[Ancienttwo]

Closes #576.

Goal

Ledger read mode (ARCHCONTEXT_LEDGER_READ_MODE=ledger) validates a model the same way YAML validation does. This PR implements the joint decision in 576#issuecomment-6851382166. There is one model validator over a set of model files, and both read modes call it. The ledger validator is removed, not patched up to parity, and there is no compatibility path.

Change

• Shared validator: packages/local-runtime/model-store-yaml/src/index.ts adds validateModelFiles(files: ModelFile[]): ModelValidationResult. It holds the body of the former YamlModelStore.validateModel, moved out of the class with the same checks in the same order: required files, per-file node JSON schema, the schemaVersion checks, the flow version, runtime topology, state machines (including the state machines: a YAML file nested under state-machines/ is silently skipped by validate and the loader #571 state-machine-path-nested error), ADR appliesTo, dependency constraints, review policy, warnings and modelDigest.
  • YamlModelStore.validateModel(workspace) is now validateModelFiles(listModelFiles(workspace.root)).
  • Required files are checked by their presence in the file set. Before, the YAML store checked with readFileSync. listModelFiles includes .archcontext/manifest.yaml and .archcontext/product.yaml exactly when they exist as files, so YAML results do not change. The ledger validator already used the set check.
• Ledger read path: packages/local-runtime/runtime-daemon/src/index.ts, ArchitectureLedgerReadModelStore.validateModel, now returns { ...validateModelFiles(readback.files), architectureLedger: {…} }. readback.files is the ledger projection of nodes, relations and constraints, merged with the Git files the ledger does not own. This is the same file set as before.
• Removed: validateLedgerModelFiles, the ledger-only subset validator. Also removed: modelDigestForFiles, which repeated the validator's modelDigest calculation, and the four architecture-domain imports that only the removed validator used.
• One file order (round 2, R1 F1): validateModelFiles orders its own input with orderModelFiles (exported from model-store-yaml): by path, in UTF-16 code unit order. collectArchContextFiles uses the same comparator, compareModelPaths, so listModelFiles produces the same order as before (default .sort()). Error order and modelDigest therefore never depend on the caller. The ledger path used to sort its merged file set with localeCompare. That localeCompare sort is gone; the ledger path now calls orderModelFiles. It still sorts and is not just deleted, because loadModel returns the same list in ledger read mode (completeTask reads constraints and the review policy from it), and an unsorted list would leave loadModel ordered differently in the two modes.
• No ledger-specific check: validateLedgerModelFiles had no check that applied only to ledger files. Every check it ran is in the shared validator, so nothing is added on top of it.

Where the shared validator lives, and why

It lives in model-store-yaml, next to ModelFile:

• Both callers already import from model-store-yaml. runtime-daemon imports listModelFiles, YamlModelStore and type ModelFile from it.
• model-store-yaml already depends on every input the validator needs: the node schema JSON, runtimeTopologyModelIssues from contracts, architecture-domain and state-machine-engine.

A core home does not work. @archcontext/core/architecture-domain cannot host it, because state-machine-engine imports architecture-domain (parseJsonOrStableYaml) and the move would create an import cycle. No other core package owns ModelFile.

Refactor stated (owner's rule)

• The ledger read path now derives the schemaVersion of projected files with the shared extractSchemaVersion (newly exported from model-store-yaml). Its duplicated schemaVersionFromModelBody is deleted. The validator reads file.schemaVersion for the missing-version, flow-version and nested-path checks, so both modes must derive it the same way. On the canonical YAML that the projection emits, the two functions return the same value.
• validateModel moved out of the class into validateModelFiles. It was re-indented as part of the move. Its logic is unchanged.

Tests

• runtime-daemon/test/local-runtime.test.ts, new: "ledger read mode validates with the YAML validator: a rejected model fails the same way and a valid model passes (ledger read mode: validateModel has no parity with YAML validation (schemas, topology, state machines) #576)". It uses test.each, so each row fails on its own, with one row per branch:

  • a valid model (runtime topology plus a state machine);
  • a node schema violation ($.mount.target: required);
  • a topology error (target: topology-relation-target-kind-invalid);
  • a nested state machine (state-machine-path-nested);
  • two invalid files whose paths sort differently under the two comparators (sub/B.yaml, sub/a.yaml). The expected order is B before a in both modes. On the round-1 head this row fails: ledger mode returned a before B.

  For each row, the test first validates with YamlModelStore and asserts the expected errors. It then builds the ledger state from those files with planYamlToArchitectureLedgerImport and deletes nodes/ and relations/ from Git, so the ledger is their only source. Next it validates through a ledger-authoritative daemon and asserts readAuthority: "ledger", the entity count, and { valid, errors } equal to the YAML result. It also asserts that each mode's modelDigest is the digest of its own file set in path order. The test oracle builds that order with a default .sort() on the paths, not with orderModelFiles. The two modes have different digests by design, because their per-file digests come from different bodies; the existing test "ledger-authoritative runtime read surfaces …" asserts that they differ. Against the origin/main source, the schema-violation row fails: its ledger result is valid: true, errors: [].

• model-store-yaml/test/validate-model.test.ts, new: validateModelFiles gets the same files in reverse localeCompare order and returns an identical result: the same errors, in the same order (nodes/B.yaml first), and the same modelDigest. On the round-1 head this test fails.

• model-store-yaml/test/validate-model.test.ts, new: required-files branch. A model without product.yaml fails with missing .archcontext/product.yaml and a missing-file diagnostic. This branch had no YAML-level test before.

• Changed existing test: runtime-daemon/test/ledger-layer-validation.test.ts.

  • It now imports validateModelFiles, because validateLedgerModelFiles is deleted.
  • Its fixture node was { schemaVersion, id, layer }, which fails the node schema. The old ledger validator did not check the node schema; that gap is this issue's defect. The fixture now carries the required kind, name, status and summary.
  • The test title says "model validation of ledger files".
  • The assertions are unchanged, apart from a non-null ! on the now-optional layerOrderErrors.

Verification

Head 5c3670ae1054f2ecadf3b8c0334d6ab5768bbdb7 (round 2), macOS (darwin arm64), bun 1.4.3:

Command	Result	Time
bun run typecheck	exit 0	<1s
bun test packages/local-runtime/model-store-yaml packages/core/changeset-engine packages/core/context-compiler	252 pass, 0 fail (changeset-engine and context-compiler consume validateModel)	29s
bun test packages/local-runtime/runtime-daemon	855 pass, 1 skip, 0 fail (856 tests)	385s
bun test tests/	4 pass, 0 fail	55s

Test budget (git diff --numstat origin/main...HEAD): test +115/−8, product +99/−139, no new test file. The product count includes the moved, re-indented validator body.

• New: a 5-row test.each parity test (about 0.9s in total) and 2 single tests.
• Changed: 1 existing test.

Architecture slice unchanged, see #576. No .archcontext/model/** or capability entrypoint changes.

Risk

• In ledger read mode, a ledger state that was accepted before now fails validation if its projected nodes or relations break the node schema or a topology rule, or if a Git-side state-machine file is invalid. This is the intended change. ledger is not the default read authority in 0.14.x, because YAML is the only authority.
• Ledger validation results can now include nodeSchemaErrors. The YAML results already did. changeSetBaseModelBlockingErrors consumes this field the same way in both modes.

Rollback

Revert this PR. The change touches no stored data and no schema.

Out of scope (possible follow-ups)

• runtime-daemon/src/index.ts has unused imports that existed before this PR (errorEnvelope, auditConsentRequiredEnvelope). They were left as they are.

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-13T12:49:40.205345Z We couldn’t complete this review. Comment @codex review to try again.	22ce466	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[Ancienttwo]

repo-harness acceptance claim
Role: acceptor
Round: 1
Subject: 22ce466
Tier: high
Agent: codex (gpt-6.1-terra), read-only

[Ancienttwo]

repo-harness acceptance review
Round: 1
Subject: 22ce466
Tier: high
Verdict: FAIL
Reviewer: codex (gpt-6.1-terra)
Model relation: different-family

Cross-family review (Codex CLI, read-only). Both read paths call the single validateModelFiles validator; the old ledger subset validator and duplicate schema-version parser are removed; the moved YAML checks keep their sequence. The two callers order files differently, so ledger and YAML can report the same failures in a different order. The PR omits the added-line test budget counts.

NITs

• F2: PR body omits the added-line counts: 85 test, 86 product, no new test file; within the caps.

Findings outside the diff

• P2 F1 at packages/local-runtime/runtime-daemon/src/index.ts:244: Ledger files sort with localeCompare, YAML files with default sort (model-store-yaml/src/index.ts:447); B.yaml precedes a.yaml in YAML order and follows it in ledger order. The shared validator appends errors in input order, so multiple invalid files can produce a different first error and differently ordered error arrays. -> Use the same path ordering in both paths and cover multiple invalid files in the parity test.

[Ancienttwo]

repo-harness acceptance record
Claim: #593 (comment)

Round	Role	Subject	Verdict
1	codex (gpt-6.1-terra), read-only	22ce4661b1c79d6012a22625a24c32eb90b4b81f	FAIL: 1 P2, 1 P3

Model relation: different-family

Findings:

• P2 F1 at packages/local-runtime/runtime-daemon/src/index.ts:244: Ledger files sort with localeCompare, YAML files with default sort (model-store-yaml/src/index.ts:447); B.yaml precedes a.yaml in YAML order and follows it in ledger order. The shared validator appends errors in input order, so multiple invalid files can produce a different first error and differently ordered error arrays. -> Use the same path ordering in both paths and cover multiple invalid files in the parity test.
• P3 F2: PR body omits the added-line counts: 85 test, 86 product, no new test file; within the caps.

[Ancienttwo]

repo-harness acceptance claim
Role: acceptor
Round: 1
Subject: 22ce466
Tier: high
Agent: pi (claude-opus-5-5), read-only

[Ancienttwo]

repo-harness acceptance review
Round: 1
Subject: 22ce466
Tier: high
Verdict: PASS
Reviewer: pi (claude-opus-5-5)
Model relation: same-family

Fresh-context Opus review (Pi seat, magpie). One validator, validateModelFiles in model-store-yaml, called by YamlModelStore.validateModel and ArchitectureLedgerReadModelStore.validateModel; validateLedgerModelFiles, modelDigestForFiles and schemaVersionFromModelBody are deleted with no references left; no compatibility path. git diff -w shows the old validateModel body moved unchanged except an equivalent required-files membership check. Ran the PR's daemon test against origin/main: schema, topology and nested state-machine rows all returned valid in ledger mode, so the tests are real. typecheck pass; validate-model + ledger-layer-validation 44 pass; local-runtime -t ledger 9 pass.

NITs

• F1: runtime-daemon index.ts:244 sorts with localeCompare while listModelFiles uses default sort; confirmed orders differ ([x/B,x/a,x/a1,x/a_b] vs [x/a_b,x/a,x/a1,x/B]), so error order and modelDigest can differ between modes. Pre-existing; use one comparator and add a two-error row whose paths sort differently.
• F2: local-runtime.test.ts:2333 table-driven test stops at the first failing row; optional test.each so each row fails on its own.

[Ancienttwo]

repo-harness acceptance record
Claim: #593 (comment)

Round	Role	Subject	Verdict
1	pi (claude-opus-5-5), read-only	22ce4661b1c79d6012a22625a24c32eb90b4b81f	PASS: 2 P3

Model relation: same-family

Findings:

• P3 F1: runtime-daemon index.ts:244 sorts with localeCompare while listModelFiles uses default sort; confirmed orders differ ([x/B,x/a,x/a1,x/a_b] vs [x/a_b,x/a,x/a1,x/B]), so error order and modelDigest can differ between modes. Pre-existing; use one comparator and add a two-error row whose paths sort differently.
• P3 F2: local-runtime.test.ts:2333 table-driven test stops at the first failing row; optional test.each so each row fails on its own.

[Ancienttwo]

Round 1 fixes are in 5c3670a.

• GPT P2 F1 and Opus F1 (file order): validateModelFiles now orders its own input with orderModelFiles, by path in code unit order. listModelFiles uses the same comparator. The ledger path's localeCompare sort is replaced by orderModelFiles. It still sorts, because loadModel returns that list in ledger mode. Siblings: ledger validateModel and loadModel, and the YAML listModelFiles order. New tests: a parity row with sub/B.yaml and sub/a.yaml that asserts the same error order in both modes and that each mode's modelDigest is computed in path order, plus a validator unit test showing that reversed localeCompare input gives an identical result. Both fail on the round-1 head.
• Opus F2: the parity table now runs with test.each, so each row fails on its own.
• GPT P3 F2: the line counts are in the PR body.

[Ancienttwo]

repo-harness acceptance claim
Role: acceptor
Round: 2
Subject: 5c3670a
Tier: high
Agent: codex (gpt-6.1-terra), read-only

[Ancienttwo]

repo-harness acceptance review
Round: 2
Subject: 5c3670a
Tier: high
Verdict: FAIL
Reviewer: codex (gpt-6.1-terra)
Model relation: different-family

Cross-family review (Codex CLI, read-only) of the round-2 delta. The validator owns the file order and the parity table gains a two-file row; the budget matches (115 test / 99 product, no new file); prior assertions are intact. The daemon parity test checks each mode's modelDigest against its own file set rather than asserting equality between modes.

NITs

• F2: runtime-daemon index.ts:245 loadLedgerModel still calls orderModelFiles; validateModelFiles sorts again. Keep ordering for loadModel where needed and let the validator own validation order.

[Ancienttwo]

repo-harness acceptance record
Claim: #593 (comment)

Round	Role	Subject	Verdict
2	codex (gpt-6.1-terra), read-only	5c3670ae1054f2ecadf3b8c0334d6ab5768bbdb7	FAIL: 1 P2, 1 P3

Model relation: different-family

Findings:

• P2 F1 at packages/local-runtime/runtime-daemon/test/local-runtime.test.ts:2392: The parity test compares error arrays but checks each modelDigest against a separate file set; equal-input digest parity between modes is not asserted. -> Add a parity case where YAML and ledger read the same paths and bodies and assert equal modelDigest.
• P3 F2: runtime-daemon index.ts:245 loadLedgerModel still calls orderModelFiles; validateModelFiles sorts again. Keep ordering for loadModel where needed and let the validator own validation order.

[Ancienttwo]

repo-harness acceptance claim
Role: acceptor
Round: 2
Subject: 5c3670a
Tier: high
Agent: pi (claude-opus-5-5), read-only

[Ancienttwo]

repo-harness acceptance review
Round: 2
Subject: 5c3670a
Tier: high
Verdict: PASS
Reviewer: pi (claude-opus-5-5)
Model relation: same-family

Fresh-context Opus review (Pi seat, magpie) of the round-2 delta. validateModelFiles starts with orderModelFiles (compareModelPaths, identical to default string sort), so YAML error order and modelDigest are unchanged for existing repositories. loadLedgerModel keeps orderModelFiles because completeTask reads loadModel's list in ledger mode, justified in the PR body; localeCompare is gone. Cross-mode digest equality is not a property of the design (ledger hashes canonical projected YAML, YAML hashes disk bodies); instead each mode's digest is checked against its own set in default order, and a unit test proves validateModelFiles is input-order independent (same errors, order and modelDigest for reverse-localeCompare input). test.each adopted; budget matches numstat. typecheck pass; 45 + 13 pass; parity row 5 and the order unit test fail on 22ce466, so the tests are real.

NITs

• R2-F1: local-runtime.test.ts:2394 digest oracle builds ledgerSet from all listModelFiles(root) plus projected files, while the real ledger path removes ledger-managed Git paths first; correct for this fixture, optionally filter to mirror isArchitectureLedgerManagedModelPath.

[Ancienttwo]

repo-harness acceptance record
Claim: #593 (comment)

Round	Role	Subject	Verdict
2	pi (claude-opus-5-5), read-only	5c3670ae1054f2ecadf3b8c0334d6ab5768bbdb7	PASS: 1 P3

Model relation: same-family

Findings:

• P3 R2-F1: local-runtime.test.ts:2394 digest oracle builds ledgerSet from all listModelFiles(root) plus projected files, while the real ledger path removes ledger-managed Git paths first; correct for this fixture, optionally filter to mirror isArchitectureLedgerManagedModelPath.

[Ancienttwo]

repo-harness acceptance claim
Role: acceptor
Round: 3
Subject: 5c3670a
Tier: high
Agent: codex (gpt-6.1-terra), read-only

[Ancienttwo]

repo-harness acceptance review
Round: 3
Subject: 5c3670a
Tier: high
Verdict: PASS
Reviewer: codex (gpt-6.1-terra)
Model relation: different-family

Follow-up on the same head after the head owner's decline of round-2 F1, with no code change. The shared validator test feeds the same files in different orders and compares the full result, errors and modelDigest included; the daemon test checks each mode's digest against its own file set in default path order. Together they verify the ordering requirement without asserting equal digests for different file bodies, so F1 is resolved.

NITs

• F2: runtime-daemon index.ts:245 loadLedgerModel still calls orderModelFiles while validateModelFiles sorts again; loadModel keeps its ordered output by design.

[Ancienttwo]

repo-harness acceptance record
Claim: #593 (comment)

Round	Role	Subject	Verdict
3	codex (gpt-6.1-terra), read-only	5c3670ae1054f2ecadf3b8c0334d6ab5768bbdb7	PASS: 1 P3

Model relation: different-family

Findings:

• P3 F2: runtime-daemon index.ts:245 loadLedgerModel still calls orderModelFiles while validateModelFiles sorts again; loadModel keeps its ordered output by design.

[Ancienttwo]

repo-harness integration status
Re: orchestrator t7 merge-only sync request (main frozen until #591; #591 merged)
Head: 82310e8, parents 5c3670a + main e41f70f
Delta: none beyond main (12 release files from 0.14.1; no overlap with the 5 files in this PR); git merge --no-edit, no conflict, no other change
Checks: none run locally on the merge (merge-only sync as requested); CI pending
Review: delta check for the new head per acceptor.md §2.2 (merge-only, no PR-file changes)

[Ancienttwo]

Merge-only sync: 82310e8 has parents 5c3670a (the reviewed head) and e41f70f (main after #591). git diff $(git merge-tree --write-tree 5c3670ae e41f70fe) 82310e8a is empty, so the head adds nothing beyond the clean merge. The round-2 Opus PASS and round-3 GPT PASS on 5c3670a carry over to this head. It merges when the required CI is green.

Seat: orchestrator t7

[Ancienttwo]

The chatgpt-codex-connector review summary is for the earlier commit 22ce466. Its follow-up reports the Codex usage limit, so it raised no finding on the current head. The required reviews come from the GPT and Opus receipts above.

Seat: orchestrator t7