feat(schema-identity): fix the D1.3 schema_digest and schema_name contracts (#63)

conformance/differential/README.md

@@ -45,6 +45,8 @@ differential/
   verdict/       -- the assembled five-field verdict artifact (build_verdict / verdict.Build)
                     vcn_*: the OCI VCN slice, derived from ../../fixtures/vcn-v1 (see docs/INTEGRATION-CONTRACT.md)
   receipt/       -- the receipt verifier (verify_receipt / receipt.Verify)
+  schema_identity/ -- the D1.3 schema identity contract (bind_schema_identity / schemaidentity.BindSchemaIdentity);
+                    a vector also holds the real bytes of a schema source file (see below)
 ```
 
 One group per primitive, landed incrementally — matching how F6
@@ -246,3 +248,23 @@ verifier to reject it.
 
 Documents are decoded so an integer stays an integer and `1.0` stays a float
 (Go: `Decoder.UseNumber`), because the receipt's version is a bare integer.
+
+### `schema_identity/`
+
+A vector directory holds `input.json`, `expected.json` and the schema source file that `input.json` names. The source file is **not JSON**: its exact bytes are the thing under test (line endings, a final newline or none), so `schema_identity/.gitattributes` marks `*.yaml` as `-text` and git leaves them alone.
+
+```text
+input.json:
+  source                string        file name of the schema source in this directory
+  claimed_digest        string|null   the digest claimed for the source (null = no claim)
+  namespace, kind       string|null   spec.identity components (null = absent)
+  identity_from_source  bool?         the Rust test checks namespace/kind against the file's own spec.identity
+
+expected.json:
+  accepted              bool
+  schema_name, schema_digest          when accepted
+  error: {code, rule, path}           when rejected
+  why                   string        context, not compared
+```
+
+Both languages must accept or reject identically and name the same code, rule and path. Contract: `docs/RECEIPT-SCHEMA.md`, "Schema identity contract".

conformance/differential/schema_identity/.gitattributes

@@ -0,0 +1,2 @@
+# The source files are fixtures whose exact bytes (line endings, a final newline or none) are the thing under test; git must not touch them.
+*.yaml -text

conformance/differential/schema_identity/claimed_digest_empty/expected.json

@@ -0,0 +1,9 @@
+{
+  "accepted": false,
+  "why": "an empty claim is a claim, and a wrong one",
+  "error": {
+    "code": "E_SCHEMA_SOURCE_BINDING",
+    "rule": "R-SCHEMA-DIGEST-MISMATCH",
+    "path": "$.schema_digest"
+  }
+}

conformance/differential/schema_identity/claimed_digest_empty/input.json

@@ -0,0 +1,6 @@
+{
+  "source": "schema.yaml",
+  "claimed_digest": "",
+  "namespace": "cic:storage",
+  "kind": "StorageResource"
+}

conformance/differential/schema_identity/claimed_digest_empty/schema.yaml

@@ -0,0 +1,13 @@
+spec:
+  identity:
+    atomic_ref: "cic:core:Identity@v0.2.0"
+    kind: StorageResource
+    namespace: "cic:storage"
+    version: v1.2.0
+  config_surface:
+    aggregate_ref: "cic:core:ConfigSurface@v0.2.0"
+    nodes:
+      - name: type
+        shape_type: scalar
+        scalar_type: string
+        mandatory: true

conformance/differential/schema_identity/claimed_digest_last_nibble_off/expected.json

@@ -0,0 +1,9 @@
+{
+  "accepted": false,
+  "why": "a one-character difference",
+  "error": {
+    "code": "E_SCHEMA_SOURCE_BINDING",
+    "rule": "R-SCHEMA-DIGEST-MISMATCH",
+    "path": "$.schema_digest"
+  }
+}

conformance/differential/schema_identity/claimed_digest_last_nibble_off/input.json

@@ -0,0 +1,6 @@
+{
+  "source": "schema.yaml",
+  "claimed_digest": "sha256:a36e841db3d5f108a7d5e400f80a636d095bc5c9ddc670142b938d73d0d1a330",
+  "namespace": "cic:storage",
+  "kind": "StorageResource"
+}

conformance/differential/schema_identity/claimed_digest_last_nibble_off/schema.yaml

@@ -0,0 +1,13 @@
+spec:
+  identity:
+    atomic_ref: "cic:core:Identity@v0.2.0"
+    kind: StorageResource
+    namespace: "cic:storage"
+    version: v1.2.0
+  config_surface:
+    aggregate_ref: "cic:core:ConfigSurface@v0.2.0"
+    nodes:
+      - name: type
+        shape_type: scalar
+        scalar_type: string
+        mandatory: true

conformance/differential/schema_identity/claimed_digest_missing/expected.json

@@ -0,0 +1,9 @@
+{
+  "accepted": false,
+  "why": "no claimed digest: fail closed",
+  "error": {
+    "code": "E_SCHEMA_SOURCE_BINDING",
+    "rule": "R-SCHEMA-DIGEST-MISSING",
+    "path": "$.schema_digest"
+  }
+}

conformance/differential/schema_identity/claimed_digest_missing/input.json

@@ -0,0 +1,6 @@
+{
+  "source": "schema.yaml",
+  "claimed_digest": null,
+  "namespace": "cic:storage",
+  "kind": "StorageResource"
+}

conformance/differential/schema_identity/claimed_digest_missing/schema.yaml

@@ -0,0 +1,13 @@
+spec:
+  identity:
+    atomic_ref: "cic:core:Identity@v0.2.0"
+    kind: StorageResource
+    namespace: "cic:storage"
+    version: v1.2.0
+  config_surface:
+    aggregate_ref: "cic:core:ConfigSurface@v0.2.0"
+    nodes:
+      - name: type
+        shape_type: scalar
+        scalar_type: string
+        mandatory: true

conformance/differential/schema_identity/claimed_digest_of_a_normalized_copy/expected.json

@@ -0,0 +1,9 @@
+{
+  "accepted": false,
+  "why": "the CRLF source claiming the digest of its LF form: a normalized digest never stands in",
+  "error": {
+    "code": "E_SCHEMA_SOURCE_BINDING",
+    "rule": "R-SCHEMA-DIGEST-MISMATCH",
+    "path": "$.schema_digest"
+  }
+}

conformance/differential/schema_identity/claimed_digest_of_a_normalized_copy/input.json

@@ -0,0 +1,6 @@
+{
+  "source": "schema.yaml",
+  "claimed_digest": "sha256:a36e841db3d5f108a7d5e400f80a636d095bc5c9ddc670142b938d73d0d1a338",
+  "namespace": "cic:storage",
+  "kind": "StorageResource"
+}

conformance/differential/schema_identity/claimed_digest_of_a_normalized_copy/schema.yaml

@@ -0,0 +1,13 @@
+spec:
+  identity:
+    atomic_ref: "cic:core:Identity@v0.2.0"
+    kind: StorageResource
+    namespace: "cic:storage"
+    version: v1.2.0
+  config_surface:
+    aggregate_ref: "cic:core:ConfigSurface@v0.2.0"
+    nodes:
+      - name: type
+        shape_type: scalar
+        scalar_type: string
+        mandatory: true

conformance/differential/schema_identity/claimed_digest_of_the_other_variant/expected.json

@@ -0,0 +1,9 @@
+{
+  "accepted": false,
+  "why": "the 314-byte source with the digest of the 313-byte one",
+  "error": {
+    "code": "E_SCHEMA_SOURCE_BINDING",
+    "rule": "R-SCHEMA-DIGEST-MISMATCH",
+    "path": "$.schema_digest"
+  }
+}

conformance/differential/schema_identity/claimed_digest_of_the_other_variant/input.json

@@ -0,0 +1,6 @@
+{
+  "source": "schema.yaml",
+  "claimed_digest": "sha256:4fff76af7c6313eae102fc1f967b9d607db0f26c51f6f5f8eb11d7c0988b07f7",
+  "namespace": "cic:storage",
+  "kind": "StorageResource"
+}

conformance/differential/schema_identity/claimed_digest_of_the_other_variant/schema.yaml

@@ -0,0 +1,13 @@
+spec:
+  identity:
+    atomic_ref: "cic:core:Identity@v0.2.0"
+    kind: StorageResource
+    namespace: "cic:storage"
+    version: v1.2.0
+  config_surface:
+    aggregate_ref: "cic:core:ConfigSurface@v0.2.0"
+    nodes:
+      - name: type
+        shape_type: scalar
+        scalar_type: string
+        mandatory: true

conformance/differential/schema_identity/claimed_digest_uppercase_hex/expected.json

@@ -0,0 +1,9 @@
+{
+  "accepted": false,
+  "why": "the digest form is lowercase hex",
+  "error": {
+    "code": "E_SCHEMA_SOURCE_BINDING",
+    "rule": "R-SCHEMA-DIGEST-MISMATCH",
+    "path": "$.schema_digest"
+  }
+}

conformance/differential/schema_identity/claimed_digest_uppercase_hex/input.json

@@ -0,0 +1,6 @@
+{
+  "source": "schema.yaml",
+  "claimed_digest": "sha256:A36E841DB3D5F108A7D5E400F80A636D095BC5C9DDC670142B938D73D0D1A338",
+  "namespace": "cic:storage",
+  "kind": "StorageResource"
+}

conformance/differential/schema_identity/claimed_digest_uppercase_hex/schema.yaml

@@ -0,0 +1,13 @@
+spec:
+  identity:
+    atomic_ref: "cic:core:Identity@v0.2.0"
+    kind: StorageResource
+    namespace: "cic:storage"
+    version: v1.2.0
+  config_surface:
+    aggregate_ref: "cic:core:ConfigSurface@v0.2.0"
+    nodes:
+      - name: type
+        shape_type: scalar
+        scalar_type: string
+        mandatory: true

conformance/differential/schema_identity/claimed_digest_without_prefix/expected.json

@@ -0,0 +1,9 @@
+{
+  "accepted": false,
+  "why": "the sha256: prefix is part of the value",
+  "error": {
+    "code": "E_SCHEMA_SOURCE_BINDING",
+    "rule": "R-SCHEMA-DIGEST-MISMATCH",
+    "path": "$.schema_digest"
+  }
+}

conformance/differential/schema_identity/claimed_digest_without_prefix/input.json

@@ -0,0 +1,6 @@
+{
+  "source": "schema.yaml",
+  "claimed_digest": "a36e841db3d5f108a7d5e400f80a636d095bc5c9ddc670142b938d73d0d1a338",
+  "namespace": "cic:storage",
+  "kind": "StorageResource"
+}

conformance/differential/schema_identity/claimed_digest_without_prefix/schema.yaml

@@ -0,0 +1,13 @@
+spec:
+  identity:
+    atomic_ref: "cic:core:Identity@v0.2.0"
+    kind: StorageResource
+    namespace: "cic:storage"
+    version: v1.2.0
+  config_surface:
+    aggregate_ref: "cic:core:ConfigSurface@v0.2.0"
+    nodes:
+      - name: type
+        shape_type: scalar
+        scalar_type: string
+        mandatory: true

conformance/differential/schema_identity/crlf_line_endings/expected.json

@@ -0,0 +1,6 @@
+{
+  "accepted": true,
+  "why": "line endings are part of the byte identity; no CRLF to LF normalization",
+  "schema_name": "cic:storage:StorageResource",
+  "schema_digest": "sha256:b0e97e6fcb7d35585a48514acc92e2ac0145ed02f3207be811bf95d18b27e0d2"
+}

conformance/differential/schema_identity/crlf_line_endings/input.json

@@ -0,0 +1,6 @@
+{
+  "source": "schema.yaml",
+  "claimed_digest": "sha256:b0e97e6fcb7d35585a48514acc92e2ac0145ed02f3207be811bf95d18b27e0d2",
+  "namespace": "cic:storage",
+  "kind": "StorageResource"
+}

conformance/differential/schema_identity/crlf_line_endings/schema.yaml

@@ -0,0 +1,13 @@
+spec:
+  identity:
+    atomic_ref: "cic:core:Identity@v0.2.0"
+    kind: StorageResource
+    namespace: "cic:storage"
+    version: v1.2.0
+  config_surface:
+    aggregate_ref: "cic:core:ConfigSurface@v0.2.0"
+    nodes:
+      - name: type
+        shape_type: scalar
+        scalar_type: string
+        mandatory: true

conformance/differential/schema_identity/digest_is_checked_before_identity/expected.json

@@ -0,0 +1,9 @@
+{
+  "accepted": false,
+  "why": "both are wrong: the digest binding is the first reason",
+  "error": {
+    "code": "E_SCHEMA_SOURCE_BINDING",
+    "rule": "R-SCHEMA-DIGEST-MISMATCH",
+    "path": "$.schema_digest"
+  }
+}

conformance/differential/schema_identity/digest_is_checked_before_identity/input.json

@@ -0,0 +1,6 @@
+{
+  "source": "schema.yaml",
+  "claimed_digest": "sha256:4fff76af7c6313eae102fc1f967b9d607db0f26c51f6f5f8eb11d7c0988b07f7",
+  "namespace": "",
+  "kind": ""
+}

conformance/differential/schema_identity/digest_is_checked_before_identity/schema.yaml

@@ -0,0 +1,13 @@
+spec:
+  identity:
+    atomic_ref: "cic:core:Identity@v0.2.0"
+    kind: StorageResource
+    namespace: "cic:storage"
+    version: v1.2.0
+  config_surface:
+    aggregate_ref: "cic:core:ConfigSurface@v0.2.0"
+    nodes:
+      - name: type
+        shape_type: scalar
+        scalar_type: string
+        mandatory: true

conformance/differential/schema_identity/golden_with_final_lf/expected.json

@@ -0,0 +1,6 @@
+{
+  "accepted": true,
+  "why": "the 314-byte golden source, one final LF",
+  "schema_name": "cic:storage:StorageResource",
+  "schema_digest": "sha256:a36e841db3d5f108a7d5e400f80a636d095bc5c9ddc670142b938d73d0d1a338"
+}

conformance/differential/schema_identity/golden_with_final_lf/input.json

@@ -0,0 +1,7 @@
+{
+  "source": "schema.yaml",
+  "claimed_digest": "sha256:a36e841db3d5f108a7d5e400f80a636d095bc5c9ddc670142b938d73d0d1a338",
+  "namespace": "cic:storage",
+  "kind": "StorageResource",
+  "identity_from_source": true
+}

conformance/differential/schema_identity/golden_with_final_lf/schema.yaml

@@ -0,0 +1,13 @@
+spec:
+  identity:
+    atomic_ref: "cic:core:Identity@v0.2.0"
+    kind: StorageResource
+    namespace: "cic:storage"
+    version: v1.2.0
+  config_surface:
+    aggregate_ref: "cic:core:ConfigSurface@v0.2.0"
+    nodes:
+      - name: type
+        shape_type: scalar
+        scalar_type: string
+        mandatory: true

conformance/differential/schema_identity/golden_without_final_lf/expected.json

@@ -0,0 +1,6 @@
+{
+  "accepted": true,
+  "why": "the same file without its final LF is another identity (313 bytes)",
+  "schema_name": "cic:storage:StorageResource",
+  "schema_digest": "sha256:4fff76af7c6313eae102fc1f967b9d607db0f26c51f6f5f8eb11d7c0988b07f7"
+}

conformance/differential/schema_identity/golden_without_final_lf/input.json

@@ -0,0 +1,7 @@
+{
+  "source": "schema.yaml",
+  "claimed_digest": "sha256:4fff76af7c6313eae102fc1f967b9d607db0f26c51f6f5f8eb11d7c0988b07f7",
+  "namespace": "cic:storage",
+  "kind": "StorageResource",
+  "identity_from_source": true
+}

conformance/differential/schema_identity/golden_without_final_lf/schema.yaml

@@ -0,0 +1,13 @@
+spec:
+  identity:
+    atomic_ref: "cic:core:Identity@v0.2.0"
+    kind: StorageResource
+    namespace: "cic:storage"
+    version: v1.2.0
+  config_surface:
+    aggregate_ref: "cic:core:ConfigSurface@v0.2.0"
+    nodes:
+      - name: type
+        shape_type: scalar
+        scalar_type: string
+        mandatory: true

conformance/differential/schema_identity/kind_contains_colon/expected.json

@@ -0,0 +1,9 @@
+{
+  "accepted": false,
+  "why": "a colon in the kind would make the last separator ambiguous",
+  "error": {
+    "code": "E_INVALID_SCHEMA_IDENTITY",
+    "rule": "R-SCHEMA-NAME-KIND",
+    "path": "$.spec.identity.kind"
+  }
+}

conformance/differential/schema_identity/kind_contains_colon/input.json

@@ -0,0 +1,6 @@
+{
+  "source": "schema.yaml",
+  "claimed_digest": "sha256:a36e841db3d5f108a7d5e400f80a636d095bc5c9ddc670142b938d73d0d1a338",
+  "namespace": "cic:storage",
+  "kind": "Storage:Resource"
+}