Repository navigation
Schemas: the Role manifest, the pass record, the feed, and one envelope for all (#28) - #214
Merged
Merged
Conversation
…tcome, and one envelope for all (#28) Each schema is in one class, held in ENVELOPE in tools/check_examples.py: a document carries schema, its identity and release; a record or a data file schema alone; a part nothing. config and hooks gain schema, with their files. Eight schemas: pass/1 (what replay needs, built by calling the Kernel for its example), view-meta/1, view-items/1 and view-item (the feed, its one text the title under untrusted, never in the facts), applied/1 and outcome/1 (a Run's artifacts), role/1 (the manifest of section 3.11) and feed/1 (config/feed.json: who acts next and what is asked, from a Decision's codes, held to the Kernel's needs_you reasons). Seven tests, five mutants, decision record 0039 (provisional number), rows in schemas/ and config/, and the design's sections 3.1, 3.4, 3.7, 3.10 and 8.4. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…nvelope reads types, and the exemptions are confined (#28) One fix round from the reviews. config/feed.json joins the protected paths, as every file in config/ is, so a change to it is reviewed by every model Lens. A run record's run, Role and Intent are codes, and run-record joins CODES_ONLY, so a pass record is walked through it. A body is one string, and only the feed marks text untrusted: an object of strings under either name in a Task is caught. A part carries no release; a document's identity and release are strings. The table check refuses a State or an outcome ruled twice, and the feed test holds the table's rules to the design's. The manifest's categories have a test and a mutant. The replay test minted a Run for every act; an approval is the one act that is a Run. config/hooks.json keeps its formatting. The design's Decision and Finding examples validate. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 38 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Oct 19, 2026
This was referenced Oct 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Slice 0's exit asks for an example of every schema slice 1 uses. After #210 the pass record, the feed, a Run's
applied.jsonandoutcome.json, and the Role manifest had none, and §3.1's envelope rule, "every message carriesschema, an identifier and therelease", reached too far to hold as written. The working rulings on the issue, with the Maintainer's two answers folded in (applied.jsonandoutcome.jsonare this story's fourth criterion; the feed carries the title, the next actor and the decision required), are the spec.What is decided
One envelope, on what crosses a boundary whole (decision record 0039, provisional number). Each schema is in one class, held by
ENVELOPEintools/check_examples.py:schema, its identity,releasetask,result,applied,outcome(run);pass,view-meta,view-items(pass)schemafacts,issue-facts,decision,issue-decision,findingeffect,disposition,coverage,run-name,run-record,view-itemschemaconfig,hooks,lifecycle,authority,apps,rubric,acceptance,trial,role,feedconfigandhooksgainschema, and so doconfig/defaults.json,config/hooks.jsonand their counter-examples. Every reader of those files reads by key and ignores it.What each schema holds, and what may not be written
pass/1now, the whole context (every key, always), every run record, each read'sdateandage, and per item its facts, Decision and the minted Run id. Its example is built by calling the Kernel and replays with the repo's own data filesview-meta/1,view-items/1,view-itemnext_actor,decision_required, age, attempts, runs, cost, sources, url, and the title underuntrusteduntrusted; a choice no person can makefeed/1,config/feed.jsonneeds_youreason, aquestionandchoicesas codesneeds_you, a reason twice, an attention class with no rule or two (_table)applied/1,outcome/1applymet, with its state, the node id read back and a reason code, and each posted Finding'sfinding/1; how a Run ended, in the run record's codesrole/1CODES_ONLYgains the new kinds andcoverage; its one exemption,body, gainsuntrusted. The walk no longer follows a reference into a kind outside the set: the existing records are held by their own rules and are not swept here.tools/check_authority.pyholds what a manifest owns, shadows and raises tofinding/1's categories.Where the rulings and the design differed, and the closed forms taken
id(the Decision) and norelease(both): §3.4 and §3.7 amended.config/defaults.jsonand Lifecycles, so its issue isnot_served(issues are not served there); the pull request is admitted with its Run id.attemptsis a list of{intent, count}, not an object keyed by Intent: the validator cannot constrain a key.next_actorlives infeed.schema.json#/$defs/actor, andview-itemreferences it;by_outcomeis its own list inconfig/feed.json.paused,pause_unreadableandunmerged_closesreasons are shown to need a person by the table test itself, beside the existing Kernel tests the check names.Reviews
A fresh-context Claude review, a security pass (subagents) and Muse Wonder Full read the first head, 5109ac7; the Kernel and the simulator are untouched, so AGY was not run. Every finding was verified and folded into one fix round, 6fae96f:
config/feed.jsonmatched no protected path, so a model-review-exempt change could rewrite what the Maintainer is asked (Muse's major; the security pass noted it). It joins the protected paths inconfig/hooks.json, as every other file inconfig/does.run-record, so a pass record'srun,roleandintentwere free strings (Muse's second major, the security pass's low). A run record holds codes now and joinsCODES_ONLY.finding/1, whichapplied/1carries, is the Factory's own record and stays as decision 0038 left it; the schema titles and the record now say so instead of claiming no text.untrustedexemption applied to any schema, andbodyexempted an object of strings (Claude). Only the feed marks text untrusted, and a body is one string; both have a test and a mutant.release; a document's identity and release were not held to be strings (Claude, Muse, security). Both held, with mutants.tools/check_authority.pyhad no test and no mutant (Claude, Muse). Added.config/hooks.jsonhad been reformatted whole; it keeps its formatting with the one key added (Claude). The design's Decision and Finding examples validate against their schemas now (Claude).Each of the twelve new mutants was applied by hand to a scratch copy and its named test seen to fail; CI's shards are the final word. Not taken, and recorded as waiting on
roles/orcontroller/: an owner with no App or an author that owns a category (the manifest's cross-field rules), a feed item whoseurlis not its item's, and anevidencealphabet beyond no-whitespace.Verify
make verifypassed on a freshgit archiveexport withPATH=/usr/bin:/bin SIM_SEEDS=40at 6fae96f. (At 5109ac7 two timing tests of the identity hook ran over their 5-second bound while three reviews ran on the same machine; both pass alone and on the idle rerun.)Closes #28
🤖 Generated with Claude Code