none = no device access; ro = read-only device access; rw = device writes permitted, gated by the real-board-session human gate. The approval branch's description points at the datum (one definition, this schema — the fleet §2.1 pointer formalized). - The three-systems contract stated once in the schema's documentation, each counterpart's criterion NAMED under its own owner: amicode's bounds (this schema), the P4 gate's end-to-end read (merge-gated on strumento #75 MERGED), Telaio's warrant-bounds deserialization conformance (their campaign). The SEAM 4 contract note is not on main yet — the director wires the cross-reference line post-merge. - Rejection tests pin the no-second-knob doctrine mechanically: validateBounds REFUSES any device value outside the enum and any unknown device-permission-shaped field (additionalProperties:false), field-precise errors naming the impostor key; the approval record kind refuses a second device knob the same way.
…ma's device datum (#703) SEAM 6's tool-surface half (issue #703) — one definition, no free text: - amicode_request_approval's bounds arg now cites the @amicode/schema warrant-bounds schema ($defs.bounds — the one definition) and its execute() validates bounds via validateBounds: a device value outside {none, ro, rw} or a second device-shaped field is refused BEFORE the card renders, so a malformed ask can never become a pressable button. - The plugin twin (retired from the config, still drift-guarded by the projection test) mirrors the same gate: opencode-plugin/warrant_bounds.ts is the dependency-free twin of $defs.bounds (bare package specifiers do not resolve in the plugin runtime — unreachable by construction, per ./ledger_client's sibling-module rules), PINNED to the schema by test/warrant_bounds_parity.test.ts: the corpus (every datum case) must agree with validateBounds on ok AND error strings, and DEVICE_DATUM must equal the schema's own device enum — growth breaks the pin. - The mint path (amicode_service/warrants.ts approveArgv) validates bounds against the schema too, refusing invalid bounds instead of silently dropping them — a dropped key silently under-authorises the minted warrant; test/amicode_service_warrants.test.ts is the flag-mapping pin the export always promised, plus the refusal cases. The three-systems contract line for the PR (the director's): amicode's bounds are this slice (the schema datum, above); the P4 gate's end-to-end read is merge-gated on strumento #75 MERGED; Telaio's warrant-bounds deserialization conformance is their campaign's criterion — each named under its own owner, none claimed as another's.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #703. Part of #679 (the codesign PRD). The one-autonomy-doctrine amicode half: device formalized as the enum {none, ro, rw} in the warrant-bounds schema — one definition, documented semantics (none = no device access; ro = read-only; rw = writes permitted, gated by the real-board-session human gate), the three-systems contract stated with counterpart criteria named under their owners (the P4 gate end-to-end read merge-gated on strumento #75 MERGED; Telaio conformance theirs). The no-second-knob test is schema-mechanical: the enum refuses any value outside it, additionalProperties:false refuses ANY unknown key with field-precise errors naming the impostor — and the refusal now holds at BOTH amicode entry surfaces: the approval card (validateBounds before the card renders — a malformed ask can never become a pressable button) and the mint path (invalid bounds refused, never silently dropped — a dropped key silently under-authorises a minted warrant). The plugin twin (dependency-free in the embedded Bun) is pinned by parity tests (corpus agreement + DEVICE_DATUM == the schema enum). The SEAM 4 contract note (PR follows) cross-references the datum from its side. Director gates: schema 213 passed (+8), extension +13 new tests with the 3 documented pre-existing env failures, typecheck clean.