From 7c59c614851c1eb24bb91d316e0129d0e6a7a0c2 Mon Sep 17 00:00:00 2001 From: Brian Jin <35789537+kikashy@users.noreply.github.com> Date: Mon, 19 Oct 2026 16:22:34 -0400 Subject: [PATCH 1/2] Adopt the published Policy offline-reader draft Pin policy-v1.0.0-draft.1 at exact Spec commit 0799b37b74e35c4a86bfbf70f7bee80bdb7bbe94 with byte-verified resources, release provenance and all 124 official corpus rows. Reuse existing offline CLI/MCP tools and reader; identify official schemas and draft result metadata while preserving prototype defaults and legacy vendored evidence. Document strict report-object compatibility and exact offline scope without implying approval, live authority, automatic migration or stable maturity. Prepare v0.37.0 release notes after focused reader, CLI/MCP and Desk integration verification; required CI and independent review remain release gates. Signed-off-by: Brian Jin <35789537+kikashy@users.noreply.github.com> Signed-off-by: kikashy Co-authored-by: Codex (gpt-6.1-sol) --- .gitattributes | 3 + CHANGELOG.md | 36 + README.md | 123 +- THIRD_PARTY_NOTICES | 11 + ...1-adopt-official-policy-draft-resources.md | 114 + docs/adr/README.md | 3 +- docs/architecture.md | 44 +- docs/mcp-clients.md | 96 +- docs/releasing.md | 10 + internal/cli/policy.go | 18 +- internal/cli/policy_candidate_test.go | 40 +- internal/mcp/policy.go | 10 +- internal/mcp/policy_test.go | 3 +- internal/policy/candidate_schema.go | 16 +- internal/policy/candidate_test.go | 13 +- internal/policy/document.go | 4 +- internal/policy/format.go | 20 +- internal/policy/official.go | 73 + internal/policy/official/CONTRIBUTING.md | 91 + internal/policy/official/GOVERNANCE.md | 284 + internal/policy/official/LICENSE | 202 + internal/policy/official/NOTICE | 5 + internal/policy/official/VERSIONING.md | 105 + .../conformance/policy/1.0.0/ADOPTION.md | 92 + .../conformance/policy/1.0.0/MIGRATION.md | 61 + .../conformance/policy/1.0.0/PROMOTION.md | 42 + .../conformance/policy/1.0.0/PUBLICATION.md | 83 + .../conformance/policy/1.0.0/README.md | 34 + .../policy/1.0.0/candidate-1.0.0-pin.json | 178 + .../policy/1.0.0/capabilities.json | 74 + .../conformance/policy/1.0.0/check_vectors.py | 58 + .../1.0.0/examples/data-access/adoption.json | 75 + .../examples/data-access/consumer-pack.json | 62 + .../1.0.0/examples/data-access/fixture.json | 58 + .../examples/data-access/interpretation.txt | 4 + .../1.0.0/examples/data-access/narrative.txt | 10 + .../1.0.0/examples/data-access/policy.json | 76 + .../1.0.0/examples/data-access/source.txt | 5 + .../1.0.0/examples/procurement/adoption.json | 97 + .../examples/procurement/consumer-pack.json | 68 + .../1.0.0/examples/procurement/fixture.json | 58 + .../examples/procurement/interpretation.txt | 5 + .../1.0.0/examples/procurement/narrative.txt | 16 + .../1.0.0/examples/procurement/policy.json | 106 + .../1.0.0/examples/procurement/source.txt | 7 + .../1.0.0/examples/refunds/adoption.json | 87 + .../1.0.0/examples/refunds/consumer-pack.json | 76 + .../1.0.0/examples/refunds/fixture.json | 58 + .../1.0.0/examples/refunds/interpretation.txt | 4 + .../1.0.0/examples/refunds/narrative.txt | 13 + .../policy/1.0.0/examples/refunds/policy.json | 91 + .../policy/1.0.0/examples/refunds/source.txt | 6 + .../policy/1.0.0/fixture.schema.json | 67 + .../policy/1.0.0/prototype-0.0.2-pin.json | 33 + .../conformance/policy/1.0.0/test_contract.py | 250 + .../policy/1.0.0/vectors.schema.json | 203 + .../policy/1.0.0/vectors/README.md | 103 + .../vectors/documents/aggregate-max.json | 25 + .../vectors/documents/aggregate-over.json | 25 + .../aggregate-shared-media-counted-once.json | 25 + .../vectors/documents/anchor-empty-range.json | 76 + .../documents/anchor-outside-narrative.json | 76 + .../vectors/documents/anchor-over-bound.json | 76 + .../documents/anchor-stale-digest.json | 76 + .../vectors/documents/anchor-utf8-split.json | 76 + .../vectors/documents/approval-field.json | 77 + .../vectors/documents/artifact-build.json | 76 + .../documents/artifact-independent.json | 76 + .../documents/artifact-leading-zero.json | 76 + .../vectors/documents/artifact-max-256.json | 76 + .../vectors/documents/artifact-newline.json | 76 + .../vectors/documents/artifact-number.json | 76 + .../vectors/documents/artifact-over-256.json | 76 + .../documents/artifact-two-components.json | 76 + .../policy/1.0.0/vectors/documents/bom.json | 1 + .../vectors/documents/companion-float.json | 1 + .../documents/companion-unsafe-integer.json | 1 + .../consumer-fallback-unknown-pack.json | 62 + .../documents/consumer-fallback-unknown.json | 71 + .../vectors/documents/consumer-graph.json | 75 + .../consumer-rule-id-duplicate-pack.json | 74 + .../documents/consumer-rule-id-duplicate.json | 71 + .../documents/core-decimal-raw-pack.json | 67 + .../vectors/documents/core-decimal-raw.json | 71 + .../core-decimal-requested-canon-pack.json | 67 + .../core-decimal-requested-canon.json | 75 + .../documents/core-exponent-308-pack.json | 67 + .../vectors/documents/core-exponent-308.json | 71 + .../documents/core-exponent-over-pack.json | 67 + .../vectors/documents/core-exponent-over.json | 71 + .../documents/core-number-128-pack.json | 67 + .../vectors/documents/core-number-128.json | 71 + .../documents/core-number-over-128-pack.json | 67 + .../documents/core-number-over-128.json | 71 + .../documents/core-unsafe-int-raw-pack.json | 67 + .../documents/core-unsafe-int-raw.json | 71 + .../core-unsafe-int-requested-canon-pack.json | 67 + .../core-unsafe-int-requested-canon.json | 75 + .../vectors/documents/coverage-duplicate.json | 75 + .../vectors/documents/coverage-omitted.json | 70 + .../vectors/documents/coverage-outside.json | 75 + .../1.0.0/vectors/documents/depth-32.json | 1 + .../1.0.0/vectors/documents/depth-33.json | 1 + .../documents/desk-managed-alias-refused.json | 76 + .../vectors/documents/document-max-bytes.json | 76 + .../vectors/documents/duplicate-json.json | 1 + .../documents/duplicate-policy-identity.json | 128 + .../1.0.0/vectors/documents/format-0.json | 76 + .../1.0.0/vectors/documents/format-2.json | 76 + .../documents/format-before-canon.json | 1 + .../documents/format-before-shape.json | 4 + .../1.0.0/vectors/documents/format-bool.json | 76 + .../1.0.0/vectors/documents/format-int.json | 76 + .../documents/format-leading-zero.json | 76 + .../vectors/documents/format-missing.json | 75 + .../vectors/documents/format-newline.json | 76 + .../1.0.0/vectors/documents/format-patch.json | 76 + .../1.0.0/vectors/documents/format-short.json | 76 + .../vectors/documents/format-suffix.json | 76 + .../vectors/documents/format-unicode.json | 76 + .../vectors/documents/format-v-prefix.json | 76 + .../vectors/documents/informational-max.json | 82 + .../vectors/documents/informational-over.json | 82 + .../1.0.0/vectors/documents/invalid-utf8.json | 1 + .../vectors/documents/kind-id-confusion.json | 75 + .../limited-scope-missing-basis.json | 92 + .../documents/limited-scope-unknown.json | 98 + .../documents/malformed-over-depth.json | 1 + .../documents/missing-governing-policy.json | 21 + .../vectors/documents/missing-narrative.json | 76 + .../vectors/documents/multiple-json.json | 1 + .../documents/multiple-policy-identities.json | 128 + .../vectors/documents/narrative-max.json | 40 + .../vectors/documents/narrative-over.json | 40 + .../1.0.0/vectors/documents/nonfinite.json | 1 + .../documents/number-literal-over-128.json | 1 + .../vectors/documents/opaque-original.json | 76 + .../vectors/documents/opaque-original.pdf | Bin 0 -> 16 bytes .../1.0.0/vectors/documents/original-max.json | 76 + .../vectors/documents/original-over.json | 76 + .../vectors/documents/permission-field.json | 77 + .../vectors/documents/policy-canon-stale.json | 75 + .../documents/policy-identity-stale.json | 75 + .../documents/policy-version-ref-stale.json | 75 + .../documents/prototype-selector-refused.json | 81 + .../documents/registration-count-16.json | 76 + .../documents/registration-count-17.json | 76 + .../vectors/documents/requirements-field.json | 77 + .../1.0.0/vectors/documents/review-max.json | 75 + .../1.0.0/vectors/documents/review-over.json | 75 + .../vectors/documents/second-policy.json | 76 + .../documents/section-id-duplicate.json | 76 + .../shared-bytes-multiple-media-types.json | 76 + .../vectors/documents/signature-field.json | 77 + .../vectors/documents/singleton-with-id.json | 68 + .../vectors/documents/source-id-unknown.json | 76 + .../documents/stale-material-hash.json | 76 + .../documents/stale-material-length.json | 76 + .../vectors/documents/standalone-policy.json | 76 + .../1.0.0/vectors/documents/surrogate.json | 1 + .../unknown-kind-registration-over.json | 1 + .../1.0.0/vectors/documents/unknown-rule.json | 75 + .../documents/unregistered-media-type.json | 76 + .../documents/unsupported-element.json | 68 + .../vectors/documents/uri-final-lf-pack.json | 62 + .../1.0.0/vectors/documents/uri-final-lf.json | 75 + .../documents/uri-fragment-raw-brackets.json | 76 + .../1.0.0/vectors/documents/uri-invalid.json | 76 + .../documents/uri-ipv6-compressed.json | 76 + .../uri-ipv6-double-compression.json | 76 + .../vectors/documents/uri-ipv6-ipv4-tail.json | 76 + .../uri-ipv6-leading-zero-ipv4-tail-pack.json | 62 + .../uri-ipv6-leading-zero-ipv4-tail.json | 75 + .../uri-ipvfuture-invalid-version.json | 76 + .../uri-ipvfuture-lowercase-pack.json | 62 + .../documents/uri-ipvfuture-lowercase.json | 75 + .../uri-ipvfuture-uppercase-pack.json | 62 + .../documents/uri-ipvfuture-uppercase.json | 75 + .../uri-numeric-regname-leading-zeros.json | 76 + .../documents/uri-path-raw-brackets-pack.json | 62 + .../documents/uri-path-raw-brackets.json | 75 + .../documents/uri-percent-brackets.json | 76 + .../documents/uri-percent-incomplete.json | 76 + .../vectors/documents/uri-percent-nonhex.json | 76 + .../documents/uri-percent-regname-pack.json | 62 + .../documents/uri-percent-regname.json | 75 + .../documents/uri-percent-unicode.json | 76 + .../documents/uri-query-raw-brackets.json | 76 + .../vectors/documents/uri-raw-unicode.json | 76 + .../uri-rootless-raw-brackets-pack.json | 62 + .../documents/uri-rootless-raw-brackets.json | 75 + .../uri-userinfo-percent-brackets.json | 76 + .../policy/1.0.0/vectors/manifest.json | 7446 +++++++++++++++++ .../conformance/policy/1.0.0/verify.py | 432 + internal/policy/official/provenance.json | 2334 ++++++ .../releases/policy-v1.0.0-draft.1.json | 192 + .../releases/policy-v1.0.0-draft.1.md | 56 + internal/policy/official/requirements-dev.txt | 2 + .../policy/official/rfcs/0000-rfc-process.md | 95 + .../official/rfcs/0023-policy-companion.md | 406 + .../policy-companion-contract/MIGRATION.md | 56 + .../rfcs/policy-companion-contract/README.md | 340 + .../capabilities.json | 74 + .../check_vectors.py | 58 + .../common.schema.json | 187 + .../examples/data-access/adoption.json | 75 + .../examples/data-access/consumer-pack.json | 62 + .../examples/data-access/fixture.json | 58 + .../examples/data-access/interpretation.txt | 4 + .../examples/data-access/narrative.txt | 10 + .../examples/data-access/policy.json | 76 + .../examples/data-access/source.txt | 5 + .../examples/procurement/adoption.json | 97 + .../examples/procurement/consumer-pack.json | 68 + .../examples/procurement/fixture.json | 58 + .../examples/procurement/interpretation.txt | 5 + .../examples/procurement/narrative.txt | 16 + .../examples/procurement/policy.json | 106 + .../examples/procurement/source.txt | 7 + .../examples/refunds/adoption.json | 87 + .../examples/refunds/consumer-pack.json | 76 + .../examples/refunds/fixture.json | 58 + .../examples/refunds/interpretation.txt | 4 + .../examples/refunds/narrative.txt | 13 + .../examples/refunds/policy.json | 91 + .../examples/refunds/source.txt | 6 + .../fixture.schema.json | 67 + .../governing-adoption.schema.json | 265 + .../policy.schema.json | 147 + .../prototype-0.0.2-pin.json | 33 + .../test_contract.py | 203 + .../vectors.schema.json | 203 + .../vectors/README.md | 101 + .../vectors/documents/aggregate-max.json | 25 + .../vectors/documents/aggregate-over.json | 25 + .../aggregate-shared-media-counted-once.json | 25 + .../vectors/documents/anchor-empty-range.json | 76 + .../documents/anchor-outside-narrative.json | 76 + .../vectors/documents/anchor-over-bound.json | 76 + .../documents/anchor-stale-digest.json | 76 + .../vectors/documents/anchor-utf8-split.json | 76 + .../vectors/documents/approval-field.json | 77 + .../vectors/documents/artifact-build.json | 76 + .../documents/artifact-independent.json | 76 + .../documents/artifact-leading-zero.json | 76 + .../vectors/documents/artifact-max-256.json | 76 + .../vectors/documents/artifact-newline.json | 76 + .../vectors/documents/artifact-number.json | 76 + .../vectors/documents/artifact-over-256.json | 76 + .../documents/artifact-two-components.json | 76 + .../vectors/documents/bom.json | 1 + .../vectors/documents/companion-float.json | 1 + .../documents/companion-unsafe-integer.json | 1 + .../consumer-fallback-unknown-pack.json | 62 + .../documents/consumer-fallback-unknown.json | 71 + .../vectors/documents/consumer-graph.json | 75 + .../consumer-rule-id-duplicate-pack.json | 74 + .../documents/consumer-rule-id-duplicate.json | 71 + .../documents/core-decimal-raw-pack.json | 67 + .../vectors/documents/core-decimal-raw.json | 71 + .../core-decimal-requested-canon-pack.json | 67 + .../core-decimal-requested-canon.json | 75 + .../documents/core-exponent-308-pack.json | 67 + .../vectors/documents/core-exponent-308.json | 71 + .../documents/core-exponent-over-pack.json | 67 + .../vectors/documents/core-exponent-over.json | 71 + .../documents/core-number-128-pack.json | 67 + .../vectors/documents/core-number-128.json | 71 + .../documents/core-number-over-128-pack.json | 67 + .../documents/core-number-over-128.json | 71 + .../documents/core-unsafe-int-raw-pack.json | 67 + .../documents/core-unsafe-int-raw.json | 71 + .../core-unsafe-int-requested-canon-pack.json | 67 + .../core-unsafe-int-requested-canon.json | 75 + .../vectors/documents/coverage-duplicate.json | 75 + .../vectors/documents/coverage-omitted.json | 70 + .../vectors/documents/coverage-outside.json | 75 + .../vectors/documents/depth-32.json | 1 + .../vectors/documents/depth-33.json | 1 + .../documents/desk-managed-alias-refused.json | 76 + .../vectors/documents/document-max-bytes.json | 76 + .../vectors/documents/duplicate-json.json | 1 + .../documents/duplicate-policy-identity.json | 128 + .../vectors/documents/format-0.json | 76 + .../vectors/documents/format-2.json | 76 + .../documents/format-before-canon.json | 1 + .../documents/format-before-shape.json | 4 + .../vectors/documents/format-bool.json | 76 + .../vectors/documents/format-int.json | 76 + .../documents/format-leading-zero.json | 76 + .../vectors/documents/format-missing.json | 75 + .../vectors/documents/format-newline.json | 76 + .../vectors/documents/format-patch.json | 76 + .../vectors/documents/format-short.json | 76 + .../vectors/documents/format-suffix.json | 76 + .../vectors/documents/format-unicode.json | 76 + .../vectors/documents/format-v-prefix.json | 76 + .../vectors/documents/informational-max.json | 82 + .../vectors/documents/informational-over.json | 82 + .../vectors/documents/invalid-utf8.json | 1 + .../vectors/documents/kind-id-confusion.json | 75 + .../limited-scope-missing-basis.json | 92 + .../documents/limited-scope-unknown.json | 98 + .../documents/malformed-over-depth.json | 1 + .../documents/missing-governing-policy.json | 21 + .../vectors/documents/missing-narrative.json | 76 + .../vectors/documents/multiple-json.json | 1 + .../documents/multiple-policy-identities.json | 128 + .../vectors/documents/narrative-max.json | 40 + .../vectors/documents/narrative-over.json | 40 + .../vectors/documents/nonfinite.json | 1 + .../documents/number-literal-over-128.json | 1 + .../vectors/documents/opaque-original.json | 76 + .../vectors/documents/opaque-original.pdf | Bin 0 -> 16 bytes .../vectors/documents/original-max.json | 76 + .../vectors/documents/original-over.json | 76 + .../vectors/documents/permission-field.json | 77 + .../vectors/documents/policy-canon-stale.json | 75 + .../documents/policy-identity-stale.json | 75 + .../documents/policy-version-ref-stale.json | 75 + .../documents/prototype-selector-refused.json | 81 + .../documents/registration-count-16.json | 76 + .../documents/registration-count-17.json | 76 + .../vectors/documents/requirements-field.json | 77 + .../vectors/documents/review-max.json | 75 + .../vectors/documents/review-over.json | 75 + .../vectors/documents/second-policy.json | 76 + .../documents/section-id-duplicate.json | 76 + .../shared-bytes-multiple-media-types.json | 76 + .../vectors/documents/signature-field.json | 77 + .../vectors/documents/singleton-with-id.json | 68 + .../vectors/documents/source-id-unknown.json | 76 + .../documents/stale-material-hash.json | 76 + .../documents/stale-material-length.json | 76 + .../vectors/documents/standalone-policy.json | 76 + .../vectors/documents/surrogate.json | 1 + .../unknown-kind-registration-over.json | 1 + .../vectors/documents/unknown-rule.json | 75 + .../documents/unregistered-media-type.json | 76 + .../documents/unsupported-element.json | 68 + .../vectors/documents/uri-final-lf-pack.json | 62 + .../vectors/documents/uri-final-lf.json | 75 + .../documents/uri-fragment-raw-brackets.json | 76 + .../vectors/documents/uri-invalid.json | 76 + .../documents/uri-ipv6-compressed.json | 76 + .../uri-ipv6-double-compression.json | 76 + .../vectors/documents/uri-ipv6-ipv4-tail.json | 76 + .../uri-ipv6-leading-zero-ipv4-tail-pack.json | 62 + .../uri-ipv6-leading-zero-ipv4-tail.json | 75 + .../uri-ipvfuture-invalid-version.json | 76 + .../uri-ipvfuture-lowercase-pack.json | 62 + .../documents/uri-ipvfuture-lowercase.json | 75 + .../uri-ipvfuture-uppercase-pack.json | 62 + .../documents/uri-ipvfuture-uppercase.json | 75 + .../uri-numeric-regname-leading-zeros.json | 76 + .../documents/uri-path-raw-brackets-pack.json | 62 + .../documents/uri-path-raw-brackets.json | 75 + .../documents/uri-percent-brackets.json | 76 + .../documents/uri-percent-incomplete.json | 76 + .../vectors/documents/uri-percent-nonhex.json | 76 + .../documents/uri-percent-regname-pack.json | 62 + .../documents/uri-percent-regname.json | 75 + .../documents/uri-percent-unicode.json | 76 + .../documents/uri-query-raw-brackets.json | 76 + .../vectors/documents/uri-raw-unicode.json | 76 + .../uri-rootless-raw-brackets-pack.json | 62 + .../documents/uri-rootless-raw-brackets.json | 75 + .../uri-userinfo-percent-brackets.json | 76 + .../vectors/manifest.json | 7446 +++++++++++++++++ .../rfcs/policy-companion-contract/verify.py | 431 + .../rfcs/policy-companion-prototype/README.md | 259 + .../common.schema.json | 203 + .../examples/data-access/adoption.json | 79 + .../examples/data-access/consumer-pack.json | 62 + .../examples/data-access/fixture.json | 62 + .../examples/data-access/interpretation.txt | 4 + .../examples/data-access/narrative.txt | 10 + .../examples/data-access/policy.json | 80 + .../examples/data-access/source.txt | 5 + .../examples/procurement/adoption.json | 101 + .../examples/procurement/consumer-pack.json | 68 + .../examples/procurement/fixture.json | 62 + .../examples/procurement/interpretation.txt | 5 + .../examples/procurement/narrative.txt | 16 + .../examples/procurement/policy.json | 110 + .../examples/procurement/source.txt | 7 + .../examples/refunds/adoption.json | 91 + .../examples/refunds/consumer-pack.json | 76 + .../examples/refunds/fixture.json | 62 + .../examples/refunds/interpretation.txt | 4 + .../examples/refunds/narrative.txt | 13 + .../examples/refunds/policy.json | 95 + .../examples/refunds/source.txt | 6 + .../governing-adoption.schema.json | 265 + .../policy.schema.json | 147 + .../test_prototype.py | 511 ++ .../rfcs/policy-companion-prototype/verify.py | 308 + .../schema/judgment-pack-core.schema.json | 578 ++ .../schema/policy/1.0.0/common.schema.json | 187 + .../consumer-core-0.2.0-draft.schema.json | 578 ++ .../1.0.0/governing-adoption.schema.json | 265 + .../schema/policy/1.0.0/policy.schema.json | 147 + .../official/spec/checkpoint-witness.md | 409 + internal/policy/official/spec/dialect.md | 1829 ++++ internal/policy/official/spec/policy.md | 379 + .../policy/official/tools/dialect_verify.py | 3219 +++++++ internal/policy/official_test.go | 133 + internal/policy/schema.go | 9 +- internal/releasecheck/check.go | 4 + 409 files changed, 52802 insertions(+), 140 deletions(-) create mode 100644 docs/adr/0061-adopt-official-policy-draft-resources.md create mode 100644 internal/policy/official.go create mode 100644 internal/policy/official/CONTRIBUTING.md create mode 100644 internal/policy/official/GOVERNANCE.md create mode 100644 internal/policy/official/LICENSE create mode 100644 internal/policy/official/NOTICE create mode 100644 internal/policy/official/VERSIONING.md create mode 100644 internal/policy/official/conformance/policy/1.0.0/ADOPTION.md create mode 100644 internal/policy/official/conformance/policy/1.0.0/MIGRATION.md create mode 100644 internal/policy/official/conformance/policy/1.0.0/PROMOTION.md create mode 100644 internal/policy/official/conformance/policy/1.0.0/PUBLICATION.md create mode 100644 internal/policy/official/conformance/policy/1.0.0/README.md create mode 100644 internal/policy/official/conformance/policy/1.0.0/candidate-1.0.0-pin.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/capabilities.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/check_vectors.py create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/data-access/adoption.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/data-access/consumer-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/data-access/fixture.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/data-access/interpretation.txt create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/data-access/narrative.txt create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/data-access/policy.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/data-access/source.txt create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/procurement/adoption.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/procurement/consumer-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/procurement/fixture.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/procurement/interpretation.txt create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/procurement/narrative.txt create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/procurement/policy.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/procurement/source.txt create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/refunds/adoption.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/refunds/consumer-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/refunds/fixture.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/refunds/interpretation.txt create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/refunds/narrative.txt create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/refunds/policy.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/examples/refunds/source.txt create mode 100644 internal/policy/official/conformance/policy/1.0.0/fixture.schema.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/prototype-0.0.2-pin.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/test_contract.py create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors.schema.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/README.md create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/aggregate-max.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/aggregate-over.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/aggregate-shared-media-counted-once.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-empty-range.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-outside-narrative.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-over-bound.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-stale-digest.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-utf8-split.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/approval-field.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-build.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-independent.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-leading-zero.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-max-256.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-newline.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-number.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-over-256.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-two-components.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/bom.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/companion-float.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/companion-unsafe-integer.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-fallback-unknown-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-fallback-unknown.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-graph.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-rule-id-duplicate-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-rule-id-duplicate.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-raw-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-raw.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-requested-canon-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-requested-canon.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-308-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-308.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-over-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-over.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-128-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-128.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-over-128-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-over-128.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-raw-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-raw.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-requested-canon-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-requested-canon.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/coverage-duplicate.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/coverage-omitted.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/coverage-outside.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/depth-32.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/depth-33.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/desk-managed-alias-refused.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/document-max-bytes.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/duplicate-json.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/duplicate-policy-identity.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-0.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-2.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-before-canon.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-before-shape.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-bool.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-int.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-leading-zero.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-missing.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-newline.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-patch.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-short.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-suffix.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-unicode.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-v-prefix.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/informational-max.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/informational-over.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/invalid-utf8.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/kind-id-confusion.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/limited-scope-missing-basis.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/limited-scope-unknown.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/malformed-over-depth.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/missing-governing-policy.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/missing-narrative.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/multiple-json.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/multiple-policy-identities.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/narrative-max.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/narrative-over.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/nonfinite.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/number-literal-over-128.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/opaque-original.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/opaque-original.pdf create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/original-max.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/original-over.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/permission-field.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/policy-canon-stale.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/policy-identity-stale.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/policy-version-ref-stale.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/prototype-selector-refused.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/registration-count-16.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/registration-count-17.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/requirements-field.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/review-max.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/review-over.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/second-policy.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/section-id-duplicate.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/shared-bytes-multiple-media-types.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/signature-field.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/singleton-with-id.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/source-id-unknown.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/stale-material-hash.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/stale-material-length.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/standalone-policy.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/surrogate.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/unknown-kind-registration-over.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/unknown-rule.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/unregistered-media-type.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/unsupported-element.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-final-lf-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-final-lf.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-fragment-raw-brackets.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-invalid.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-ipv6-compressed.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-ipv6-double-compression.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-ipv6-ipv4-tail.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-ipv6-leading-zero-ipv4-tail-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-ipv6-leading-zero-ipv4-tail.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-ipvfuture-invalid-version.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-ipvfuture-lowercase-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-ipvfuture-lowercase.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-ipvfuture-uppercase-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-ipvfuture-uppercase.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-numeric-regname-leading-zeros.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-path-raw-brackets-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-path-raw-brackets.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-percent-brackets.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-percent-incomplete.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-percent-nonhex.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-percent-regname-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-percent-regname.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-percent-unicode.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-query-raw-brackets.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-raw-unicode.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-rootless-raw-brackets-pack.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-rootless-raw-brackets.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/documents/uri-userinfo-percent-brackets.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/vectors/manifest.json create mode 100644 internal/policy/official/conformance/policy/1.0.0/verify.py create mode 100644 internal/policy/official/provenance.json create mode 100644 internal/policy/official/releases/policy-v1.0.0-draft.1.json create mode 100644 internal/policy/official/releases/policy-v1.0.0-draft.1.md create mode 100644 internal/policy/official/requirements-dev.txt create mode 100644 internal/policy/official/rfcs/0000-rfc-process.md create mode 100644 internal/policy/official/rfcs/0023-policy-companion.md create mode 100644 internal/policy/official/rfcs/policy-companion-contract/MIGRATION.md create mode 100644 internal/policy/official/rfcs/policy-companion-contract/README.md create mode 100644 internal/policy/official/rfcs/policy-companion-contract/capabilities.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/check_vectors.py create mode 100644 internal/policy/official/rfcs/policy-companion-contract/common.schema.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/data-access/adoption.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/data-access/consumer-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/data-access/fixture.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/data-access/interpretation.txt create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/data-access/narrative.txt create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/data-access/policy.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/data-access/source.txt create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/procurement/adoption.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/procurement/consumer-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/procurement/fixture.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/procurement/interpretation.txt create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/procurement/narrative.txt create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/procurement/policy.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/procurement/source.txt create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/refunds/adoption.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/refunds/consumer-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/refunds/fixture.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/refunds/interpretation.txt create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/refunds/narrative.txt create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/refunds/policy.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/examples/refunds/source.txt create mode 100644 internal/policy/official/rfcs/policy-companion-contract/fixture.schema.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/governing-adoption.schema.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/policy.schema.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/prototype-0.0.2-pin.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/test_contract.py create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors.schema.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/README.md create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/aggregate-max.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/aggregate-over.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/aggregate-shared-media-counted-once.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/anchor-empty-range.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/anchor-outside-narrative.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/anchor-over-bound.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/anchor-stale-digest.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/anchor-utf8-split.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/approval-field.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/artifact-build.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/artifact-independent.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/artifact-leading-zero.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/artifact-max-256.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/artifact-newline.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/artifact-number.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/artifact-over-256.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/artifact-two-components.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/bom.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/companion-float.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/companion-unsafe-integer.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/consumer-fallback-unknown-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/consumer-fallback-unknown.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/consumer-graph.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/consumer-rule-id-duplicate-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/consumer-rule-id-duplicate.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-decimal-raw-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-decimal-raw.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-decimal-requested-canon-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-decimal-requested-canon.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-exponent-308-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-exponent-308.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-exponent-over-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-exponent-over.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-number-128-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-number-128.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-number-over-128-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-number-over-128.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-unsafe-int-raw-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-unsafe-int-raw.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-unsafe-int-requested-canon-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/core-unsafe-int-requested-canon.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/coverage-duplicate.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/coverage-omitted.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/coverage-outside.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/depth-32.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/depth-33.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/desk-managed-alias-refused.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/document-max-bytes.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/duplicate-json.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/duplicate-policy-identity.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/format-0.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/format-2.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/format-before-canon.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/format-before-shape.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/format-bool.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/format-int.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/format-leading-zero.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/format-missing.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/format-newline.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/format-patch.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/format-short.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/format-suffix.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/format-unicode.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/format-v-prefix.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/informational-max.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/informational-over.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/invalid-utf8.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/kind-id-confusion.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/limited-scope-missing-basis.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/limited-scope-unknown.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/malformed-over-depth.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/missing-governing-policy.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/missing-narrative.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/multiple-json.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/multiple-policy-identities.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/narrative-max.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/narrative-over.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/nonfinite.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/number-literal-over-128.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/opaque-original.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/opaque-original.pdf create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/original-max.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/original-over.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/permission-field.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/policy-canon-stale.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/policy-identity-stale.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/policy-version-ref-stale.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/prototype-selector-refused.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/registration-count-16.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/registration-count-17.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/requirements-field.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/review-max.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/review-over.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/second-policy.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/section-id-duplicate.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/shared-bytes-multiple-media-types.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/signature-field.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/singleton-with-id.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/source-id-unknown.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/stale-material-hash.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/stale-material-length.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/standalone-policy.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/surrogate.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/unknown-kind-registration-over.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/unknown-rule.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/unregistered-media-type.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/unsupported-element.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-final-lf-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-final-lf.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-fragment-raw-brackets.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-invalid.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-ipv6-compressed.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-ipv6-double-compression.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-ipv6-ipv4-tail.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-ipv6-leading-zero-ipv4-tail-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-ipv6-leading-zero-ipv4-tail.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-ipvfuture-invalid-version.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-ipvfuture-lowercase-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-ipvfuture-lowercase.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-ipvfuture-uppercase-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-ipvfuture-uppercase.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-numeric-regname-leading-zeros.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-path-raw-brackets-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-path-raw-brackets.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-percent-brackets.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-percent-incomplete.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-percent-nonhex.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-percent-regname-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-percent-regname.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-percent-unicode.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-query-raw-brackets.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-raw-unicode.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-rootless-raw-brackets-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-rootless-raw-brackets.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/documents/uri-userinfo-percent-brackets.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/vectors/manifest.json create mode 100644 internal/policy/official/rfcs/policy-companion-contract/verify.py create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/README.md create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/common.schema.json create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/data-access/adoption.json create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/data-access/consumer-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/data-access/fixture.json create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/data-access/interpretation.txt create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/data-access/narrative.txt create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/data-access/policy.json create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/data-access/source.txt create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/procurement/adoption.json create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/procurement/consumer-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/procurement/fixture.json create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/procurement/interpretation.txt create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/procurement/narrative.txt create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/procurement/policy.json create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/procurement/source.txt create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/refunds/adoption.json create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/refunds/consumer-pack.json create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/refunds/fixture.json create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/refunds/interpretation.txt create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/refunds/narrative.txt create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/refunds/policy.json create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/examples/refunds/source.txt create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/governing-adoption.schema.json create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/policy.schema.json create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/test_prototype.py create mode 100644 internal/policy/official/rfcs/policy-companion-prototype/verify.py create mode 100644 internal/policy/official/schema/judgment-pack-core.schema.json create mode 100644 internal/policy/official/schema/policy/1.0.0/common.schema.json create mode 100644 internal/policy/official/schema/policy/1.0.0/consumer-core-0.2.0-draft.schema.json create mode 100644 internal/policy/official/schema/policy/1.0.0/governing-adoption.schema.json create mode 100644 internal/policy/official/schema/policy/1.0.0/policy.schema.json create mode 100644 internal/policy/official/spec/checkpoint-witness.md create mode 100644 internal/policy/official/spec/dialect.md create mode 100644 internal/policy/official/spec/policy.md create mode 100644 internal/policy/official/tools/dialect_verify.py create mode 100644 internal/policy/official_test.go diff --git a/.gitattributes b/.gitattributes index 383dad5e..06f16634 100644 --- a/.gitattributes +++ b/.gitattributes @@ -20,5 +20,8 @@ internal/policy/prototype/** -text # Candidate schemas, provenance, examples and vectors also retain exact bytes. internal/policy/candidate/** -text +# Official independently released Policy draft resources retain exact bytes. +internal/policy/official/** -text + # The served authoring schema has a byte digest on every platform. internal/dialect/version2.schema.json -text diff --git a/CHANGELOG.md b/CHANGELOG.md index ace94ff5..516d658e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,42 @@ All notable changes to tagged releases are documented here. +## 0.37.0 - 2026-10-19 + +- Adopt the immutable official Policy draft `policy-v1.0.0-draft.1`, Spec commit + `0799b37b74e35c4a86bfbf70f7bee80bdb7bbe94`, for existing explicit `1.0.0` + CLI/MCP operations (#293, ADR-0061). Retain and verify the complete published + archive, HTTPS schema identities, per-file provenance and all 124 corpus rows. + The shared Go reader compares exact official results; the unchanged reference + reader runs against the retained archive. The release gate verifies its + independent manifest pin and inventory. Core pins, schema, numeric/URI behavior + and all historical prototype/candidate vendor bytes remain unchanged. +- **Explicit 1.0.0 report migration:** maturity becomes `draft`; source revision, + specification URL, capability exclusions and validation/check scope strings now + identify the official draft. Existing `candidateCapabilities` and + `candidateResult` names remain. The complete full-check valid result is + `{"status":"valid","formatVersion":"1.0.0","maturity":"draft"}`; finite + refusal objects and narrower-operation scopes remain. Strict consumers must + update their immutable Runtime/Spec pins and exact metadata expectations. + Derived editing schemas get release-specific Runtime URNs and a `sourceId` + identifying the official HTTPS schema. Default discovery and prototype reports + remain byte compatible. Historical candidate reports retain their old pin and + proposed maturity; no artifact bytes, approval, Job or live authority migrate. + +This requires a minor release under the 0.x policy. Existing command/tool names, +output/contract versions, exit classes, private 24 MiB material JSON and 16 MiB MCP +ceilings remain. The host surface stays experimental with false full-document- +conformance and authority capabilities. Draft support establishes no stable +maturity or independently authored interoperability; Runtime's conformance claim +remains solely in `CONFORMANCE.md`. No full Core semantics, evaluation, acquisition, +publication or governing-authority determination is added. +The existing Linux/macOS/Windows amd64/arm64 platform targets are unchanged. + +Release preparation: required repository CI, the final merged source pin, tagged +platform archives, checksums, attestations, native smoke and publication checks +remain release gates. This prepared entry does not assert that those gates have +completed. The held `v0.35.0` tag/draft remains unchanged. + ## 0.36.0 - 2026-10-19 This release is cumulative from the last published Runtime, `v0.34.0`. It includes diff --git a/README.md b/README.md index c8598bd0..f2efacfa 100644 --- a/README.md +++ b/README.md @@ -1081,8 +1081,8 @@ are reported in-band. See ADR-0055. `jpack experimental policy` implements the **nonnormative** RFC 0023 prototype, exact version `0.0.2`, for `policy` and `governing-adoption` documents -([ADR-0059](docs/adr/0059-experimental-offline-policy-tools.md)). RFC 0023 remains -Draft. This is an experimental authoring aid; its results establish no approval, +([ADR-0059](docs/adr/0059-experimental-offline-policy-tools.md)). This retained +prototype is an experimental authoring aid; its results establish no approval, governing-adoption authority or standard conformance. Discover the exact scope, limits and pinned source revision with `experimental policy contract --format json`. No stable Policy format is selected by default. @@ -1137,61 +1137,94 @@ The RFC, prototype schemas and synthetic fixtures are bundled from specification revision `8a56a95d555c17640d2db4984363b779536b3c2a`, with per-file digests and licensing provenance. They are never fetched at runtime. -### Proposed draft Policy contract candidate - -The same experimental commands additionally support the **unadopted, -proposed-draft** candidate `formatVersion: "1.0.0"` -([ADR-0060](docs/adr/0060-explicit-policy-candidate-format.md)). It is a review -candidate for RFC 0023, not a stable format, adopted standard or conformance -class. Its artifacts are pinned separately to Spec commit -`0852c5fa7726e51b36e574a5b110e7f5e012e03d` in -[the candidate provenance manifest](internal/policy/candidate/provenance.json). - -Default `contract` output and all prototype reports keep their existing shape -for strict clients. Explicit discovery returns a separate `registryVersion: "1"` -report; selecting one contract returns that format's provenance and capabilities: +### Official Policy draft selection + +The same experimental commands explicitly support the independently released +Policy draft `formatVersion: "1.0.0"` +([ADR-0061](docs/adr/0061-adopt-official-policy-draft-resources.md)). Resources are +pinned to `policy-v1.0.0-draft.1`, Spec commit +`0799b37b74e35c4a86bfbf70f7bee80bdb7bbe94`, in +[the official provenance manifest](internal/policy/official/provenance.json). +The full published archive is retained with exact source paths and per-file +hashes, including the public HTTPS schemas, prose, complete 124-row corpus, +examples, reference reader and its frozen dependencies. Runtime verifies that +inventory before schema compilation and in the release gate; it fetches nothing. +This is draft support through the existing experimental surface. Runtime's +conformance claim remains solely in [CONFORMANCE.md](CONFORMANCE.md). + +Default `contract` output and all prototype reports keep their existing bytes +and shape for strict clients. Explicit discovery returns a separate +`registryVersion: "1"` report; selecting one contract returns that format's +provenance and capabilities: ```bash jpack experimental policy contract --all-formats --format json jpack experimental policy contract --format-version 1.0.0 --format json -jpack experimental policy init --kind policy --format-version 1.0.0 --id urn:example:candidate --version 7.3.42 +jpack experimental policy init --kind policy --format-version 1.0.0 --id urn:example:policy --version 7.3.42 jpack experimental policy schema --kind governing-adoption --format-version 1.0.0 -jpack experimental policy check candidate-adoption.json --materials retained-materials.json --format json +jpack experimental policy check adoption.json --materials retained-materials.json --format json ``` `--all-formats` and contract `--format-version` are mutually exclusive. Documents -with `formatVersion` select the candidate grammar explicitly; supported prototype -inputs continue using their exact wrapper. An optional `--format-version 1.0.0` -on canonicalize/digest/validate/check also selects candidate refusal handling for -malformed or selector-less input. It does not insert a missing selector, rewrite -an artifact or migrate bytes. Candidate Policies use `workspace-managed` or -`externally-managed`; `desk-managed` is refused. Artifact `version` remains -independent of the format selector. Candidate adoption requires retained -candidate Policy bytes; prototype Policies cannot satisfy those references. - -Candidate reports identify `formatVersion`, `proposed-draft` maturity, their -exact source pin and `candidateCapabilities`. Only a full candidate `check` -includes `candidateResult`, whose complete value is one of: +with `formatVersion` select the draft grammar explicitly; supported prototype +inputs continue using their exact wrapper. Optional `--format-version 1.0.0` on +canonicalize/digest/validate/check also selects draft refusal handling for +malformed or selector-less input. The document must still carry its exact +selector. No tool inserts it, migrates bytes or changes a Job or approval. +Draft Policies use `workspace-managed` or `externally-managed`; `desk-managed` is +refused. Artifact `version` remains independent of the format selector. Draft +adoptions require retained 1.0.0 Policy bytes; prototype Policies cannot satisfy +those references. + +Explicit 1.0.0 reports identify `profile: "jps-policy-companion"`, +`profileVersion` and `formatVersion: "1.0.0"`, `maturity: "draft"`, the immutable +source commit and its `spec/policy.md` URL. The existing `candidateCapabilities` +member now contains the exact official draft capability artifact. Only a full +`check` includes `candidateResult`, whose complete value is one of: ```json -{"status":"valid","formatVersion":"1.0.0","maturity":"proposed-draft"} +{"status":"valid","formatVersion":"1.0.0","maturity":"draft"} {"status":"refused","code":"invalid-selector"} ``` The finite refusal codes and phase ordering are defined by the -[pinned candidate contract](internal/policy/candidate/README.md#5-resource-limits-and-refusal-classifications). +[pinned draft contract](internal/policy/official/spec/policy.md#5-resource-limits-and-refusal-classifications). Runtime retains exit 0 for success, 1 for invalid content and 2 for unsupported -input; the nested result supplies the portable candidate classification. -Environment failures are operational errors and provide no candidate result. -Canonicalize/digest establish encoding and identity only; validate checks closed -document forms and local references, with retained materials unchecked. Their -reports omit `candidateResult`. - -The Go harness compares all 124 exact portable result objects, acquiring vector -sources lazily and preserving raw Pack numbers and every retained-byte identity. -It uses the shared registration/checking engine directly: valid distinct-byte -bundles can exceed the private 24 MiB JSON/base64 carrier or MCP's 16 MiB request -limit, especially when identical bytes are registered under multiple media -types. Those transport ceilings are unchanged. Agreement with these vectors -supplies no independently authored implementation evidence, approval, current -authority or permission. +input; the nested result supplies the portable classification. Environment +failures supply no portable result. Canonicalize/digest establish encoding and +identity only; validate checks document forms and local references and leaves +retained materials unchecked. These narrower reports omit `candidateResult`. +The scopes are `closed-draft-document-and-local-references` for validate and +`draft-supplied-exact-bytes-anchors-and-scoped-core-references` for check. +`experimental` stays true and `fullDocumentConformance`, approval, execution, +live-authority and network-acquisition capabilities stay false. Full Core +semantics and evaluation remain outside these checks. + +**Migration from Runtime v0.36.0:** explicit 1.0.0 report metadata changes from +`proposed-draft` to `draft`, with a new source pin, URL, capability exclusions and +scope strings. Strict report consumers must deliberately update their Runtime +and Spec pins and expected metadata. The report member names, output/contract +versions, refusal codes and exact Policy/adoption grammar remain unchanged. +Candidate reports retained from the old Runtime keep their original source and +maturity; they are historical evidence, never relabeled. The old +[candidate vendor tree](internal/policy/candidate/provenance.json) and prototype +bytes remain frozen. Promotion changes no Policy/adoption, Pack, source, +narrative or review-basis bytes. Prototype migration requires the separate +[explicit migration](internal/policy/official/conformance/policy/1.0.0/MIGRATION.md), +new immutable identities and dependent review; nothing migrates implicitly. + +Draft schema reports return self-contained Runtime editing copies with a new +release-specific URN `$id`; `resource.sourceId` names the original immutable +`https://judgmentpack.org/schema/policy/1.0.0/{kind}.schema.json` resource. The +editing copy is not served under the upstream ID. Raw upstream resource bytes +and hashes remain in the official vendor tree. + +The Go harness compares all 124 official portable result objects, acquiring +vector sources lazily and preserving raw Pack numbers and retained-byte +identities. The unchanged reference reader runs against the same retained +archive. Portable tests use the shared raw registration/checking engine: +distinct-byte bundles can exceed the private 24 MiB JSON/base64 carrier or MCP's +16 MiB request limit, especially with repeated bytes under multiple media types. +These ceilings remain unchanged. Agreement is same-vendor implementation +evidence and establishes no stable maturity, independently authored +interoperability, approval, current authority or permission. diff --git a/THIRD_PARTY_NOTICES b/THIRD_PARTY_NOTICES index 650a00d0..d4ff1a6d 100644 --- a/THIRD_PARTY_NOTICES +++ b/THIRD_PARTY_NOTICES @@ -22,6 +22,17 @@ the Apache License, Version 2.0; a copy is in the accompanying LICENSE file, and the required attribution is in NOTICE. The exact upstream revision and per-file SHA-256 digests are recorded in the bundled lock.json. +The same Apache-2.0 attribution covers pinned Policy material under +internal/policy/prototype/, internal/policy/candidate/ and internal/policy/official/. +The prototype and historical proposed candidate retain their original source +bytes and provenance. The official directory embeds the complete immutable +policy-v1.0.0-draft.1 source archive at Spec commit +0799b37b74e35c4a86bfbf70f7bee80bdb7bbe94, including schemas, prose, corpus, +examples, reference Python reader and source dependencies. Its LICENSE and NOTICE +are retained verbatim; provenance.json records the archive and per-file SHA-256 +digests and lengths. These Python sources are retained artifacts, not additional +runtime dependencies. + Apache License 2.0 components (Go modules) ------------------------------------------ diff --git a/docs/adr/0061-adopt-official-policy-draft-resources.md b/docs/adr/0061-adopt-official-policy-draft-resources.md new file mode 100644 index 00000000..a615645c --- /dev/null +++ b/docs/adr/0061-adopt-official-policy-draft-resources.md @@ -0,0 +1,114 @@ +--- +status: proposed +date: 2026-10-19 +deciders: maintainer +--- + +# Adopt immutable official Policy draft resources in the shared offline reader + +## Context and problem statement + +The independent Spec release `policy-v1.0.0-draft.1` publishes the bounded Policy +draft at exact document format `1.0.0`. Runtime v0.36.0 already reads the identical +proposed grammar, but pins historical candidate schemas and reports proposed +maturity. New checks need an explicit immutable official source without changing +retained artifact identities, prototype defaults or host authority. + +## Decision drivers + +- Pin the actual published archive, HTTPS schemas, prose and complete 124-row corpus. +- Reuse the existing bounded reader and its original-byte, typed Pack and URI checks. +- Keep prototype reports byte compatible and historical candidate evidence identifiable. +- Make observable report/schema metadata changes explicit to strict consumers. +- Leave migration, approvals, Jobs, providers and current authority to their owners. + +## Considered options + +- Leave explicit 1.0.0 operations pinned to the unadopted candidate. +- Add a second engine or host authority/profile selection layer for identical grammar. +- Repin explicit 1.0.0 operations to the official draft and retain historical resources. + +## Decision outcome + +Chosen option: repin existing explicit 1.0.0 operations to official draft resources. +The complete 387-file published archive is retained under `internal/policy/official` +with original source paths. Its provenance manifest records release/tag +`policy-v1.0.0-draft.1`, source commit +`0799b37b74e35c4a86bfbf70f7bee80bdb7bbe94`, archive SHA-256 and per-file hashes and +lengths. An independent manifest digest and complete inventory verification guard +schema compilation and the Runtime release check. The original Spec reader and +dependencies remain unchanged and runnable against that archive. No mutable source +is fetched. The old candidate and prototype vendor trees and provenance stay frozen. + +This partially supersedes ADR-0060's determination of the source/maturity for new +explicit 1.0.0 operations. Its dispatch, byte-preservation, URI, transport and +authority boundaries remain in force. Default contract discovery, prototype +reports and `0.0.2` operations retain their exact prior behavior. The all-formats +registry still has version `1` and contains prototype and official draft entries; +there is no separate current candidate selector for the same grammar. + +Explicit 1.0.0 reports keep `outputVersion: "2"`, `contractVersion: "1"`, +`profile: "jps-policy-companion"`, `profileVersion`/`formatVersion: "1.0.0"` and the +existing `candidateCapabilities` and `candidateResult` names. Source revision and +URL now identify the immutable official `spec/policy.md`; maturity becomes `draft`. +`candidateCapabilities` is the exact released capability artifact. Validate's scope +is `closed-draft-document-and-local-references`; check's scope is +`draft-supplied-exact-bytes-anchors-and-scoped-core-references`. + +Only full retained-material checks emit the complete portable result: +`{"status":"valid","formatVersion":"1.0.0","maturity":"draft"}` or the existing +finite refusal object. Narrow encoding/local validation and environmental failures +emit no full-check result. `experimental` remains true because these are the +existing experimental host tools; `fullDocumentConformance`, approval, execution, +live-authority and network-acquisition capabilities stay false. Full Core semantics +and evaluation are outside these checks. No stable or independently authored +interoperability claim is made. The Runtime conformance claim remains solely in +`CONFORMANCE.md`. + +The official raw schemas retain their exact HTTPS `$id` values and bytes. Schema +operations return the existing self-contained editing form under a new derived ID: +`urn:judgmentpack:runtime:experimental-policy:policy-v1.0.0-draft.1:{kind}:authoring-schema:1`. +Its `resource.sourceId` names the immutable official schema. The changed copy is +never labeled with the upstream HTTPS identity or the historical candidate editing +URN. Prototype derived schema identities and report fields stay unchanged. + +The 0.x minor release documents this intentional change to explicit 1.0.0 metadata. +Strict consumers must update their immutable Runtime/Spec pins and exact report +expectations. Report member names and finite results retain the existing protocol +shape, so the global output version does not change. Historical candidate reports +keep their original pin and proposed maturity; they are never relabeled. Promotion +changes no Policy/adoption, Pack, source, narrative or review-basis bytes. Prototype +migration requires separate explicit artifact creation, immutable identities and +dependent snapshot review under the released migration guide. No approval, Job, +permission or host lifecycle migrates. + +### Consequences + +- New explicit draft checks share the complete official corpus and immutable provenance. +- Strict explicit 1.0.0 consumers must update metadata pins before accepting new reports. +- The same shared engine preserves raw Core numbers, URI semantics and private wire limits. +- Revisit when a new exact format or host contract changes the supported boundary. + +## Material decision and review + +Material-decision impact categories: `public-surface`, `documented-claim`, +`conformance`, `security`, `dependency`. Official metadata and editing resource +identity change the public surface; immutable artifact integrity adds a release +gate. The published draft grammar and finite result ordering are reused, including +the existing input bounds and original-byte Core checks. + +The maintainer's standing temporary different-vendor-review waiver applies to this +bounded Policy adoption. The parent coordinator will record the exact reviewed +commit, independent bounded review and any dispositions before merge. A second +Codex agent is same-vendor review and supplies no independent authorship evidence; +the waiver changes no standing repository rule. This proposed record does not +assert completed review, merge or a Runtime release. + +## More information + +- [Original candidate decision](0060-explicit-policy-candidate-format.md) +- [Official source provenance](../../internal/policy/official/provenance.json) +- [Promotion identity map](../../internal/policy/official/conformance/policy/1.0.0/PROMOTION.md) +- [Explicit prototype migration](../../internal/policy/official/conformance/policy/1.0.0/MIGRATION.md) +- [CLI documentation](../../README.md#official-policy-draft-selection) +- [MCP documentation](../mcp-clients.md#explicit-official-draft-selection) diff --git a/docs/adr/README.md b/docs/adr/README.md index bb15b928..d43f2cfa 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -155,4 +155,5 @@ authority, and following it confers no conformance status on anything. | [0056](0056-version-3-dialect-authoring.md) | Check supported version-3 Dialect declarations through shared authoring tools | accepted | | [0057](0057-named-dialect-artifact-identity.md) | Share offline tools for named Dialect artifacts | accepted | | [0059](0059-experimental-offline-policy-tools.md) | Prototype Policy document and retained-reference checks offline | accepted | -| [0060](0060-explicit-policy-candidate-format.md) | Add an explicit Policy contract candidate without changing prototype clients | accepted | +| [0060](0060-explicit-policy-candidate-format.md) | Add an explicit Policy contract candidate without changing prototype clients | accepted; source/maturity for new explicit 1.0.0 operations superseded by [0061](0061-adopt-official-policy-draft-resources.md) | +| [0061](0061-adopt-official-policy-draft-resources.md) | Adopt immutable official Policy draft resources in the shared offline reader | proposed | diff --git a/docs/architecture.md b/docs/architecture.md index 3ed6758a..166a78d6 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -48,25 +48,37 @@ number domain. Source/schema/example provenance pins specification revision resource is fetched at runtime. The shared 16 MiB stdio line bound is unchanged, so JSON/base64 overhead reduces the maximum retained material a call can carry. -The proposed-draft, unadopted Policy contract candidate `1.0.0` is an additional -explicit format ([ADR-0060](adr/0060-explicit-policy-candidate-format.md)). Its -schemas, prose, examples and 124 portable vectors are pinned separately to Spec -commit `0852c5fa7726e51b36e574a5b110e7f5e012e03d`. Format selection, schema and -provenance differ; material identity, UTF-8 anchors and typed Pack coverage use -the same engine. Candidate adoption cannot consume prototype Policy bytes. -No-argument contract discovery and prototype reports retain their exact prior -shape for strict clients. All-format discovery requires explicit CLI -`--all-formats` or MCP `allFormats:true` and returns registry version 1. - -Candidate full checks return a bounded `candidateResult` with exactly the -portable status/code object, separate from Runtime diagnostics and exit status. +Explicit format `1.0.0` selects the official draft resources of +`policy-v1.0.0-draft.1`, pinned to Spec commit +`0799b37b74e35c4a86bfbf70f7bee80bdb7bbe94` +([ADR-0061](adr/0061-adopt-official-policy-draft-resources.md)). The complete +published archive, original source paths and per-file provenance live under +`internal/policy/official`; the independent manifest pin and every file are +verified before schema compilation and by the release gate. The HTTPS source +schema identities stay distinct from derived release-specific Runtime editing +URNs, exposed alongside `resource.sourceId`. The same offline engine handles the +unchanged 1.0.0 grammar, material identity, anchors and typed Pack coverage. +The archived proposed candidate and prototype trees retain their exact bytes and +original metadata. Prototype defaults and reports remain byte compatible; +all-format discovery still requires explicit CLI `--all-formats` or MCP +`allFormats:true` and returns registry version 1. + +Explicit 1.0.0 reports now carry official source provenance and `draft` maturity, +retaining `candidateCapabilities` and `candidateResult` member names. Only full +checks return the exact portable valid/refusal object. Encoding/local validation +retain their narrower scopes. The promotion deliberately changes 1.0.0 metadata, +capability exclusions, scope strings and derived editing schema identity; strict +clients must update their pins. It rewrites no artifact or historical report and +migrates no approval, Job or host authority. The experimental surface and false +full-document-conformance/authority flags remain unchanged. + Root physical bounds, strict JSON, selection and canonical numeric domain precede ordered registration; root schema and semantic checks follow registration. Portable tests defer source acquisition to its phase and use shared raw registration directly. Duplicate media registrations count bytes once but may -repeat base64 on the wire, so candidate agreement never widens the private -24 MiB material JSON or 16 MiB MCP ceiling. No candidate result establishes -current authority, permission, publication, review trust or independent agreement. +repeat base64 on the wire; agreement never widens the private 24 MiB material +JSON or 16 MiB MCP ceiling. No draft result establishes current authority, +permission, publication, review trust, stable conformance or independent agreement. ## Artifact version arithmetic @@ -153,7 +165,7 @@ claim — see [`CONFORMANCE.md`](../CONFORMANCE.md). - `internal/audit` composes and appends the opt-in evaluation records of ADR-0018: one JSON line per completed non-rehearsal evaluation (ADR-0028) — for a non-rehearsal graph evaluation, one per node and one for the composite (ADR-0041) — carrying the pack's identity and the digest of its exact bytes, the facts and evidence documents as they reached the engine, and the disposition as the canonical bytes the run produced rather than a re-serialization of them. It is reached only from a configuration that declared an audit directory, only after the evaluator has returned a result, and only from the three deciding surfaces — the test verbs run the same evaluator and record nothing, and a declared rehearsal records nothing either (ADR-0028). It evaluates nothing, changes no payload, and cannot influence a disposition; it does read a clock, which nothing on the payload path does. A record may carry `cites` (ADR-0033): the gateway receipts the caller said the decision relied on, in the gateway's own `{sessionId, callIndex, signature}` shape, held to that shape and otherwise recorded as given — the runtime verifies no receipt and reads no store. A record of `experimental evaluate` or the MCP `experimental_evaluate` tool may also carry `binding` (ADR-0050): a caller's `{kind, digest}` commitment to material of its own, held to that shape (`audit.ParseBinding`, which `audit.Verify` applies to a recorded one, reporting `binding-malformed`) and otherwise recorded as given — the runtime never interprets, verifies or recomputes it. The trail is chained unless the configuration says `chain: false` (ADR-0047 §1): each record carries `trail`, `sequence` and `previous`, the SHA-256 of the exact bytes of the line before it, assigned while the writer holds an exclusive lock on the trail file that `internal/fssecure` takes (`Root.AppendLocked`); nothing read from the trail is re-encoded. `audit.Verify` checks a trail by the same rules, over its exact bytes, from a snapshot whose size `fssecure.SizeBetweenWrites` reads under the lock, shared; `Writer.Repair` appends a discontinuity record after a torn last line and rewrites nothing; and the `jpack audit` commands in `internal/cli` drive them. The same reading lists the checkpoint of every chained record after a sequence, for a deliverer to hand to a holder, and holds a trail to the checkpoints a holder kept, reporting the records none covers as unwitnessed (ADR-0047 §2a); no hand-over is recorded or waited for. A writer given a signing key (`Writer.SignWith`, the key the project's `audit.signingKey` or `JPACK_SIGNING_KEY` names, loaded by `audit.LoadSigner`, which walks the key's path a directory at a time with each held open, refuses a symbolic link anywhere in it and the project's directory by identity, holds the key to its owner alone, and, when `audit.signingPublicKey` or `JPACK_SIGNING_PUBLIC_KEY` names the public key it is expected to have, refuses a seed whose public key is another; on a platform without unix ownership and modes, Windows among them, every key is refused) signs each chained record it appends in the `signatures.jsonl` sidecar beside the trail (ADR-0047 §2b): the signing runs in the step `fssecure.Root.AppendLockedThen` takes after the trail's write and syncs and before the lock is released, so the sidecar follows the trail line for line, and a signature that cannot be written leaves the record unsigned, never the decision failed. `Writer.Rotate` hands signing to a next key with a line the current key signs. `audit.Verify` reads the sidecar in step with the trail, a line at a time, when the verifier supplies public keys, from sizes `fssecure.SizesBetweenWrites` reads under the one shared lock. `jpack audit stamp` asks an RFC 3161 authority to stamp the current checkpoint's digest, through `internal/timestamp` (the request, the HTTP transport and the token's parsing and verification, on `encoding/asn1` and `crypto/x509` alone), and keeps the token with `Writer.RecordStamp` in `stamps.jsonl` under that file's own lock; nothing on the decision path reaches it (ADR-0047 §2a). `audit.Verify` checks those tokens against the verifier's roots before the trail is read, matches their checkpoints against it as it is read, and reports the lag between each covered record's `at` and its first stamp. None of them is an MCP tool. - `internal/lock` implements the reviewed-set lock (ADR-0019): a generated, deterministic sibling of `jpack.json` pinning the digest of the configuration's exact bytes and of every declared pack and graph — not a declared matrix or rows document, which no deciding surface applies. Its presence is the whole of the opt-in — no configVersion moves and the configuration schema does not name it, because a configuration that named its own lock could rename it. `packs lock` writes it, `packs verify` names every difference from it, and the three deciding surfaces hold the law one evaluation applies to it before evaluating — a declared rehearsal excepted (ADR-0028); the rehearsal verbs consult it never. It decides nothing about whether a change was right: an amendment and a tampering are the same act to a runtime, and it is not a wall against an editor that re-locks. - `internal/compare` evaluates one set of inputs, a matrix admitted under its own rules whose expectations play no part, or a `packs suggest` candidates document, under two versions of a pack through `internal/evaluation` unchanged, and reports the inputs whose §8.3 canonical dispositions, handoff targets or refusals differ (ADR-0045). It opens no project, so it records nothing and consults no lock, and a difference it reports is not an expectation. -- `internal/policy` owns the experimental offline Policy prototype document and supplied-material checks of ADR-0059; it performs no evaluation or source acquisition. +- `internal/policy` owns the experimental offline Policy prototype and official draft document and supplied-material checks of ADR-0059 and ADR-0061; it performs no evaluation or source acquisition. - `internal/cli` owns commands, streams, and human/JSON rendering. - `internal/mcp` adapts the offline core onto Model Context Protocol tools over stdio. - `tools/sync-spec-artifacts` is an explicit maintainer-only snapshot importer. diff --git a/docs/mcp-clients.md b/docs/mcp-clients.md index 4095a581..68cf43f9 100644 --- a/docs/mcp-clients.md +++ b/docs/mcp-clients.md @@ -53,7 +53,7 @@ gitignored in this repository. Copy a snippet, don't commit one. | `describe_runtime` | Versions and artifact provenance | | `list_examples` / `get_example` | The embedded valid fixtures, read-only; `spec_version` chooses the bundled version, and the evaluator admits `0.2.0-draft` | | `list_packs` / `get_pack` | This project's own packs, by decision id, through its `jpack.json` | -| `experimental_get_policy_contract` / `experimental_policy_init` / `experimental_get_policy_schema` | EXPERIMENTAL: exact nonnormative Policy prototype capabilities, starter templates and schemas; no project reads or writes | +| `experimental_get_policy_contract` / `experimental_policy_init` / `experimental_get_policy_schema` | EXPERIMENTAL: exact Policy prototype or explicitly selected official draft capabilities, starter templates and schemas; no project reads or writes | | `experimental_policy_canonicalize` / `experimental_policy_digest` / `experimental_policy_validate` / `experimental_policy_check` | EXPERIMENTAL: supplied Policy document identity, local checks and retained-material reference checks; no evaluation or authority | | `experimental_evaluate` | EXPERIMENTAL SURFACE (ADR-0007): the §§7–8 resolution model; claim and scope in [`CONFORMANCE.md`](../CONFORMANCE.md) | | `experimental_get_test_matrix_contract` | EXPERIMENTAL: discover the project matrix version, closed members, types and authoring rules without reading a project | @@ -446,8 +446,7 @@ caller. Clients discover the capability through `tools/list`. CLI equivalent: Discover `experimental_get_policy_contract` before using this additive offline surface ([ADR-0059](adr/0059-experimental-offline-policy-tools.md)). All seven -tools serve the exact nonnormative RFC 0023 prototype `0.0.2`; the RFC remains -Draft. No stable Policy format is implied. Schema resources are self-contained +tools retain the exact nonnormative RFC 0023 prototype `0.0.2`. No stable Policy format is implied. Schema resources are self-contained Runtime editing copies derived from pinned prototype schemas. Reports carry experimental status, pinned provenance, capability scope and diagnostics shared with the CLI. @@ -463,7 +462,8 @@ pinned provenance, capability scope and diagnostics shared with the CLI. | `experimental_policy_check` | `document` and `materials`, exact JSON text strings | `kind` is exactly `policy` or `governing-adoption`; `formatVersion` is exactly -`0.0.2`. The explicit artifact `id` and `version` are separate from that format. +`0.0.2` for prototype use, or `1.0.0` for explicit official draft selection below. +The explicit artifact `id` and `version` are separate from that format. Unknown members, duplicate members, wrong case, missing required arguments and null argument values are refused. Malformed or missing arguments are tool errors. Well-typed unsupported selectors, invalid artifact identities, and invalid document or retained-material content @@ -500,41 +500,57 @@ RPC framing consume more space. Consequently, not every bundle under the 16 MiB retained-byte limit fits a single MCP request. A client must bound the complete encoded request; CLI named-file input supports the larger material JSON envelope. -### Explicit proposed-draft candidate selection +### Explicit official draft selection -The seven existing tools also serve the unadopted Policy contract candidate -`1.0.0`, at `proposed-draft` maturity, pinned to Spec commit -`0852c5fa7726e51b36e574a5b110e7f5e012e03d` -([ADR-0060](adr/0060-explicit-policy-candidate-format.md)). Calling contract +The seven existing tools also serve official Policy draft format `1.0.0`, pinned +to `policy-v1.0.0-draft.1` at Spec commit +`0799b37b74e35c4a86bfbf70f7bee80bdb7bbe94` +([ADR-0061](adr/0061-adopt-official-policy-draft-resources.md)). Calling contract without arguments or with `{}` returns the exact existing prototype report. -`{allFormats:true}` explicitly requests the separate registry version 1; -`{formatVersion:"1.0.0"}` selects the candidate contract. These two arguments -are mutually exclusive. `{formatVersion:"0.0.2"}` selects the prototype contract. - -Init/schema require the exact selected `formatVersion` as before. Document tools -accept an optional `formatVersion` string for explicit dispatch, including -candidate classification of malformed or selector-less bytes. The document -still must carry its own exact selector; no tool inserts or rewrites it. -Without an operation selector, a document carrying `formatVersion` dispatches -to the candidate; existing prototype documents retain their behavior. Candidate -Policies use `workspace-managed` or `externally-managed`, never an alias of the -prototype's `desk-managed`. Candidate adoption requires candidate Policy bytes. - -Candidate reports include their own `formatVersion`, source provenance, maturity -and exact `candidateCapabilities` artifact. Only full candidate checks add -`candidateResult`, exactly the portable valid object -`{status:"valid",formatVersion:"1.0.0",maturity:"proposed-draft"}` or refusal -`{status:"refused",code:"…"}`. Their bounded finite codes follow the -[pinned candidate contract](../internal/policy/candidate/README.md#5-resource-limits-and-refusal-classifications). -Encoding/local validation omit that field; operational failures supply no -candidate result. MCP sets `isError:true` on refusals. Neither result format -asserts current authority, permission, trusted review or standard conformance. - -Candidate physical bounds and strict JSON parsing precede selector/canonical -checks, then ordered registration precedes document schema and reference checks. -Retained artifact byte pins are checked before parsing and optional canonical -identity. Pack bytes go unchanged to Core structural validation. The private -material carrier and the 16 MiB stdio request ceiling remain unchanged; duplicate -base64 registrations can exceed a transport ceiling even when their distinct -retained bytes fit the candidate. Passing portable raw-input vectors therefore -promises no larger encoded envelope or independent interoperability evidence. +`{allFormats:true}` explicitly requests registry version 1; +`{formatVersion:"1.0.0"}` selects the official draft contract. The selectors are +mutually exclusive. `{formatVersion:"0.0.2"}` selects the prototype contract. + +Init/schema require the exact selected `formatVersion`. Document tools accept +an optional `formatVersion` string for explicit dispatch, including draft +classification of malformed or selector-less bytes. The document must still carry +its own selector; no tool inserts or rewrites it. Without an operation selector, +a strict document carrying `formatVersion` dispatches to the draft. Draft Policies +use `workspace-managed` or `externally-managed`, never the prototype's +`desk-managed`. Draft adoption requires retained 1.0.0 Policy bytes. + +Explicit draft reports carry `profile:"jps-policy-companion"`, +`profileVersion`/`formatVersion:"1.0.0"`, `maturity:"draft"`, the exact new +`specRevision` and its immutable `spec/policy.md` URL. The existing +`candidateCapabilities` member is the exact official artifact. Only full checks +add `candidateResult`, exactly `{status:"valid",formatVersion:"1.0.0",maturity:"draft"}` +or `{status:"refused",code:"…"}`. Finite codes follow the +[pinned draft contract](../internal/policy/official/spec/policy.md#5-resource-limits-and-refusal-classifications). +Encoding/local validation omit that result; operational failures supply none. +MCP sets `isError:true` on refusals. Validate's scope is +`closed-draft-document-and-local-references`; check's scope is +`draft-supplied-exact-bytes-anchors-and-scoped-core-references`. +`experimental` remains true, and `fullDocumentConformance`, approval, execution, +live-authority and network-acquisition capabilities remain false. + +Strict v0.36.0 consumers must explicitly update their Runtime/Spec pins and exact +metadata expectations: maturity, provenance URL/commit, capability exclusions, +scope strings and the derived editing schema ID change. Existing member names, +`outputVersion:"2"`, `contractVersion:"1"`, refusal codes and document grammar +stay unchanged. `resource.sourceId` identifies the immutable official HTTPS schema; +the self-contained editing copy has a separate Runtime URN containing the release +tag. The complete published archive and manifest are retained under +`internal/policy/official`. Historical candidate reports and vendor bytes keep +their original proposed maturity and provenance. No Policy/adoption/retained bytes, +approvals, Jobs or host authority migrate automatically. + +Draft physical bounds and strict JSON parsing precede selector/canonical checks, +then ordered registration precedes document schema and reference checks. Retained +artifact byte pins precede parsing and optional canonical identity. Pack bytes go +unchanged to Core structural validation. The private material carrier and the +16 MiB stdio request ceiling remain unchanged; repeated base64 registrations can +exceed a transport ceiling while their distinct retained bytes fit the draft. +The Go reader's agreement with all 124 exact official results and the retained +reference reader supplies same-vendor evidence. It establishes no stable maturity, +independently authored interoperability, current authority, permission or trusted +review. Runtime's conformance claim remains solely in [CONFORMANCE.md](../CONFORMANCE.md). diff --git a/docs/releasing.md b/docs/releasing.md index 221f5744..64a523a2 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -46,6 +46,16 @@ expected bundle digest. Review one lock per bundled version: the release gate ch only the version a surface selects by default. Update the embedded registry only when adding a new specification version. +Policy draft resources are independently pinned under `internal/policy/official/`, +with the complete `policy-v1.0.0-draft.1` archive's original source paths. Its +provenance records the immutable release/tag, exact Spec commit, archive digest and +per-file bytes. `tools/check-release` also verifies the independent Policy manifest +pin and full embedded inventory. Updating these resources requires an explicit +reviewed artifact change and appropriate CLI version increment; it never rewrites +the retained prototype or historical candidate trees or the Core locks. Policy +source schema IDs stay distinct from derived Runtime editing schema IDs. See +[ADR-0061](adr/0061-adopt-official-policy-draft-resources.md) for compatibility. + ## Validate locally Install the exact GoReleaser version used by the workflow, then run: diff --git a/internal/cli/policy.go b/internal/cli/policy.go index 6976763a..f0be5a09 100644 --- a/internal/cli/policy.go +++ b/internal/cli/policy.go @@ -13,8 +13,8 @@ import ( func (a *App) policyCommand() *cobra.Command { group := &cobra.Command{ - Use: "policy", Short: "EXPERIMENTAL: offline Policy prototype and proposed-draft candidate tools", - Long: "Offline tools for the nonnormative RFC 0023 Policy prototype 0.0.2 and unadopted proposed-draft candidate 1.0.0. Discover candidates explicitly with contract --all-formats; no-argument contract retains the prototype contract. Validate checks document forms and local references. Check also checks the exact supplied retained-material closure and specific Core references; it does not perform full Core semantic validation or evaluate anything. No approval, governing-adoption authority, publication, billing or source access is established. This experimental surface may change without compatibility promise.", + Use: "policy", Short: "EXPERIMENTAL: offline Policy prototype and official draft tools", + Long: "Offline tools for the nonnormative RFC 0023 Policy prototype 0.0.2 and independently released Policy draft 1.0.0. Discover formats explicitly with contract --all-formats; no-argument contract retains the prototype contract. Validate checks document forms and local references. Check also checks the exact supplied retained-material closure and specific Core references; it does not perform full Core semantic validation or evaluate anything. No approval, governing-adoption authority, publication, billing or source access is established. This experimental surface may change without compatibility promise.", Args: cobra.NoArgs, RunE: func(cmd *cobra.Command, _ []string) error { return cmd.Help() }, } for _, operation := range []string{"contract", "init", "schema", "canonicalize", "digest", "validate", "check"} { @@ -32,7 +32,7 @@ func (a *App) policyOperation(operation string) *cobra.Command { args = cobra.ExactArgs(1) } descriptions := map[string]string{ - "contract": "Describe capabilities and pinned provenance; opt into candidate discovery explicitly", + "contract": "Describe capabilities and pinned provenance; select the official draft explicitly", "init": "Print a starter template; missing retained materials remain unchecked", "schema": "Print the schema for an explicitly selected Policy kind and format", "canonicalize": "Print canonical document bytes; encoding success is not validation", @@ -78,7 +78,7 @@ func (a *App) policyOperation(operation string) *cobra.Command { case "schema": report, code = policy.Schema(command, kind, profileVersion) default: - data, err := a.readInput(operands[0], policy.MaxDocumentBytes, "Policy prototype document") + data, err := a.readInput(operands[0], policy.MaxDocumentBytes, "Policy document") if errors.Is(err, fssecure.ErrTooLarge) { data = make([]byte, policy.MaxDocumentBytes+1) } else if err != nil { @@ -120,9 +120,9 @@ func (a *App) policyOperation(operation string) *cobra.Command { switch operation { case "contract": if registry != nil { - _, err = fmt.Fprintf(a.out, "Policy format registry 1 · EXPERIMENTAL\n0.0.2 · nonnormative prototype · %s\n1.0.0 · proposed-draft candidate, unadopted · %s\nSelect a format explicitly for init/schema. No authority or conformance is established.\n", policy.SpecURL, policy.CandidateURL) + _, err = fmt.Fprintf(a.out, "Policy format registry 1 · EXPERIMENTAL\n0.0.2 · nonnormative prototype · %s\n1.0.0 · official Policy draft · %s\nSelect a format explicitly for init/schema. No authority or conformance is established.\n", policy.SpecURL, policy.DraftURL) } else if report.FormatVersion == policy.CandidateVersion { - _, err = fmt.Fprintf(a.out, "Policy candidate %s · EXPERIMENTAL · proposed-draft, unadopted\nSpecification: %s\nKinds: policy, governing-adoption\nNo approval, current authority or standard conformance is established.\n", report.FormatVersion, report.Specification) + _, err = fmt.Fprintf(a.out, "Policy draft %s · EXPERIMENTAL · draft maturity\nSpecification: %s\nKinds: policy, governing-adoption\nNo approval, current authority or standard conformance is established.\n", report.FormatVersion, report.Specification) } else { _, err = fmt.Fprintf(a.out, "Policy tools · EXPERIMENTAL · nonnormative prototype %s\nSpecification: %s\nKinds: policy, governing-adoption\nOperations: contract, init, schema, canonicalize, digest, validate, check\nValidate checks document forms and local references. Check checks exact supplied retained materials and specific Core references, without full Core semantic validation or evaluation.\nNo approval, governing-adoption authority or standard conformance is established.\n", policy.PrototypeVersion, policy.SpecURL) } @@ -132,13 +132,13 @@ func (a *App) policyOperation(operation string) *cobra.Command { _, err = fmt.Fprintln(a.out, report.CanonicalDigest) case "validate": if report.FormatVersion == policy.CandidateVersion { - _, err = fmt.Fprintln(a.out, "Proposed-draft candidate document and local-reference checks passed. Retained materials were not checked; no authority is established.") + _, err = fmt.Fprintln(a.out, "Policy draft document and local-reference checks passed. Retained materials were not checked; no authority is established.") } else { _, err = fmt.Fprintln(a.out, "Prototype document and local-reference checks passed. Retained materials were not checked; no authority is established.") } case "check": if report.FormatVersion == policy.CandidateVersion { - _, err = fmt.Fprintln(a.out, "Proposed-draft candidate retained-material and reference checks passed. Full Core semantics and evaluation were not checked; no authority is established.") + _, err = fmt.Fprintln(a.out, "Policy draft retained-material and reference checks passed. Full Core semantics and evaluation were not checked; no authority is established.") } else { _, err = fmt.Fprintln(a.out, "Prototype retained-material and reference checks passed. Full Core semantics and evaluation were not checked; no authority is established.") } @@ -163,7 +163,7 @@ func (a *App) policyOperation(operation string) *cobra.Command { if operation == "init" || operation == "schema" { c.Flags().StringVar(&kind, "kind", "", "required exact kind: policy or governing-adoption") } - c.Flags().StringVar(&profileVersion, "format-version", "", "exact format: prototype 0.0.2 or proposed-draft candidate 1.0.0; required for init/schema, optional explicit dispatch otherwise") + c.Flags().StringVar(&profileVersion, "format-version", "", "exact format: prototype 0.0.2 or official draft 1.0.0; required for init/schema, optional explicit dispatch otherwise") if operation == "contract" { c.Flags().BoolVar(&allFormats, "all-formats", false, "explicitly discover all formats in registry version 1") } diff --git a/internal/cli/policy_candidate_test.go b/internal/cli/policy_candidate_test.go index 2319e9be..c3710cd8 100644 --- a/internal/cli/policy_candidate_test.go +++ b/internal/cli/policy_candidate_test.go @@ -18,7 +18,7 @@ import ( func candidateCLIBytes(t *testing.T, name string) string { t.Helper() - raw, err := os.ReadFile(filepath.Join("..", "policy", "candidate", "examples", "refunds", name)) + raw, err := os.ReadFile(filepath.Join("..", "policy", "official", "conformance", "policy", "1.0.0", "examples", "refunds", name)) if err != nil { t.Fatal(err) } @@ -115,7 +115,7 @@ func TestPolicyCandidateCLIAndMCPParity(t *testing.T) { if !reflect.DeepEqual(actual, other) { t.Fatalf("candidate CLI/MCP mismatch\n%v\n%v", actual, other) } - if actual["specRevision"] != policy.CandidateRevision || actual["maturity"] != "proposed-draft" { + if actual["specRevision"] != policy.DraftRevision || actual["maturity"] != "draft" { t.Fatal("candidate provenance") } if tc.operation == "check" { @@ -134,7 +134,7 @@ func TestPolicyCandidateCLIAndMCPParity(t *testing.T) { args = append(args, "--materials", materialPath) } exit, stdout, stderr := runTest(t, args, candidateCLIBytes(t, "policy.json")) - if exit != 0 || stderr != "" || !strings.Contains(stdout, "Proposed-draft candidate") { + if exit != 0 || stderr != "" || !strings.Contains(stdout, "Policy draft") { t.Fatalf("candidate human output %d %s %s", exit, stdout, stderr) } } @@ -186,3 +186,37 @@ func TestPolicyExplicitContractDiscoveryParity(t *testing.T) { } } } + +func TestPolicyOfficialDraftInitSchemaParity(t *testing.T) { + for _, operation := range []string{"init", "schema"} { + for _, kind := range []string{"policy", "governing-adoption"} { + t.Run(operation+"/"+kind, func(t *testing.T) { + args := []string{"experimental", "policy", operation, "--kind", kind, "--format-version", "1.0.0", "--format", "json"} + input := map[string]any{"kind": kind, "formatVersion": "1.0.0"} + name := "experimental_get_policy_schema" + if operation == "init" { + args = append(args, "--id", "urn:test:draft", "--version", "7.3.42") + input["id"], input["version"] = "urn:test:draft", "7.3.42" + name = "experimental_policy_init" + } + exit, stdout, stderr := runTest(t, args, "") + if exit != 0 || stderr != "" { + t.Fatal(exit, stdout, stderr) + } + var actual map[string]any + if err := json.Unmarshal([]byte(stdout), &actual); err != nil { + t.Fatal(err) + } + other, isError := candidateMCPReply(t, name, input) + delete(actual, "command") + delete(other, "command") + if isError || !reflect.DeepEqual(actual, other) || actual["specRevision"] != policy.DraftRevision || actual["specification"] != policy.DraftURL || actual["maturity"] != "draft" || actual["candidateResult"] != nil { + t.Fatal("official init/schema CLI/MCP mismatch", actual, other) + } + if operation == "schema" && actual["resource"].(map[string]any)["sourceId"] != "https://judgmentpack.org/schema/policy/1.0.0/"+kind+".schema.json" { + t.Fatal("missing official schema identity") + } + }) + } + } +} diff --git a/internal/mcp/policy.go b/internal/mcp/policy.go index d2f5a993..b4d0c07a 100644 --- a/internal/mcp/policy.go +++ b/internal/mcp/policy.go @@ -17,9 +17,9 @@ func policyToolName(operation string) string { func policyDefinition(operation string) map[string]any { descriptions := map[string]string{ - "contract": "With no selectors, discover the unchanged pinned RFC 0023 prototype 0.0.2. Explicit allFormats:true discovers registry version 1; formatVersion selects one contract, mutually exclusive. Candidate 1.0.0 is proposed-draft and unadopted. Reports exact kinds, capabilities and limits. Experimental; no project reads, persistence, evaluation or authority.", - "init": "Return a nonnormative Policy companion starter template for an explicitly selected kind, format and identity. Retained materials are missing and unchecked. The client saves it; no publication, approval or governing-adoption authority is established.", - "schema": "Return a self-contained Runtime editing schema derived from pinned nonnormative prototype resources for an explicit kind and explicit prototype 0.0.2 or proposed-draft candidate 1.0.0. Use validate for strict document and local-reference checks. Offline; no project reads or writes.", + "contract": "With no selectors, discover the unchanged pinned RFC 0023 prototype 0.0.2. Explicit allFormats:true discovers registry version 1; formatVersion selects one contract, mutually exclusive. Explicit 1.0.0 selects the immutable official Policy draft release; this experimental host surface establishes no stable conformance. Reports exact kinds, capabilities and limits. Experimental; no project reads, persistence, evaluation or authority.", + "init": "Return a Policy companion starter template for an explicitly selected kind, format and identity. Retained materials are missing and unchecked. The client saves it; no publication, approval or governing-adoption authority is established.", + "schema": "Return a self-contained Runtime editing schema derived from pinned prototype or official draft resources for an explicit kind and explicit prototype 0.0.2 or official draft 1.0.0. Use validate for strict document and local-reference checks. Offline; no project reads or writes.", "canonicalize": "Return canonical Policy companion document bytes and separate canonical/raw byte digests. Encoding success is not document validation, retained-material verification or authority. Experimental; no files read or written.", "digest": "Return the canonical Policy companion digest and separate raw-byte identity. Encoding success is not validation or authority. Experimental; no files read or written.", "validate": "Check exact Policy companion document JSON for strict forms, schema and local references. Does not check retained materials, full Core semantics, evaluation, approval or governing-adoption authority. Experimental; no files read or written.", @@ -29,7 +29,7 @@ func policyDefinition(operation string) map[string]any { schema := map[string]any{"type": "object", "additionalProperties": false, "properties": properties} if operation == "init" || operation == "schema" { properties["kind"] = map[string]any{"type": "string", "enum": []string{"policy", "governing-adoption"}} - properties["formatVersion"] = map[string]any{"type": "string", "enum": []string{policy.PrototypeVersion, policy.CandidateVersion}, "description": "Exact prototype 0.0.2 or unadopted proposed-draft candidate 1.0.0; no format is selected by default."} + properties["formatVersion"] = map[string]any{"type": "string", "enum": []string{policy.PrototypeVersion, policy.CandidateVersion}, "description": "Exact prototype 0.0.2 or official draft 1.0.0; no format is selected by default."} schema["required"] = []string{"kind", "formatVersion"} if operation == "init" { properties["id"] = map[string]any{"type": "string", "description": "Explicit absolute artifact URI identifier."} @@ -45,7 +45,7 @@ func policyDefinition(operation string) map[string]any { properties["allFormats"] = map[string]any{"type": "boolean", "description": "Explicit opt-in to registry version 1; mutually exclusive with formatVersion."} } if operation != "init" && operation != "schema" { - properties["formatVersion"] = map[string]any{"type": "string", "description": "Optional exact format selection: 0.0.2 prototype or 1.0.0 proposed-draft candidate. Candidate selection also classifies malformed/missing document selectors. No automatic migration."} + properties["formatVersion"] = map[string]any{"type": "string", "description": "Optional exact format selection: 0.0.2 prototype or 1.0.0 official draft. Explicit draft selection also classifies malformed/missing document selectors. No automatic migration."} } if operation == "check" { properties["materials"] = map[string]any{"type": "string", "maxLength": policy.MaxMaterialsWireBytes, "description": fmt.Sprintf("Exact retained-material JSON text: {materials:[{content:{bytesDigest,byteLength,mediaType},dataBase64}]}. No paths/URLs. Maximum decoded JSON text %d bytes; stdio's %d-byte line limit can be reached first after JSON/base64 overhead.", policy.MaxMaterialsWireBytes, maxMessageBytes)} diff --git a/internal/mcp/policy_test.go b/internal/mcp/policy_test.go index ce2d1615..e9f3bda4 100644 --- a/internal/mcp/policy_test.go +++ b/internal/mcp/policy_test.go @@ -102,13 +102,14 @@ func TestPolicyCandidateDiscoveryStrictArguments(t *testing.T) { for _, args := range []string{ `{"allFormats":true,"formatVersion":"1.0.0"}`, `{"allFormats":null}`, `{"allFormats":"true"}`, `{"AllFormats":true}`, `{"allFormats":true,"allFormats":true}`, `{"formatVersion":null}`, + `{"formatVersion":false}`, `{"formatVersion":0}`, } { reply := runServer(t, rawToolCall(t, 1, "experimental_get_policy_contract", args))[0]["result"].(map[string]any) if reply["isError"] != true || reply["structuredContent"] != nil { t.Fatal(args, reply) } } - for _, args := range []string{`{"document":"{}","formatVersion":null}`, `{"document":"{}","FormatVersion":"1.0.0"}`} { + for _, args := range []string{`{"document":"{}","formatVersion":null}`, `{"document":"{}","formatVersion":false}`, `{"document":"{}","formatVersion":0}`, `{"document":"{}","FormatVersion":"1.0.0"}`} { reply := runServer(t, rawToolCall(t, 1, "experimental_policy_validate", args))[0]["result"].(map[string]any) if reply["isError"] != true || reply["structuredContent"] != nil { t.Fatal(args, reply) diff --git a/internal/policy/candidate_schema.go b/internal/policy/candidate_schema.go index 1927d4ae..5a0586f7 100644 --- a/internal/policy/candidate_schema.go +++ b/internal/policy/candidate_schema.go @@ -13,6 +13,8 @@ import ( var candidate embed.FS const candidateCommonID = "urn:jps:proposal:policy-companion:1.0.0:common" +const draftSchemaPrefix = "https://judgmentpack.org/schema/policy/1.0.0/" +const draftCommonID = draftSchemaPrefix + "common.schema.json" var candidateSchemasOnce sync.Once var candidateSchemas map[string]*jsonschema.Schema @@ -20,24 +22,28 @@ var candidateSchemasError error func schemaSource(version string) (embed.FS, string, string, string) { if version == CandidateVersion { - return candidate, candidateFormat.directory, candidateFormat.commonURI, candidateFormat.revision + return official, candidateFormat.directory, candidateFormat.commonURI, candidateFormat.revision } return prototype, prototypeFormat.directory, prototypeFormat.commonURI, prototypeFormat.revision } func loadCandidateSchemas() (map[string]*jsonschema.Schema, error) { candidateSchemasOnce.Do(func() { + if err := VerifyOfficialArtifacts(); err != nil { + candidateSchemasError = err + return + } resources := map[string][]byte{} for _, name := range []string{"common", "policy", "governing-adoption"} { - raw, err := candidate.ReadFile("candidate/" + name + ".schema.json") + raw, err := official.ReadFile(candidateFormat.directory + "/" + name + ".schema.json") if err != nil { candidateSchemasError = err return } - resources["urn:jps:proposal:policy-companion:1.0.0:"+name] = raw + resources[draftSchemaPrefix+name+".schema.json"] = raw } candidateSchemas = map[string]*jsonschema.Schema{} - for name, id := range map[string]string{"common": candidateCommonID, "uri": candidateCommonID + "#/$defs/uri", "policy": "urn:jps:proposal:policy-companion:1.0.0:policy", "governing-adoption": "urn:jps:proposal:policy-companion:1.0.0:governing-adoption"} { + for name, id := range map[string]string{"common": draftCommonID, "uri": draftCommonID + "#/$defs/uri", "policy": draftSchemaPrefix + "policy.schema.json", "governing-adoption": draftSchemaPrefix + "governing-adoption.schema.json"} { s, err := compileCandidateSchemas(resources, id) if err != nil { candidateSchemasError = err @@ -71,7 +77,7 @@ func candidateSchema(name string, value any) (*issue, int) { } schemas, err := loadCandidateSchemas() if err != nil { - return problem("JPS-POLICY-ARTIFACT", "", "Pinned candidate schemas could not be compiled."), result.ExitIO + return problem("JPS-POLICY-ARTIFACT", "", "Pinned official draft schemas could not be verified or compiled."), result.ExitIO } if err := schemas[name].Validate(value); err != nil { if schemaBound(err) { diff --git a/internal/policy/candidate_test.go b/internal/policy/candidate_test.go index 0bfdca38..b7a00e7f 100644 --- a/internal/policy/candidate_test.go +++ b/internal/policy/candidate_test.go @@ -47,7 +47,7 @@ func vectorBytes(source map[string]any) ([]byte, *issue, int) { if strings.ContainsRune(name, 0) || path.IsAbs(name) || path.Clean(name) != name || strings.HasPrefix(name, "../") { return nil, candidateIssue("invalid-carrier"), result.ExitInvalid } - raw, err := candidate.ReadFile("candidate/" + name) + raw, err := official.ReadFile("official/conformance/policy/1.0.0/" + name) if err != nil { return nil, candidateIssue("missing-material"), result.ExitInvalid } @@ -56,8 +56,8 @@ func vectorBytes(source map[string]any) ([]byte, *issue, int) { return bytes.Repeat([]byte{byte(number(source["repeatByte"]))}, number(source["byteLength"])), nil, 0 } -func TestCandidatePortableVectors(t *testing.T) { - value, failure := carrier.Decode(candidateRead(t, "vectors/manifest.json"), limits()) +func TestOfficialDraftPortableVectors(t *testing.T) { + value, failure := carrier.Decode(officialRead(t, "conformance/policy/1.0.0/vectors/manifest.json"), limits()) if failure != nil { t.Fatal(failure) } @@ -99,6 +99,9 @@ func TestCandidatePortableVectors(t *testing.T) { } actual := mustMap(t, mustJSON(t, r.CandidateResult)) + if r.SpecRevision != DraftRevision || r.Specification != DraftURL || r.Maturity != "draft" || r.Capabilities.FullDocumentConformance || r.Capabilities.LiveAuthority || r.Capabilities.ExecutionAuthority || r.Capabilities.ApprovalVerification { + t.Fatal("official draft metadata or authority boundary changed") + } if !reflect.DeepEqual(actual, object(entry["expected"])) { t.Fatalf("result %v want %v; exit %d diagnostics %v", actual, entry["expected"], exit, r.Diagnostics) } @@ -146,7 +149,7 @@ func TestCandidateRawIdentityAndFormatIsolation(t *testing.T) { f := candidateFixture(t, "refunds") raw := f.raw["policy.json"] r, exit := Canonicalize("canon", raw) - if exit != 0 || r.BytesDigest != digest(raw) || r.CanonicalDigest == r.BytesDigest || r.FormatVersion != CandidateVersion || r.SpecRevision != CandidateRevision || r.CandidateResult != nil { + if exit != 0 || r.BytesDigest != digest(raw) || r.CanonicalDigest == r.BytesDigest || r.FormatVersion != CandidateVersion || r.SpecRevision != DraftRevision || r.CandidateResult != nil { t.Fatalf("candidate identity %+v exit %d", r, exit) } if r.Document == "" { @@ -199,7 +202,7 @@ func TestCandidateInitSchemaAndExplicitDiscovery(t *testing.T) { } } var capabilities map[string]any - if json.Unmarshal(registry.Formats[1].CandidateCapabilities, &capabilities) != nil || capabilities["maturity"] != "proposed-draft" { + if json.Unmarshal(registry.Formats[1].CandidateCapabilities, &capabilities) != nil || capabilities["maturity"] != "draft" { t.Fatal("candidate discovery") } } diff --git a/internal/policy/document.go b/internal/policy/document.go index 298a39a8..fedb92b4 100644 --- a/internal/policy/document.go +++ b/internal/policy/document.go @@ -1,5 +1,6 @@ // Package policy supplies bounded offline tools for the explicitly non-normative -// RFC 0023 prototype and proposed-draft candidate. It is not a policy authority or an evaluator. +// RFC 0023 prototype and the independently released Policy draft. It is not a +// policy authority or an evaluator. package policy import ( @@ -69,6 +70,7 @@ type Resource struct { Name string `json:"name"` MediaType string `json:"mediaType"` Text string `json:"text"` + SourceID string `json:"sourceId,omitempty"` } type MaterialRequirement struct { diff --git a/internal/policy/format.go b/internal/policy/format.go index bdb3fa11..bbda81e9 100644 --- a/internal/policy/format.go +++ b/internal/policy/format.go @@ -13,15 +13,19 @@ import ( const CandidateVersion = "1.0.0" const CandidateRevision = "0852c5fa7726e51b36e574a5b110e7f5e012e03d" const CandidateURL = "https://github.com/Judgment-Pack/judgment-pack-spec/blob/" + CandidateRevision + "/rfcs/policy-companion-contract/README.md" +const DraftRelease = "policy-v1.0.0-draft.1" +const DraftRevision = "0799b37b74e35c4a86bfbf70f7bee80bdb7bbe94" +const DraftURL = "https://github.com/Judgment-Pack/judgment-pack-spec/blob/" + DraftRevision + "/spec/policy.md" type formatDescriptor struct { version, profile, maturity, revision, url, directory, commonURI string } var prototypeFormat = formatDescriptor{ProfileVersion, Profile, "non-normative", SpecRevision, SpecURL, "prototype", commonID} -var candidateFormat = formatDescriptor{CandidateVersion, "jps-policy-companion", "proposed-draft", CandidateRevision, CandidateURL, "candidate", candidateCommonID} +var candidateFormat = formatDescriptor{CandidateVersion, "jps-policy-companion", "draft", DraftRevision, DraftURL, "official/schema/policy/1.0.0", draftCommonID} -// CandidateResult is the complete portable full-check result. It is absent from +// CandidateResult retains the existing report member name for the complete +// portable draft full-check result. It is absent from // legacy reports and from encoding/local validation, which have narrower scopes. type CandidateResult struct { Status string `json:"status"` @@ -71,9 +75,9 @@ func candidateReport(command string) Report { r.FormatVersion = f.version r.Capabilities.ProfileVersions = []string{f.version} r.Capabilities.Maturity = f.maturity - r.Capabilities.ValidationScope = "closed-candidate-document-and-local-references" - r.Capabilities.CheckScope = "candidate-supplied-exact-bytes-anchors-and-scoped-core-references" - r.CandidateCapabilities, _ = candidate.ReadFile("candidate/capabilities.json") + r.Capabilities.ValidationScope = "closed-draft-document-and-local-references" + r.Capabilities.CheckScope = "draft-supplied-exact-bytes-anchors-and-scoped-core-references" + r.CandidateCapabilities, _ = official.ReadFile("official/conformance/policy/1.0.0/capabilities.json") return r } @@ -83,7 +87,7 @@ func candidateRefused(r Report, code string) (Report, int) { if code == "input-over-bound" || code == "unsupported-format" || code == "unsupported-canonical-identity" { exit = result.ExitUnsupported } - return refused(r, "JPS-POLICY-CANDIDATE-"+strings.ToUpper(code), "", "Proposed-draft candidate check refused: "+code+".", exit) + return refused(r, "JPS-POLICY-CANDIDATE-"+strings.ToUpper(code), "", "Policy draft check refused: "+code+".", exit) } // Only a strict object carrying the new selector opts into automatic candidate @@ -244,7 +248,7 @@ func DigestFormat(command string, data []byte, format string) (Report, int) { } func candidateIssue(code string) *issue { - return &issue{code: "JPS-POLICY-CANDIDATE-" + strings.ToUpper(code), message: "Proposed-draft candidate check refused: " + code + ".", candidateCode: code} + return &issue{code: "JPS-POLICY-CANDIDATE-" + strings.ToUpper(code), message: "Policy draft check refused: " + code + ".", candidateCode: code} } func candidateCode(err *issue, exit int) string { @@ -277,7 +281,7 @@ func finishCandidateCheck(r Report, code int) (Report, int) { return r, code } if code == 0 { - r.CandidateResult = &CandidateResult{Status: "valid", FormatVersion: CandidateVersion, Maturity: "proposed-draft"} + r.CandidateResult = &CandidateResult{Status: "valid", FormatVersion: CandidateVersion, Maturity: "draft"} } else if r.refusalCode != "" { r.CandidateResult = &CandidateResult{Status: "refused", Code: r.refusalCode} } diff --git a/internal/policy/official.go b/internal/policy/official.go new file mode 100644 index 00000000..3e00c3f1 --- /dev/null +++ b/internal/policy/official.go @@ -0,0 +1,73 @@ +package policy + +import ( + "embed" + "encoding/json" + "fmt" + "io/fs" + "strings" + "sync" +) + +// official retains published source paths so the unchanged reference reader can +// run against its frozen schemas, complete corpus and shared canonicalizer. +// +//go:embed official +var official embed.FS + +const officialProvenanceDigest = "sha256:398735dc63478806ff77d75af61ef3dd76459ffbef454cb4bdb1b25bc54f3e25" + +var officialOnce sync.Once +var officialError error + +// VerifyOfficialArtifacts verifies the independently pinned manifest and every +// retained release file. The same check guards schema compilation and releases; +// no network resolution or publication/authority assertion is involved. +func VerifyOfficialArtifacts() error { + officialOnce.Do(func() { officialError = verifyOfficialArtifacts(official) }) + return officialError +} + +func verifyOfficialArtifacts(source fs.FS) error { + raw, err := fs.ReadFile(source, "official/provenance.json") + if err != nil || digest(raw) != officialProvenanceDigest { + return fmt.Errorf("official Policy draft provenance does not match its independent pin") + } + var manifest struct { + SourceRepository string `json:"sourceRepository"` + SourceRevision string `json:"sourceRevision"` + SourceRelease string `json:"sourceRelease"` + FormatVersion string `json:"formatVersion"` + Maturity string `json:"maturity"` + Files []struct { + SourcePath string `json:"sourcePath"` + Path string `json:"path"` + SHA256 string `json:"sha256"` + ByteLength int `json:"byteLength"` + } `json:"files"` + } + if json.Unmarshal(raw, &manifest) != nil || manifest.SourceRepository != "https://github.com/Judgment-Pack/judgment-pack-spec" || manifest.SourceRevision != DraftRevision || manifest.SourceRelease != DraftRelease || manifest.FormatVersion != CandidateVersion || manifest.Maturity != "draft" || len(manifest.Files) == 0 { + return fmt.Errorf("official Policy draft provenance identity is invalid") + } + expected := map[string]bool{"official/provenance.json": true} + for _, file := range manifest.Files { + if !fs.ValidPath(file.Path) || file.Path != file.SourcePath || expected["official/"+file.Path] { + return fmt.Errorf("official Policy draft manifest inventory is invalid") + } + name := "official/" + file.Path + raw, err := fs.ReadFile(source, name) + if err != nil || len(raw) != file.ByteLength || digest(raw) != "sha256:"+file.SHA256 { + return fmt.Errorf("official Policy draft file differs from its pin: %s", file.Path) + } + expected[name] = true + } + return fs.WalkDir(source, "official", func(name string, entry fs.DirEntry, err error) error { + if err != nil { + return err + } + if !entry.IsDir() && !expected[name] { + return fmt.Errorf("unmanifested official Policy draft file: %s", strings.TrimPrefix(name, "official/")) + } + return nil + }) +} diff --git a/internal/policy/official/CONTRIBUTING.md b/internal/policy/official/CONTRIBUTING.md new file mode 100644 index 00000000..7c948c2f --- /dev/null +++ b/internal/policy/official/CONTRIBUTING.md @@ -0,0 +1,91 @@ +# Contributing + +Thank you for helping test whether organizational judgment can have a useful portable format. + +This is a research preview. Critical feedback, counterexamples, and removal proposals are as +valuable as additive features. + +## Good first contributions + +- a pack example from a domain unlike the existing examples; +- an ambiguity or contradiction in the draft prose; +- a case accepted by the schema that should be rejected; +- a case rejected by the schema that should be portable; +- an interoperability, privacy, security, or authoring-cost concern; +- evidence that a concept belongs in a profile rather than Core. + +## Working on an issue + +You're welcome to comment that you'd like to take an issue, and a maintainer may assign it to you. +Only that assignment reserves it. Without one, the first pull request that meets the issue's +acceptance criteria is the one that gets merged, and until then the issue stays open to anyone. + +Work on one issue at a time. Finish the pull request you have open, or say you're withdrawing it, +before you take another. We assign at most one issue to each contributor at once. + +If an assigned issue goes quiet for a couple of weeks with no pull request, a maintainer will +check in. If there's no reply within a week after that, the issue is unassigned so someone else +can pick it up. You're welcome to take it back while it's still open. + +## Before proposing a feature + +Open a design issue describing: + +1. the user or interoperability problem; +2. at least two realistic examples; +3. why an extension or external product behavior is insufficient; +4. compatibility and migration consequences; +5. security and privacy consequences; and +6. how two independent implementations could test agreement. + +Material changes should become a Request for Comments (RFC). Copy the structure in +[`rfcs/0000-rfc-process.md`](rfcs/0000-rfc-process.md). + +## Pull requests + +A pull request should: + +- remain focused on one problem; +- link the relevant issue or RFC; +- update prose, schema, examples, and conformance cases together when applicable; +- include at least one negative or adversarial case for normative behavior; +- identify breaking changes explicitly; and +- avoid claiming that conformance proves truth, authorization, or safety. + +Normative changes are not accepted solely because the reference implementation supports them. + +## Local checks + +CI runs the repository checks on Python 3.12. That is what the workflow currently uses rather +than a declared minimum version for the project. + +Install the test dependencies: + +```bash +python -m pip install -r requirements-dev.txt +``` + +Run the same checks CI runs: + +```bash +python -m unittest discover -s tests -v +``` + +**Install the dependencies even if the suite appears to run without them.** `requirements-dev.txt` +pins `jsonschema[format-nongpl]`, and the `format` keyword is only checked when those extras are +present. Without them, `jsonschema` silently ignores `format`, so conformance cases that exist to +prove a malformed URI or timestamp is rejected come back **valid** and the suite passes while +checking less than it says it does. Two current corpus cases behave exactly that way. + +## Developer Certificate of Origin + +Contributions must be signed off using Git's `--signoff` option. The sign-off certifies the +Developer Certificate of Origin 1.1: . + +## License + +By contributing, you agree that your contribution is licensed under Apache License 2.0. + +## Conduct + +Participation is governed by [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md). diff --git a/internal/policy/official/GOVERNANCE.md b/internal/policy/official/GOVERNANCE.md new file mode 100644 index 00000000..12763b08 --- /dev/null +++ b/internal/policy/official/GOVERNANCE.md @@ -0,0 +1,284 @@ +# Governance + +## Status: early research preview + +Judgment Pack is an open, vendor-neutral specification developed in public. Today it has a single +maintainer and no independent contributors (see [Interim review regime](#interim-review-regime)). +It is not controlled by any required commercial runtime, though the reference runtime is written by +the same maintainer and is not independent evidence of interoperability. Conforming +implementations may be open-source or proprietary; conformance is defined by the specification and +its conformance cases, not by any single vendor's product. + +The current status is an early research preview (`0.2.0-draft`). There is no compatibility guarantee +for `0.x` drafts. Concepts may be revised or removed as the specification is exercised against real +implementations. + +Technical discussion, proposals, decisions, and compatibility analysis are expected to occur +publicly in this repository. Payment, employment, or commercial membership does not by itself +establish the technical merit of a proposal. + +## Decision principles + +Maintainers evaluate changes in this order: + +1. demonstrated interoperability need; +2. safety and semantic clarity; +3. independent implementability; +4. compatibility and migration cost; +5. author and operator usability; +6. implementation complexity; and +7. ecosystem adoption potential. + +The convenience of any single implementation is not sufficient reason to add a Core feature. + +## Decision process + +- Minor editorial changes may use ordinary pull requests. +- Material or normative changes require a Request for Comments (RFC) and a public review + period. See [Interim review regime](#interim-review-regime) for what that period currently + produces and what stands in for the outside review it does not yet draw. +- Stable features should have two independent implementations and conformance cases. +- Maintainers publish the disposition and rationale for an RFC. +- Material objections and minority positions should be recorded rather than silently discarded. + +During the research preview, maintainers may reject or remove concepts aggressively. There is no +compatibility promise for `0.x` drafts. + +## Interim review regime + +The project has one maintainer, Brian Jin ([@kikashy](https://github.com/kikashy)), and no +independent contributors. Elsewhere this document says "maintainers" and speaks of public review +periods, as do [`README.md`](./README.md), +[`docs/origin-and-boundary.md`](./docs/origin-and-boundary.md), and Q40 of [`FAQ.md`](./FAQ.md). +Those describe the intended end state, not today. Today a public review period means a change sits +in public and no one comments, and one maintainer merges their own RFCs with model assistance on the +drafting — a real concentration of judgment. + +This section adds an adversarial reading where there is currently none. It is not review breadth. +Breadth means readers with different exposure — users, implementers, operators — and no model has +any. + +This section is the operative text proposed by [RFC 0009](./rfcs/0009-interim-review-regime.md), +which is its design record, adopted 2026-07-27. The regime was introduced through the RFC process it +amends; two adversarial reviews of the proposal, with a written disposition for every finding, are +recorded on that RFC's pull request, and the maintainer's merge of that pull request is the +acceptance. + +### Practice + +The precedent is partial. RFC 0006 +([pull request 9](https://github.com/Judgment-Pack/judgment-pack-spec/pull/9)) records the review +prompt verbatim, the unedited findings of an OpenAI Codex review of a Claude-drafted RFC, the +response, and a maintainer disposition; the bar stated at the time was a different model family, not +a different vendor. RFC 0007 and the reference runtime's architecture decision records carry no such +record and were merged without one. + +- **Scope.** The pull request adopting [RFC 0009](./rfcs/0009-interim-review-regime.md) and every + pull request merged after it, where that pull request creates, materially amends, or dispositions + an RFC in this repository. The test is commit-relative, not date-relative: the adopting pull + request is inside its own scope rather than the last one exempt from it, and no merge falls into a + same-day gap. Predating the requirement is not an exemption: RFCs 0001–0007 acquire it the next + time such a pull request touches them, and an RFC opened early and completed later is covered by + the merge, not by the opening date. Editorial pull requests — typography, links, formatting — are + not covered. +- **Runtime.** The maintainer applies the same rule to material decisions in the reference runtime, + with or without an architecture decision record. A decision is *material* when it changes a public + surface, a documented claim, conformance-relevant behavior, the security posture, or a dependency + boundary. Not writing an ADR does not make a decision immaterial. This document binds only this + repository; the runtime's adopting text is its + [`docs/adr/README.md`](https://github.com/Judgment-Pack/judgment-pack-runtime/blob/main/docs/adr/README.md), + and the obligation exists there because that text is merged — so this bullet now describes a rule + the runtime is under rather than an intention. That text also requires every runtime pull request to + declare its material-decision impact, so a change treated as immaterial is classified out loud and + can be disputed rather than passing in silence. Runtime ADRs are written after the decision and + are immutable once accepted, so the review attaches to the pull request that makes the decision, + not to the ADR text. +- **Cross-vendor review.** At least one adversarial review by a model from a **different vendor** + than any model that assisted the drafting. *Vendor* means the organization that controls the + model's weights and training — the developer, not the API host and not a reseller. Two hosted + copies of the same model share lineage and are the same vendor here, whatever the invoice says. + *Assisted the drafting* means generated or revised text that survives in the merged artifact, or + planning, analysis, structure, or design choices supplied by a model and relied on to produce it. + Paraphrase does not launder assistance: a model that shaped the outline, chose the arguments, or + settled a design question assisted the drafting even when none of its sentences survive. Applying + an accepted finding in the maintainer's own words does not make the reviewer a drafter; adopting + reviewer-generated text verbatim does not invalidate the review that produced it, but the record + says where that happened. A case the maintainer cannot call is declared in the record, and the + declaration is an attestation like the others below. +- **Record.** The review is recorded in the pull request, in a comment beginning with the heading + `## Cross-vendor adversarial review`. The record names the drafting model or models and the + reviewing model, each with vendor, model identifier, and date; states the commit SHA that was + reviewed and what repository context the reviewer was given — files, diff range, tools, whether it + could read the working tree; quotes the review prompt verbatim; and includes the reviewing model's + complete unedited output, including findings the maintainer rejects. If more than one review was + run, every run is linked and the record states that no run was discarded. +- **Change after review.** A material change to the artifact after the reviewed SHA requires a fresh + review of the later SHA. One class of change is excepted: a change that implements a dispositioned + finding of a review already recorded on the same pull request, which is covered by that finding's + disposition and by the commit the disposition links. Without the exception the requirement never + terminates — every review provokes changes and every change provokes a review — and the exception + opens no general escape, because it is pinned to specific recorded findings: a material change no + recorded finding asked for is not covered by one. A note in place of a review is available only + for non-material changes — typography, links, formatting — and the note says what changed. +- **Disposition.** Every finding receives a written maintainer disposition: accept, accept in part, + reject with reason, or defer with the condition that would reopen it. Every accepted finding links + to the commit that implements it or to the tracked follow-up that will. +- **Redaction.** The unedited-output requirement yields to disclosure risk and to nothing else. If + the raw output contains an exploitable vulnerability, personal data, or credentials, the published + record may redact exactly that portion. The redaction is marked in place, its reason class stated + — vulnerability, personal data, or credential — the unredacted original preserved privately, and + the full text published after remediation when it is safe to publish, handled under + [`SECURITY.md`](./SECURITY.md). A finding the maintainer finds unwelcome is not a + disclosure risk. +- **Pull requests only.** No RFC, and no material runtime decision, is merged except through a pull + request carrying the review and the dispositions. Direct pushes to the default branch are not used + for either. + +### What the record cannot show + +The heading convention above makes records *findable*. It does not make compliance *provable*. The +record makes the maintainer's claims discoverable; it cannot verify them. These stay attestations by +the reviewed party: + +- which models actually assisted the drafting, including assistance that left no surviving text; +- that the quoted prompt is the complete input, including system instructions, attached context, and + tool output; +- that the quoted output is complete and unedited apart from a marked redaction; +- that no run was discarded. + +Pull-request comments are editable and deletable by their author, so the comment is not the anchor. +The reviewed commit SHA is: the artifact under review is fixed in Git history even when the text +describing it is not. A reader who wants more than an attestation would need provider-side logs, +which this project does not publish and does not claim to. + +### Limits + +Model review is not decision authority. It is not authoritative; the disposition of the maintainer +named above is, and they are accountable for it. Known weaknesses: + +- The reviewing model is selected, prompted, transcribed, and dispositioned by the party being + reviewed. Nothing here prevents re-running a review until it is agreeable. The recorded prompt, the + complete output, and the link to every run are what would make that visible — and every one of them + is supplied by the same party, per + [What the record cannot show](#what-the-record-cannot-show). + Only a reader who checks makes any of it cost anything. +- Cross-vendor review is intended to decorrelate some vendor-specific blind spots. The effect is + unmeasured, and models from different vendors still share training data, tuning conventions, and + benchmark culture, so the blind spots they share are not vendor-shaped. +- A reviewing model reading a model-assisted draft may find it unusually agreeable. +- No model review represents a user, an implementer, or an operator, or reports a cost borne by one. +- No model is accountable for the finding it failed to make. +- The maintainer also authors the reference runtime, `judgment-pack-runtime`. No runtime is required + to interpret a pack, but that runtime is not independent of this specification: RFC 0006 names it + as one of the two independent implementations its evidence bar requires, and two implementations + by one author are not independent evidence. + +Model reviews are not external design reviews. They do not count toward any exit evidence in +[`ROADMAP.md`](./ROADMAP.md). + +Outside review is not made unnecessary by this regime. It is what the regime is waiting for. + +### When a second maintainer arrives + +*Arrival* is the grant of merge rights to a second distinct legal person, whether or not that person +is independent of the first under the exit criteria below. The bullets here trigger on the grant. +Two maintainers do not by themselves end this regime: the exit criteria still require independence, +and ending the regime still takes the removal RFC. On arrival: + +- an RFC is no longer merged by its own author, and the other maintainer records the disposition; +- recusal under [Maintainer conflicts](#maintainer-conflicts) becomes available, and + the single-maintainer substitute recorded there lapses; +- with exactly two maintainers, the non-author can block everything by being absent. If the + non-author is conflicted, or does not respond within 14 days of a review request, the author + merges, and the disposition states that no second maintainer reviewed it and why; +- the cross-vendor review requirement continues until this section is removed. + +### Exit criteria + +Recorded in advance. They are prerequisites for opening the RFC that removes this section, not a +self-executing end: this regime is in force until that RFC merges, whether or not the conditions +hold on any given day. + +1. The project has at least two maintainers with merge rights who are independent of each other: + distinct legal persons, not employed by or contracting with the same entity and not funded by it + for this work. A maintainer added after this section is adopted must have at least five merged + non-trivial commits authored before their first grant of merge rights. The founding maintainer + named above is exempt from that count: they held merge rights before there was anything to merge, + and a rule they could satisfy by revoking and re-granting their own rights would measure nothing. +2. Substantive comment on RFCs has come from at least two distinct third-party GitHub accounts, + belonging to neither maintainer, across at least two separate RFCs. Comment is *substantive* when + it engages the technical substance and receives a written disposition; a typo report, an + endorsement, or an aside nobody answered is not. The two commenters are identified natural + persons, not accounts created for the purpose. + +What those conditions measure is independent participation: that merge rights are held by more than +one person, and that someone who is neither maintainer has engaged the substance and been answered +in public. They do not measure breadth. Nothing here counts users, implementers, or operators, or +asks what exposure a commenter argues from, so on the day this regime exits the project still has no +measure of the breadth that the second paragraph above says model review is not. Multi-party +governance is what that is for; this regime ends where that work starts. + +Part of this is recorded publicly as it happens, and part is not. Nomination and every grant of merge +rights are recorded in this repository on the day they occur, so the number of maintainers, the date +of each grant, and the commits preceding it are checkable by anyone. Independence is not checkable: +employment, contracting, funding, and whether two accounts are two people cannot be established from +repository history, and Git authorship metadata is not identity. Whether a comment is substantive is +a judgment, and whether a commenter was solicited is invisible from outside. Those are +**attestations**. The maintainer states each one, with the evidence relied on, in the removal RFC, +and an outside reader can dispute any of them there. + +A maintainer removes this section by a governance RFC citing the evidence for each condition, +disposed under the process in this document. The RFC may be short. It is not opened before both +conditions hold, and until it merges every requirement above applies unchanged. Deleting the +project's only standing accountability regime is a governance change, so it takes the route +this document requires for one. This regime was introduced by that route — through +[RFC 0009](./rfcs/0009-interim-review-regime.md), under the process it amends, with its adversarial +reviews and a disposition for every finding recorded on that RFC's pull request — and its removal +takes the same route. + +**Reactivation.** After removal, this regime reactivates on the day fewer than two independent +maintainers hold merge rights — by resignation, by revocation of rights, by loss of independence, or +by inactivity — automatically, whether or not anyone announces it. A maintainer with no authored +commit, recorded review, or recorded disposition in the preceding 90 days does not count toward the +two. Counting accounts is not the test: two accounts held by one legal person, or held by two people +no longer independent of each other, were never two maintainers for this purpose. The section is +restored to this document by ordinary pull request citing this clause, and it binds from the day the +condition returned, not from the day that pull request merges. Restoring an accountability regime +whose precondition has returned needs no RFC; removing one does. + +Dropping the `-draft` suffix is governed by [`ROADMAP.md`](./ROADMAP.md) Stage 3 and +[`VERSIONING.md`](./VERSIONING.md). This section neither restates that bar nor supplies a second, +weaker one. + +## Maintainer conflicts + +A maintainer with a direct commercial or personal conflict should disclose it. Another maintainer +should lead disposition when practical. With one maintainer that is not available: the conflict is +disclosed in the pull request and named in the disposition. This substitute lapses when a second +maintainer arrives (see [Interim review regime](#interim-review-regime)). + +## Evolving the governance model + +The specification intends to evolve through real implementations and interoperability feedback. As +independent conforming implementations, production adopters, and sustained outside contribution +accumulate, the maintainer intends to formalize multi-party governance. The near-term trigger is the +exit criteria in [Interim review regime](#interim-review-regime). + +That transition should be proposed through a public governance RFC covering technical steering, +release authority, trademarks, intellectual property, and the project's long-term home. Until the +supporting implementation and contribution base exists, adding heavier governance ceremony would +create process without creating independent technical power. The recorded model review required by +[Interim review regime](#interim-review-regime) is the deliberate exception: it creates a record +rather than a body, confers authority on no one, and costs third parties nothing. + +## Participate + +Participation is open. No membership or commercial relationship is required to propose changes, +report problems, or contribute implementations. + +- Source and specification: +- Issue tracker: +- Discussion: [join the Judgment Pack Slack](https://join.slack.com/t/judgment-pack/shared_invite/zt-44qrd47ok-o_~Vk3BFDzsN~EGAPkeQBw) +- Contributing guide: [./CONTRIBUTING.md](./CONTRIBUTING.md) +- Code of conduct: [./CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md) +- Roadmap: [./ROADMAP.md](./ROADMAP.md) diff --git a/internal/policy/official/LICENSE b/internal/policy/official/LICENSE new file mode 100644 index 00000000..d6456956 --- /dev/null +++ b/internal/policy/official/LICENSE @@ -0,0 +1,202 @@ + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/internal/policy/official/NOTICE b/internal/policy/official/NOTICE new file mode 100644 index 00000000..da28de4b --- /dev/null +++ b/internal/policy/official/NOTICE @@ -0,0 +1,5 @@ +Judgment Pack Specification +Copyright 2026 Brian Jin + +This product includes specification artifacts developed by the Judgment Pack +project (https://github.com/Judgment-Pack/judgment-pack-spec). diff --git a/internal/policy/official/VERSIONING.md b/internal/policy/official/VERSIONING.md new file mode 100644 index 00000000..498b8b6d --- /dev/null +++ b/internal/policy/official/VERSIONING.md @@ -0,0 +1,105 @@ +# Versioning and release policy + +Core Judgment Pack Specification releases use Semantic Versioning identifiers with a leading `v` on +Git tags. Specification `0.2.0-draft` is identified by the exact tag `v0.2.0-draft`, and `0.1.0-draft` +by `v0.1.0-draft`. Only a tag and GitHub release published by the maintainers establish an immutable +release; similarly named files on the mutable `main` branch do not. + +## Specification versions + +`specVersion` identifies the specification release a Judgment Pack targets. Readers MUST compare +the complete value; they must not infer compatibility from a shared major or minor number during +the `0.x` research period. + +A conformance claim is made against one exact `specVersion`. That applies to every class, and it +binds hardest on evaluator conformance (Core §3.4): such a claim names the exact version and the +evaluation corpus published with it, and is not inherited by a later or an earlier version. The corpus +version is the `suiteVersion` member of the evaluation manifest, and the corpus is frozen when a +`specVersion` is released — rows are added only on the way to the next one (Core §3.4.1) — so two +identically worded claims require the same rows, and such a claim must state that every one of those rows +passed. A failing row blocks the claim unless a project-issued erratum +(`conformance/evaluation/errata.md`) marks it defective for that corpus version; a claimant cannot make +that call for itself. A superseded schema stays published so documents that keep the older `specVersion` +remain checkable, and a previously published versioned URL stays resolvable; neither confers anything on a +claim. A preserved schema is served at the `$id` it was published under, and where that identifier was +re-pointed to this project's own domain it differs from the tagged artifact in that one member and nothing +else — the release notes of the version that preserved it publish the digest of both forms. + +Any `0.x` release may change reader, writer, or semantic behavior incompatibly. Release notes must +identify those effects and include migration guidance when an earlier pack can be transformed. + +The `main` branch describes work in progress. It is not an immutable specification release and +must not be used as a reproducibility anchor. + +## Pack versions + +The root `version` member identifies a revision of one pack series. It is independent of +`specVersion` and follows the three-component grammar defined by the Core schema. + +A published `(id, version)` pair SHOULD be immutable. Changed pack content should receive a new +pack version, even when `specVersion` does not change. + +## Compatibility dimensions + +Release notes describe compatibility separately for: + +- **reader compatibility** — whether an older reader can parse and preserve a newer document; +- **writer compatibility** — whether a newer writer can emit documents accepted by older readers; +- **semantic compatibility** — whether conforming consumers assign the same portable meaning; and +- **migration compatibility** — whether a deterministic document transformation is available. + +No compatibility dimension is implied merely because two releases share a version prefix. + +## Release artifacts + +An immutable Core preview release contains, at minimum: + +- the tagged Core prose specification; +- the tagged JSON Schema with a versioned `$id`, plus any superseded schema still published; +- examples, document-conformance cases, and the evaluation corpus from the same commit; and +- release notes identifying maturity, compatibility, and known limitations; +- `.tar.gz` and `.zip` artifact bundles from that commit; and +- SHA-256 checksums and GitHub build-provenance attestations for those bundles. + +If prose, schema, or conformance artifacts disagree, the conflict is a specification defect. The +artifact roles and conformance boundaries in the tagged Core specification determine which claim +each artifact is permitted to make. + +## Deprecation and support + +Research-preview releases have no compatibility or security service-level guarantee. Maintainers +may deprecate or remove behavior in a later `0.x` release, but must record the change in release +notes. A stable release will require a separate support and deprecation policy before publication. + +## Independently versioned Policy draft companion + +Policy uses the scoped tag `policy-v`, where `releaseVersion` is +strict three-component SemVer followed by `-draft.N` (unsigned ASCII decimal N, +no leading zero except `0`). This route is draft-only; it creates no stable +maturity or support guarantee. Only the tag and maintainer-published GitHub +release together establish an immutable Policy release. The prepared first +identifier is `policy-v1.0.0-draft.1`; preparation does not publish it. + +A Policy release names the exact document `formatVersion`, supported Core consumer +`specVersion`, closed schema identities and complete corpus/digest in its own +versioned JSON release manifest beside the release notes. Those values and an +artifact's x.y.z `version` are independent of the companion release identifier. +The existing builder/workflow shares archive, checksums and build provenance with +Core, but validates a Policy tag against its own manifest and explicit draft RFC +acceptance. Core tags still require exact Core schema/document/evaluation pins; +Core bundles exclude independently versioned Policy schema/corpus directories. + +First publication freezes the normative meaning, schema resource bytes/URLs and +complete corpus inputs/results for an exact Policy format. A later draft release +for that same format retains those pins and can change packaging or non-normative +explanation only. Changed acceptance, interpretation, bounds, refusal semantics +or grammar requires a new exact format selector, new versioned schema resources +and reviewed compatibility/migration guidance. Published resource URLs, release +manifests and tagged artifacts are preserved; they are never repointed. + +A Policy offline-reader conformance claim names the exact independent Policy +release, format, supported Core consumer version and complete published corpus +manifest/digest; every row must pass. No claim is available before publication. +It establishes supplied-document agreement only, with the scope/exclusions of +[the companion](spec/policy.md). Stable maturity still requires the independent +implementation evidence in the existing governance and RFC process. diff --git a/internal/policy/official/conformance/policy/1.0.0/ADOPTION.md b/internal/policy/official/conformance/policy/1.0.0/ADOPTION.md new file mode 100644 index 00000000..afb285d8 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/ADOPTION.md @@ -0,0 +1,92 @@ +# RFC 0023 conditional draft disposition + +On 2026-10-19 the maintainer directed: “Accept the bounded draft after CI; record +the limited public review”. This authorizes acceptance of the immutable +supplied-document surface in [spec/policy.md](../../../spec/policy.md), its +Policy offline-reader class and the independent draft release route, effective +only when [PR 218](https://github.com/Judgment-Pack/judgment-pack-spec/pull/218) +merges after required CI passes. The PR carries the proposed Accepted status; +the default-branch RFC remains Review until merge. This record claims no completed +merge, publication, stable maturity, product admission or consumer adoption. + +## Actual limited public review and maintainer decision + +The initial bounded assessment read [issue 211](https://github.com/Judgment-Pack/judgment-pack-spec/issues/211) +and its one comment, [PR 212](https://github.com/Judgment-Pack/judgment-pack-spec/pull/212), +its six comments, zero submitted reviews and zero inline review comments. The +issue opened 2026-10-18 at 03:01:59 UTC; PR 212 opened at 03:15:52 UTC and merged +at 17:50:10 UTC as `8a56a95d555c17640d2db4984363b779536b3c2a`. That merge adopted +only a Draft RFC/non-normative prototype, expressly withholding companion adoption. +The issue update at 20:55:02 UTC reports corrected candidate work in PRs 216/217, +124 matching vectors and two Codex-assisted readers, while keeping the RFC in +Review and independent evidence outstanding. + +All substantive comments in that original history were by the maintainer; one +other comment was a contribution bot. No independent technical objection, +endorsement or implementation review was recorded there. The proposal and +corrected candidate were public from 2026-10-18 to this 2026-10-19 decision, a +limited period with no demonstrated outside stakeholder participation. Silence +is not acceptance or evidence of interoperability. + +RFC 0000 sets a reasonable public period according to complexity, with no fixed +minimum. The maintainer explicitly elects to proceed after this limited period +for the **bounded draft**, conditional on required green CI and PR 218 merge, +rather than treating the earlier non-normative merge or absent comments as +acceptance. The exact selector/bounds/coverage surface and deferred items below +limit that disposition. Subsequent technical objections remain grounds for +review through the existing RFC process; the stable independent-evidence bar +is unchanged. This is a disclosed maintainer judgment, not outside review. + +The PR 212 same-vendor readiness review and response preserve findings F1–F6. +F1's exact-byte/multiple-media-type defect was fixed; F6's typed references, +original bounds and requirements deferral were addressed. F2 release registration, +F3 current authority, F4 external lifecycle and F5 private-to-portable migration +remain product-owned boundaries, not solved by this offline companion. + +## Exact review record and standing exception + +The separate reviewer, OpenAI `gpt-6.1-sol` at `xhigh` on 2026-10-19, inspected +frozen tree `60b04d452efa49032a0cc7d3ac1e55a3900410a8`, subsequently committed +unchanged as `7f118278e480d88e53e6a6be2fe084610a2bebf9`. The drafting worker also +used OpenAI `gpt-6.1-sol` at `xhigh`. The reviewer reported **no material findings** +in that bounded artifact; no finding was silently discarded. The complete +report, context and supplied brief are in +[the PR review record](https://github.com/Judgment-Pack/judgment-pack-spec/pull/218#issuecomment-6273316525). +The report SHA-256 is +`6506927d179cfe165122c45e6fafc856e6dd975e1c51d63abda984aacfd711e0`. + +This is separate-agent **same-vendor** review. The maintainer applies the standing +temporary different-vendor-review exception, originally recorded for PR 212 in +[this explicit instruction](https://github.com/Judgment-Pack/judgment-pack-spec/pull/212#issuecomment-6253085953), +to this bounded promotion. It does not amend the general governance rule or turn +Codex review into cross-vendor review, outside stakeholder review or independently +authored implementation evidence. Historical review records remain unchanged. + +Required CI on the initial promotion found the Core fixture audit incorrectly +counting Policy-owned JSON as Core fixtures. The explicit namespace fix and its +ownership regressions change tests only. The final CI-fix/acceptance delta is +subject to the PR's final bounded review and required CI before merge; the earlier +report is not claimed to cover an unidentified later commit. + +## Exact draft dispositions effective upon merge + +| RFC question | Draft disposition and condition to reopen | +| --- | --- | +| 1. Selector, bounds and closed grammar | Accept exact `formatVersion: "1.0.0"`, strict independent x.y.z artifact versions, 262,144 parsed bytes, depth 32, 128-character number literals/exponent magnitude 308, 1,048,576 narrative/review/informational bytes, 4,194,304 original bytes, 16,777,216 distinct retained bytes, 16 registrations, and the declared closed field/count maxima; retained bytes and optional `jps-canon`, UTF-8 anchors, pack-only typed references and scoped total coverage. Refuse aliases/unknown members/structured requirements. No evaluator or live authority changes. A grammar/bound change requires explicit selector and compatibility review. | +| 2. Review trust, signatures and cross-workspace adoption | Defer. Interpretation bytes prove no reviewer identity or authorized sign-off. Reopen with a concrete cross-workspace export need, authentication/trust profile, exact reviewed candidate/workflow binding and adversarial verification vectors. | +| 3. RFC 0011 currency registry | Defer; do not adopt or supersede the Draft registry. Reopen with an RFC 0011 disposition and explicit distinction between offline membership and current authenticated admission. | +| 4. Provider lifecycle/freshness | Defer to owning hosts. Read support, byte identity, opaque revision or missing file cannot establish publication/withdrawal. Reopen with a real provider's demonstrated revision/lifecycle/freshness evidence and reviewed mapping/reconciliation/enforcement tests. | +| 5. Teams, quorums, roles and approval | Defer. No universal separation-of-duties rule or imported roles; honest local self-review remains a host workflow choice. Reopen with a team host contract covering quorum/workflow revision, role revocation, expiry and transactional candidate/publication binding. | +| 6. Graph/composition closure | Defer and refuse graph consumers. Reopen with an adopted owning graph/execution contract, complete trusted closure registration and missing-dependency/cycle vectors; caller-supplied lists prove no complete closure. | +| 7. Independent readers / adapters | Genuinely independent authorship evidence remains absent and is required before stable maturity under the existing rules. Reopen with independently authored readers reproducing the same immutable corpus, provenance and disagreements; adapter work needs a concrete interchange demand. | + + +The independent companion release route was selected by the maintainer. The +first release identifier is `policy-v1.0.0-draft.1`; this source record alone +establishes no publication. The exact tag and a maintainer-published GitHub +release must both exist. This draft +disposition includes the Policy-scoped VERSIONING.md amendment and shared release +builder/workflow routing, without changing Core versions or evaluator semantics. +After the final bounded review/dispositions and required CI, PR merge makes this +draft disposition effective. A later tag and maintainer-published release must +pass the separate exact-source/pin/publication gates. diff --git a/internal/policy/official/conformance/policy/1.0.0/MIGRATION.md b/internal/policy/official/conformance/policy/1.0.0/MIGRATION.md new file mode 100644 index 00000000..da69ed31 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/MIGRATION.md @@ -0,0 +1,61 @@ +# Explicit migration from prototype 0.0.2 + +This is the breaking migration to the **Policy draft** `formatVersion: "1.0.0"`, +whose acceptance takes effect only upon required green CI and PR 218 merge. +The default-branch RFC remains Review until then; publication is a separate step. Neither semver arithmetic nor opening a document consents +to migration. The draft reader refuses prototype documents; it never upgrades +or reinterprets them. Prototype 0.0.1 needs its own explicit path to 0.0.2 and is +not silently accepted by this guide. + +1. Keep the original 0.0.2 Policy, adoption, fixture and all retained bytes. Record + their exact digests and the original prototype pin. Migration creates new + reviewable artifacts; it does not overwrite history. +2. Obtain explicit author/operator intent to migrate, including which exact Policy + versions, consuming Pack and adoption scope are intended. Explicitly choose + `workspace-managed` for former `desk-managed` content, or retain + `externally-managed` intent. Do not infer intent from an imported source's owner, + publisher, folder, citation, access response or approval history. +3. Preserve the source, narrative, interpretation/review-basis and consumer bytes + **exactly**, with their existing raw digest, length and declared media types. + Preserve anchors, local section/source IDs, opaque provider revisions and Pack + `specVersion`/identity. Do not extract, normalize, reserialize or rewrite those + files just to satisfy migration. Re-extraction or changed meaning is separate + authoring and requires a fresh review. +4. Construct a new Policy by removing the complete `prototype` wrapper and adding + the exact string `formatVersion: "1.0.0"`. Replace `desk-managed` with the + explicitly selected `workspace-managed`. Preserve the rest of the supported + content/provenance/sections. Choose the Policy's new immutable identity/version + explicitly: preserve its stable series ID only with a new artifact version, or + fork to a new ID. Never reuse an existing immutable `(id, version)` with changed + bytes. This offline checker cannot detect historical reuse on its own. +5. Serialize and retain those new Policy bytes. Regenerate the raw content digest + and length and, when requested, the `jps-canon` canonical identity. Update every + dependent adoption's exact Policy reference (ID, artifact version, bytes and + optional canonical digest); a stale old hash must refuse. Keep the exact Pack + bytes/reference; a different Pack is a separate new interpretation. +6. Construct a new adoption with `formatVersion: "1.0.0"` and no prototype wrapper. + Choose its immutable identity/version explicitly. Preserve or deliberately + re-review its exact scope and total coverage; do not fill omissions or upgrade + manual/pending/out-of-scope clauses automatically. Retain new adoption bytes, + regenerate their identities wherever referenced, and validate the full supplied + material under the draft checker and vectors. +7. Re-review dependent release/registration/export snapshots that pin changed Policy + or adoption bytes. Keep historical snapshots and runs on their original pins. + A new snapshot is an explicit host operation, never a side effect of parsing or + importing a document. Host authority and current admission remain separate. + +No approval, signature, authenticated review assertion, role, permission, lifecycle +state, publication receipt or dispatch grant migrates automatically. Existing +review-basis bytes remain historical explanations only. Even if every narrative +byte and clause ID is unchanged, a host must obtain fresh applicable authorization +for its new candidate and workflow, under its own contract. Informational sources +stay informational; making one governing requires a reviewed new adoption. + +The three retained examples intentionally use new Policy/adoption IDs and retain +the old consumer/source/narrative/interpretation files unchanged. Their new hashes +are reproducible examples, not migrated organizational approvals. There is no +migration helper or implicit parser fallback in this slice. + +Promotion from the proposed 1.0.0 grammar changes no Policy/adoption artifact +bytes. See [PROMOTION.md](PROMOTION.md) for schema URNs and result-envelope +maturity changes; do not rewrite retained documents to change their maturity. diff --git a/internal/policy/official/conformance/policy/1.0.0/PROMOTION.md b/internal/policy/official/conformance/policy/1.0.0/PROMOTION.md new file mode 100644 index 00000000..1af20d07 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/PROMOTION.md @@ -0,0 +1,42 @@ +# Promotion and identity map + +This promotes the exact corrected candidate at Spec commit +`a74a440cfc31d0e135cdc8035f3474b17f27f320` into the bounded draft approved by the +maintainer conditional on required green CI and PR 218 merge. The default branch +remains Review until merge; no completed adoption or publication is asserted here. +The [candidate pin](candidate-1.0.0-pin.json) records every historical candidate +file; [prototype-0.0.2-pin.json](prototype-0.0.2-pin.json) retains the original +prototype baseline `8a56a95d555c17640d2db4984363b779536b3c2a`. Neither old tree is +edited, redirected, reclassified or imported by the new checker. + +| Surface | Proposed candidate → draft promotion | +| --- | --- | +| Policy and adoption document grammar | Same exact `formatVersion: "1.0.0"`; every supported field, bound, URI rule, anchor, reference and coverage meaning is unchanged | +| Policy/adoption and all retained example/vector inputs | Byte-for-byte identical, including content digests, Pack pins, narrative, source, interpretation, optional canonical identity and invalid counterexamples | +| Schema resources | `urn:jps:proposal:policy-companion:1.0.0:{common,policy,governing-adoption,fixture,vectors}` becomes `https://judgmentpack.org/schema/policy/1.0.0/{...}.schema.json`; references change with the resource identity | +| Public document schemas | Versioned under `schema/policy/1.0.0/`; closed grammar preserved; schema URLs identify exact format resources, not evidence of publication | +| Reader valid result / capability maturity | `proposed-draft` becomes `draft`; valid result is exactly `{"status":"valid","formatVersion":"1.0.0","maturity":"draft"}` | +| Reader refusal objects | Unchanged finite code-only objects and phase ordering | +| Vector carrier | New schema identity; suite version remains exact `"1"`; manifest and valid expected results use `draft`; all 124 input cases and refusal answers stay unchanged | +| Capability exclusions | `adopted-or-stable-format` becomes `stable-format`; all operational/trust/evidence exclusions remain | +| Supported consumer schema | Byte-identical retained Core `0.2.0-draft` schema copy; the new reader uses that frozen copy instead of a future mutable current-Core path | +| Existing Core / Dialect / prototype | No schema, corpus, evaluator, content or canonicalizer changes | + +Schema resource identities and result-envelope maturity are observable changes. A +consumer pinning old schema URNs or comparing whole old results must explicitly +select the new schema/checker/result profile. An existing software reader pinned +to historical Spec bytes remains experimental for that exact candidate; a +software version number or successful existing run cannot advance its Spec pin +or conformance claim. Implementers must record the new immutable Spec commit and +released corpus when available, update schema resolution and expected metadata, +and verify the exact retained input vectors. + +Do not reserialize existing Policy/adoption documents merely to promote maturity: +there is no maturity field in those artifacts and their content identity remains +unchanged. A prototype 0.0.2 document has a different grammar and requires the +separate [explicit migration](MIGRATION.md), new immutable identities and dependent +snapshot review. No approval, role, permission or host lifecycle migrates. + +The reference checker reuses this author's existing strict reader/canonicalizer. +This promotion and a second language port do not establish independent authorship +or cross-vendor review. diff --git a/internal/policy/official/conformance/policy/1.0.0/PUBLICATION.md b/internal/policy/official/conformance/policy/1.0.0/PUBLICATION.md new file mode 100644 index 00000000..7805e5df --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/PUBLICATION.md @@ -0,0 +1,83 @@ +# Independent Policy draft publication + +The maintainer selected independent companion draft releases with Core unchanged. +The first release identifier is **`policy-v1.0.0-draft.1`**: first draft +publication of exact document grammar `formatVersion: "1.0.0"`. Naming it in a +source branch establishes neither publication nor stable maturity; publication +requires the exact tag and a maintainer-published GitHub release. The maintainer approved the bounded draft conditional +on required green CI and PR 218 merge; the default-branch RFC remains Review +until that merge. The acceptance decision is limited to draft maturity. + +## Exact identities and existing release machinery + +`policy-v` is the Policy-only namespace; `releaseVersion` must be +strict three-component SemVer followed by `-draft.N`, with an unsigned decimal +`N` and no leading zero except `0`. No stable Policy tag is supported. The first +release identifier is `1.0.0-draft.1`; its base deliberately matches grammar +1.0.0, but equality or a shared prefix never implies compatibility. The release +identifier, document `formatVersion`, immutable artifact x.y.z `version`, Core +consumer `specVersion` and local vector-carrier version `"1"` are separate values. + +The same `tools/build_release.py` and GitHub release workflow route this scoped +namespace to a closed [release manifest](../../../releases/policy-v1.0.0-draft.1.json). +The builder checks exact metadata/schema/corpus/format pins, RFC draft acceptance, +release notes, tag/commit/HEAD equality and a clean tracked worktree. The existing +archive, SHA-256 checksum, draft-prerelease and GitHub build-attestation steps are +shared with Core. No alternate publisher or bypass of Core checks is introduced. + +The Policy bundle prefix is `judgment-pack-policy-1.0.0-draft.1/`; archive names +are `judgment-pack-policy_1.0.0-draft.1_artifacts.tar.gz` and `.zip`, accompanied by +`checksums.txt` and build provenance. It contains only the selected Policy prose, +versioned schemas, complete 124-row input corpus/examples/checker, exact release +manifest/notes, pinned dependencies and shared strict-reader/canonicalizer helper, +the required frozen Core `0.2.0-draft` consumer schema, referenced companion prose and archived RFC +candidate/prototype provenance. Historical material stays explicitly unadopted. +Core bundles continue on `v` with their existing exact schema and +corpus checks; independently released Policy schemas/corpus are excluded from +Core bundle selection. No Core `specVersion` or evaluator semantics change. + +## Frozen format meaning and discovery + +The public document schema identities are exactly +`https://judgmentpack.org/schema/policy/1.0.0/{common,policy,governing-adoption}.schema.json`. +The local fixture/vector carrier schemas use `fixture` and `vectors` at that +same versioned prefix. The site serves those exact resource bytes. Before the +first immutable release they are candidate resources; resolving a URL proves no +adoption. On first publication those resource URLs and all normative format +bytes/corpus inputs are frozen. The release manifest pins their digests. + +Another draft release for the same exact format MUST retain those format/schema/ +corpus pins. It may revise packaging or non-normative explanation, with explicit +release notes. It MUST NOT change existing validity, interpretation, refusal +meaning/order, schema bytes or expected corpus answers while continuing to call +that input grammar `1.0.0`. A semantic change requires an explicit new format +selector, new schema resource URLs and reviewed migration/compatibility guidance. +No URL already published by a prior release is repointed. Each tag's JSON manifest +and notes remain available; schema identity/compatibility is never inferred from +release or artifact version arithmetic. + +The class's claim names the independent Policy tag/release and exact corpus +manifest/digest, plus format and supported Core consumer version. Until the tag +and maintainer-published GitHub release both exist, no immutable publication or +Policy offline-reader conformance claim is available. Draft RFC acceptance alone, +an experimental software release and two same-author ports do not establish it. + +## Gates before any publication + +The maintainer authorized bounded draft acceptance after CI and recorded the +limited public review in [ADOPTION.md](ADOPTION.md). It takes effect only upon +PR 218 merge after required green CI and the final bounded review/disposition. +The earlier separate same-vendor review and standing temporary different-vendor +waiver are identified there; neither supplies outside stakeholder review or +independent implementation evidence, and the general governance rule is unchanged. + +The PR carries the proposed Accepted status and refreshed exact pins; the default +branch remains Review until merge. A later production tag must point to the +accepted merged source and pass the shared builder's exact manifest/tag/commit/ +HEAD/clean-tree gates. The builder still refuses a source whose RFC status is +Review. Tag creation, the workflow's draft prerelease and maintainer publication +are separate actions; this source document does not establish their occurrence. + +The [prepared release notes](../../../releases/policy-v1.0.0-draft.1.md) identify +reader, writer, semantic and migration effects. Stable maturity remains blocked +on genuinely independently authored readers/evidence under the existing rules. diff --git a/internal/policy/official/conformance/policy/1.0.0/README.md b/internal/policy/official/conformance/policy/1.0.0/README.md new file mode 100644 index 00000000..bb97cd66 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/README.md @@ -0,0 +1,34 @@ +# Policy offline reader — draft format 1.0.0 + +This is the supporting material for the [Policy draft companion](../../../spec/policy.md) +and [RFC 0023](../../../rfcs/0023-policy-companion.md). The maintainer approved the +bounded draft conditional on required green CI and PR 218 merge; until then the +default-branch RFC remains Review. Immutable release publication remains separate. +The 124 vectors become a released corpus only when their exact Policy tag and a +maintainer-published GitHub release both exist. Passing them alone creates no +conformance, approval or authority claim. + +- [Draft contract](../../../spec/policy.md), [versioned closed schemas](../../../schema/policy/1.0.0/). +- [Portable vector input grammar](vectors/README.md), [exact manifest](vectors/manifest.json). +- [Capability record](capabilities.json), [promotion and identity map](PROMOTION.md). +- [Explicit prototype migration](MIGRATION.md), [publication plan](PUBLICATION.md). +- [Public-process record and conditional draft disposition](ADOPTION.md). + +The examples retain the proposed candidate's exact Policy, adoption, Pack, source, +narrative and interpretation bytes. The checker continues to use the repository's +existing `tools/dialect_verify.py` strict reader/canonicalizer; this reuse does not +provide independently authored implementation evidence. + +With the repository's pinned Python 3.12 dependencies: + +```sh +python conformance/policy/1.0.0/verify.py --capabilities +python conformance/policy/1.0.0/check_vectors.py +python -m unittest discover -s conformance/policy/1.0.0 -p 'test_*.py' -v +``` + +The independent Policy draft bundle selects these artifacts; Core bundles exclude +the independently versioned schema/corpus directories. The site exposes versioned +schema resources and conditionally approved draft prose. Its raw artifact +directory is separate from the independent release bundle; obtain released +corpus bytes from the exact immutable Policy release. No Core corpus changes. diff --git a/internal/policy/official/conformance/policy/1.0.0/candidate-1.0.0-pin.json b/internal/policy/official/conformance/policy/1.0.0/candidate-1.0.0-pin.json new file mode 100644 index 00000000..aafcc5de --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/candidate-1.0.0-pin.json @@ -0,0 +1,178 @@ +{ + "repository": "https://github.com/Judgment-Pack/judgment-pack-spec", + "commit": "a74a440cfc31d0e135cdc8035f3474b17f27f320", + "formatVersion": "1.0.0", + "maturity": "proposed-draft", + "files": { + "MIGRATION.md": "sha256:0602a092ae1c6f670e0b440f3df33de1eb4d825bf714af50143151882e674e34", + "README.md": "sha256:21364149bbd76cc7bc2b917b898d0fa79739bd454f94d4af3510e0e1a6ea88f7", + "capabilities.json": "sha256:57977501550cb90de46d9eb88016725949f1eda83be470ff467804e8f393a287", + "check_vectors.py": "sha256:4a7f5842a685c0085908aeabe05fdd29df8ebcbc8dd986112fa947989d056230", + "common.schema.json": "sha256:a26362280ac4cf0ba7a15a6c382ee8c61df97c78be4ef291f1107db24f28dd06", + "examples/data-access/adoption.json": "sha256:98294b5df0876cc793f236fa5184380aa37f2e459e1f630a5e613237404c2ec0", + "examples/data-access/consumer-pack.json": "sha256:c4912216ef58c754473bdda95be7322126ab2970bd75bea9306f342927d974e4", + "examples/data-access/fixture.json": "sha256:95575efc4fc7571089f17b7684c9ea66c7f16d52cb5b7032c0c494f3f73c25db", + "examples/data-access/interpretation.txt": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "examples/data-access/narrative.txt": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "examples/data-access/policy.json": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "examples/data-access/source.txt": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "examples/procurement/adoption.json": "sha256:e9c871b2e7dc7448e46b2d4d347beb504bbe0a691be11df4283a95a693208703", + "examples/procurement/consumer-pack.json": "sha256:d810d8b3972a4bbc31cd3deb7ada4de965f1ad59bf753cec6748f943213cbcee", + "examples/procurement/fixture.json": "sha256:bd05d532515eff20322a88c8cbb34899849479f4f4fef8a1f2e3d577a2b96205", + "examples/procurement/interpretation.txt": "sha256:14e401b11a917a3275bc18c2d85f547bfd71cf34a706e160ec54621603b36de2", + "examples/procurement/narrative.txt": "sha256:993a73c70afdc16c94368982d1e951c85c90838d1f750a7001c2942dc9834b94", + "examples/procurement/policy.json": "sha256:539587356d8c0942f6e2c98ec09311e9c55fc4efcc6b9f8845e58db817a8dc58", + "examples/procurement/source.txt": "sha256:4681b36d52396d3faef09e4a7c551d829920362beb47a1bfb32c2d6c4d82763b", + "examples/refunds/adoption.json": "sha256:7c7cd121fc4510fff19b8bcaf120ce1a9cb3f7e60b8e811ce9be917799367bc8", + "examples/refunds/consumer-pack.json": "sha256:2a049f10cd8c5d4fc81200976507a8563d0bc1fca19fa9691fc1601507512e38", + "examples/refunds/fixture.json": "sha256:48b47e5ca483e53ee4c943409f9892b518108cd0f94ead4f2715852d25a74d60", + "examples/refunds/interpretation.txt": "sha256:63f58f37957f808e98c67db11ac9d835286733336e47ae24f28b974d431b9862", + "examples/refunds/narrative.txt": "sha256:909d57f27b7359c777dfb2ea07d859408a13504bf8dded27807889f7cde52969", + "examples/refunds/policy.json": "sha256:8e3a487de4b15a1bc6c824e6dedd2e1b4fe16f4b3c4430a76b46e943ef2565ff", + "examples/refunds/source.txt": "sha256:ae72534013fc75083b184765e7a558b71b5e4674720aa56e8960844fd712c6c0", + "fixture.schema.json": "sha256:70f72c813ecbf988087de1de41d0871b24dec340e79af5bfe8e488a51ce9cd1b", + "governing-adoption.schema.json": "sha256:2a6a55c0efdb5fc25a52bc645eda33ca67247e7db83a0de21204ef6a28432dcb", + "policy.schema.json": "sha256:21c2a3a3f9763cecfb9348938e078384a9abbf3e55fb8126704cf8a55555fcd7", + "prototype-0.0.2-pin.json": "sha256:48a264397902303c0373c4ae11e2bde9b55474f7ff76b33e1fdc3f919c70bacb", + "test_contract.py": "sha256:0a1ad1f90efa0a257851e7f4c420d494d2e38d59405b0139337986f077b070e9", + "vectors/README.md": "sha256:d27b79c1932261d3bf64abb07d5c95ccab0a9016e83412c40a129747fdb8eaec", + "vectors/documents/aggregate-max.json": "sha256:356820def6f85b5a73a1b3520dac185ca3413a17a7d1f269009b3109f789be09", + "vectors/documents/aggregate-over.json": "sha256:356820def6f85b5a73a1b3520dac185ca3413a17a7d1f269009b3109f789be09", + "vectors/documents/aggregate-shared-media-counted-once.json": "sha256:356820def6f85b5a73a1b3520dac185ca3413a17a7d1f269009b3109f789be09", + "vectors/documents/anchor-empty-range.json": "sha256:f57abd537598b6f2d4f21f5531cc8b287cb8a408174b1699afe23ab862bba431", + "vectors/documents/anchor-outside-narrative.json": "sha256:aa0fed3939d88597f5a2eab96e1a9305f5671c9d9ffc1140c3a79a0a985d24e9", + "vectors/documents/anchor-over-bound.json": "sha256:0f10c69c68a792e43de7b56978bce3073f2baba2ef026607d5c21104e113916f", + "vectors/documents/anchor-stale-digest.json": "sha256:f15662d3349adebe3f37358da15f6c1cbea7a531ead7be55b13a83e6fea865f0", + "vectors/documents/anchor-utf8-split.json": "sha256:dbb8e91eeaaec4ca6afa0b60ed9ab7621fc46b464052181fc15a7207880d8485", + "vectors/documents/approval-field.json": "sha256:b6d55b494d997d827ceda4f0c7b0ff4c644171928f22b2c64bff7ba049cdaae6", + "vectors/documents/artifact-build.json": "sha256:d8e6a2f1de1400d0f93deb768709a79dd2608581a59f3d91c48c0fe46b53da3e", + "vectors/documents/artifact-independent.json": "sha256:b29b0d41f9c53df4ccf45b304e4307848a5aca82f9669ce6a6f532ba9eca7efa", + "vectors/documents/artifact-leading-zero.json": "sha256:9bac870cd83f3ce25b4d02c820d962d084de92ea0ccdefb1b4a86e194ece3be0", + "vectors/documents/artifact-max-256.json": "sha256:79b1ac4516f3be2234b1a333a09679474c8f0f9d4c8743cf0b552eaaa97ff06c", + "vectors/documents/artifact-newline.json": "sha256:7b398d8f7062dc484dd919271c3cb4d090389604a1504b356892cedf06e29431", + "vectors/documents/artifact-number.json": "sha256:4d81f8abe5de7580d5896bc2538dc7c7bb6eca300a7fb3a8dab7bf8ad9525cb1", + "vectors/documents/artifact-over-256.json": "sha256:eb73ca4e4a698530f0dee89fefdd9a0914ca0af55202c4da478797a9de491278", + "vectors/documents/artifact-two-components.json": "sha256:9d2d77db996adea115097fd4ef3c4a3ffbe4a08799aaea256d00cf3e94d5969e", + "vectors/documents/bom.json": "sha256:aa25e978046d680ef8740d837e6de5bc1e2a2dc6089dbda1012544b538d53f65", + "vectors/documents/companion-float.json": "sha256:eb454acf3392a959782b8b7e53332d65ebd0c6607d77a1f17561f91534987cee", + "vectors/documents/companion-unsafe-integer.json": "sha256:98f3e87d38e17bce0a5e1b2076ae16f78bdf45001dfd192f39be0fe94a50116d", + "vectors/documents/consumer-fallback-unknown-pack.json": "sha256:8c7a49e4b3b81d1880e64bdee1734c4805a1c4daffc599683ce098d47e0c2011", + "vectors/documents/consumer-fallback-unknown.json": "sha256:39fb7ccbef49a24c8f0f2241eb8413c56521df4c4aacd9b75206301718a8aaf4", + "vectors/documents/consumer-graph.json": "sha256:f380c38339a85ab4ef31c23640b319f85bc7783e8e75c41d11ae741196b604d1", + "vectors/documents/consumer-rule-id-duplicate-pack.json": "sha256:93560dbc1b0537cf834d02b2607dade6b9a6407c5a37caf36954822762f0c312", + "vectors/documents/consumer-rule-id-duplicate.json": "sha256:4a1285549c9649cbdd756fe836010d1e4e159f36a0bc9cf7a0ad704c38a38b4a", + "vectors/documents/core-decimal-raw-pack.json": "sha256:9a2b3c06074ead90e9b34d3213ad9b5665ad05c548dfa9cc3be57e8e9f23634b", + "vectors/documents/core-decimal-raw.json": "sha256:93a8d631bd4244f3b309451071488b35e064ab3618934a76b0d9ebf46cb5e442", + "vectors/documents/core-decimal-requested-canon-pack.json": "sha256:9a2b3c06074ead90e9b34d3213ad9b5665ad05c548dfa9cc3be57e8e9f23634b", + "vectors/documents/core-decimal-requested-canon.json": "sha256:d4f9c354aaaf6093d5034cf6adcd8c01bb1aa9cbcf32f9ccafdd9aa2790bb737", + "vectors/documents/core-exponent-308-pack.json": "sha256:52bd1104aedcc81011f2b0aaac2f5a3e082dc96b7a9c490cf441a005d3e3667e", + "vectors/documents/core-exponent-308.json": "sha256:c9275574c422b7520ae07d85bf6491d895b7fc62689308d6338df55180c3cfc0", + "vectors/documents/core-exponent-over-pack.json": "sha256:7d593e7fac09abf836b599e7719f33850381bd60d5aa8c078a7cf2d43c494843", + "vectors/documents/core-exponent-over.json": "sha256:0cdf2672ddded5c222e3b18c7a9b7041f0175591be323a39b5bddff6672e5763", + "vectors/documents/core-number-128-pack.json": "sha256:0a694f57fa21a82551738a128022578c837b332848866db302da838c70b8e3c7", + "vectors/documents/core-number-128.json": "sha256:5e97a1562791b398a9d7e70533c595a568b889c7966c43ea43eeadf751de6417", + "vectors/documents/core-number-over-128-pack.json": "sha256:bceb1d327714090d58fb463516779aeb50168299e0ff0d2a9de21a7ff5421114", + "vectors/documents/core-number-over-128.json": "sha256:4372c8016d83883bc944428d5d09510abac11dc10501cc74cbb7d577913a3eec", + "vectors/documents/core-unsafe-int-raw-pack.json": "sha256:2857116756d73d0babfcd3ede480fd8d462ea95bfcbc234c5e80983b3c4b9910", + "vectors/documents/core-unsafe-int-raw.json": "sha256:880c2b146822bd4ca14b5bb79953f706aa770f0b61afc7c76312ed4a23a1d715", + "vectors/documents/core-unsafe-int-requested-canon-pack.json": "sha256:2857116756d73d0babfcd3ede480fd8d462ea95bfcbc234c5e80983b3c4b9910", + "vectors/documents/core-unsafe-int-requested-canon.json": "sha256:f0dbc21fab5b69614e11c9948a897a1ec9f7e3dc3d8bb23e41bbd2521220ff9f", + "vectors/documents/coverage-duplicate.json": "sha256:5c804382923831378fd72aa6a4a115cefc5c59357c7fd5ff7fb3b57cec158a0d", + "vectors/documents/coverage-omitted.json": "sha256:4fad299227c43ff3d3fda7cadd881398f7b908bfa6177abb475e50fe2f3e7c65", + "vectors/documents/coverage-outside.json": "sha256:f53966ceab71d7d1577684d064c52d3515f266da03e811e1444408875757cb5d", + "vectors/documents/depth-32.json": "sha256:4e04cac422d9ecd4a5f6221653eeb4eaf29077cf3f588cd36bf6dc8ead76971f", + "vectors/documents/depth-33.json": "sha256:eac9bf029c22e177c74309fb891e3351dccfb04f055127ea82dc2dc3136cd899", + "vectors/documents/desk-managed-alias-refused.json": "sha256:5234fd95d7550559cd2c2147bed06f9ff6f905b2e4607e8eeebfef03a778698c", + "vectors/documents/document-max-bytes.json": "sha256:515b22dea881243654a2c04aacd1fae4079e914bb63c9fd028a21821c0add188", + "vectors/documents/duplicate-json.json": "sha256:e36957f702ac6bd47232355cad2b9a15a1bc3d6a23f0cbd5bb2d7bf4d33e8288", + "vectors/documents/duplicate-policy-identity.json": "sha256:07f804bccb31243a806fa8bf820089bf5b2328cd68a0a267f00056f0f161b2ed", + "vectors/documents/format-0.json": "sha256:90e517db584be09a68876e0e12e1fdcfa6bca002cfc249e884f76c009e2646b3", + "vectors/documents/format-2.json": "sha256:8c2a26c5f677e592d86b2e216439d45ce1846fd409c66e0b8bc1e827de18e41d", + "vectors/documents/format-before-canon.json": "sha256:d945aff06cc556a99fee0d475f16fd5f0fabb96965e74427cb822b465c8b1bf2", + "vectors/documents/format-before-shape.json": "sha256:179cd26a351c7bf45c2fca5bc06ba835aa6eaa1a546cec4aa900706a697598f5", + "vectors/documents/format-bool.json": "sha256:5dc2e06bd54f5207ecdb5ba27ec2b80f772193a971f06106067aed2ec594bbbd", + "vectors/documents/format-int.json": "sha256:aff42b4b0a8e641cc5c92c661cdde3537745a2c2466d2b79c7d01e1a6493708b", + "vectors/documents/format-leading-zero.json": "sha256:c6a980c290cd29ee4c15883a88e4c80de0f99e4605a5f3e094067bd4a221d3b2", + "vectors/documents/format-missing.json": "sha256:4ea51f8934e58095eee944853cc5541124ea94f0b24c09078ac27f465f32d3bc", + "vectors/documents/format-newline.json": "sha256:dc41a327f8e1c762c6d2326badcfc829814c970f7afbbbbc54f87d585eea74da", + "vectors/documents/format-patch.json": "sha256:dcbac865d354a2865bf1d17a0197c603f5a120326958bb7e8cbd95ca8dc20355", + "vectors/documents/format-short.json": "sha256:93f0b639cbb98ad9ec64d16c09d58010f951c5664962e8cf1838da5b030a5769", + "vectors/documents/format-suffix.json": "sha256:debe48d95d872019bc1bdfadff03f645e14dfed66dd034d0d77d95520ca10f5c", + "vectors/documents/format-unicode.json": "sha256:e0ba64d6e3ac4e5f72cbcbea04b9dfe5052747d56244950835feaf08c9db041a", + "vectors/documents/format-v-prefix.json": "sha256:d18d8d65f5126fde63083e1594ef93f0944e092d98e29d54ee3dfe1cc0d8a66a", + "vectors/documents/informational-max.json": "sha256:569a5b0680eafb6308c2984912e4a702054e6839a6c484bec7eb68ae0fc8aad8", + "vectors/documents/informational-over.json": "sha256:361db3f18d7640ac7ecaebfe28e45436ca10bc8ebc806fd23f1ac5145ca3c472", + "vectors/documents/invalid-utf8.json": "sha256:36781faac995a68b69aab7d540747e0c70efed427e66a608cdf64fc4feaaff12", + "vectors/documents/kind-id-confusion.json": "sha256:d7f690d0ca4b7962916984ee5ee92b70c3b7464016c0e003b0a3bbf4560127c8", + "vectors/documents/limited-scope-missing-basis.json": "sha256:9d9a9b30e6bfa07ca3aa059f14f1011bf2b1dcee92e218d8ea6656b8bad65584", + "vectors/documents/limited-scope-unknown.json": "sha256:670a45f40a0ff1b21a12481f962f50ae63618d79fa30932882e45ed645a64bdd", + "vectors/documents/malformed-over-depth.json": "sha256:fdc562409aec5a2549f9a1b1f21155ec3b49c71ce76b3ad080c56ba1d0543a76", + "vectors/documents/missing-governing-policy.json": "sha256:27f20c087c208144a234684ca1719ab9e0013dad914be4ddf507a546e1d216f8", + "vectors/documents/missing-narrative.json": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "vectors/documents/multiple-json.json": "sha256:b51f08b698d88d8027a935d9db649774949f5fb41a0c559bfee6a9a13225c72d", + "vectors/documents/multiple-policy-identities.json": "sha256:fedf62df6fd02f041a2ea418305804ab5ace22bc0946cd1c876c0063937ce2c5", + "vectors/documents/narrative-max.json": "sha256:c1592868007ae1365c18c55e7325d641f82cb4dfcf7ad71ab5cda2fb9a984504", + "vectors/documents/narrative-over.json": "sha256:5ec2805842ca8c97450c468d2b78c6063d48c00287a1195da476e23e36c0008f", + "vectors/documents/nonfinite.json": "sha256:d5b592c05dc25b5032553f1b27f4139be95e881f73db33b02b05ab20c3f9981e", + "vectors/documents/number-literal-over-128.json": "sha256:e2eb26c79686e936e6603fbcd49b32881635021917d175c4df147b5e21b44f5c", + "vectors/documents/opaque-original.json": "sha256:feb70c8c8e2a8f80e634980de161fa1bb092460969707696b5a3b5059ad71df3", + "vectors/documents/opaque-original.pdf": "sha256:af7777006b9a8e6b9ffd9dbc25f3d4f3c54331e9f74948ba9d1facdf63b1a8be", + "vectors/documents/original-max.json": "sha256:78948872a9e1ff6eddff492224fe06858b0f4c0e0f8439553e49d58043abc541", + "vectors/documents/original-over.json": "sha256:990e5847fc18a19f13a1cf7df4dd55b943e6be3c65ba87c25189405ac896c1a0", + "vectors/documents/permission-field.json": "sha256:87516d167771479d3b14674ddfc747e03e6a3b12175af1a6cbf91daa7ad34069", + "vectors/documents/policy-canon-stale.json": "sha256:45fa4fb5f254eeed1037d1374524b49ed6b94bf484a6f7b7af77a28c725c271a", + "vectors/documents/policy-identity-stale.json": "sha256:77f758365f4c4b772cde630b45f2045e8434511dc5d5e261c67e41de9db7a78c", + "vectors/documents/policy-version-ref-stale.json": "sha256:f048ab96431c7a97f44a4339b72dc03a164c0c7747a8d2aa9b95fafa099e4457", + "vectors/documents/prototype-selector-refused.json": "sha256:b537c0a1efb5ebc6e06e8a8e60dca2d0ad3d2c4f5e4eeab091b23c3dff4fa408", + "vectors/documents/registration-count-16.json": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "vectors/documents/registration-count-17.json": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "vectors/documents/requirements-field.json": "sha256:397484bcb95f136afcc4b2201a6137ef100d9cdc3c8a0b2326dbc1653d2db62c", + "vectors/documents/review-max.json": "sha256:729e84b3a8c8826638b7cf5f9703429658aee12eb9aafa0a5dde82f50f450718", + "vectors/documents/review-over.json": "sha256:9ca0faef44ae60d277c1744c358a55c219400b15a6365f519ba20059d14d153b", + "vectors/documents/second-policy.json": "sha256:144558275929f298692344329199afd892f5d74f1bc8aa70bea4bda14e98d627", + "vectors/documents/section-id-duplicate.json": "sha256:c63007da9f867e07f68f8a91758f2054436e91263ddb7c50b8bd5dee21cf80be", + "vectors/documents/shared-bytes-multiple-media-types.json": "sha256:f4d2bc2c621771b30f3ae984ab3fd05a00891827c047d5a746fc44a3ad23ad1a", + "vectors/documents/signature-field.json": "sha256:fc4064630a3ef93cbfb46969a22600796a2954256ca42876325673e5d2ef49d1", + "vectors/documents/singleton-with-id.json": "sha256:232d4bbb79ff949aaf6c9e17292c5c70426595d8e761c6fefecb6d225e7d677a", + "vectors/documents/source-id-unknown.json": "sha256:e93860ee23385cee86b3bca725e14c3fa4f45aadd3c5cb4fa422ee3d008cd3f1", + "vectors/documents/stale-material-hash.json": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "vectors/documents/stale-material-length.json": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "vectors/documents/standalone-policy.json": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "vectors/documents/surrogate.json": "sha256:8c0c59dd0d275aadcd462a5fe12eb352cbdfeaf961eae4f85a4660521df7d2f5", + "vectors/documents/unknown-kind-registration-over.json": "sha256:1e2f99280db3d76fbb608f1c13a53be498d2b4bfc46836b2893383895cf076ab", + "vectors/documents/unknown-rule.json": "sha256:b4d8bc7e5745d897cda79f121721b388b4da9e1fe125d782dbe161cddd03aa87", + "vectors/documents/unregistered-media-type.json": "sha256:1c816a89de90ad710cfeb4b17bad6f0720515395e0af0b35e0394d539e605b30", + "vectors/documents/unsupported-element.json": "sha256:356114c27d81685231f3e6b7aa32305ae890319cf392e652e69d8ce908f5ca90", + "vectors/documents/uri-final-lf-pack.json": "sha256:c418f413e2b19f32dcc2f46664717ff2eb81e940fca57315275d39e63037f495", + "vectors/documents/uri-final-lf.json": "sha256:2f801fd7b06bf34f5c3a42973249a71bf84c421755a1ef372b1bbd4ccd3710c4", + "vectors/documents/uri-fragment-raw-brackets.json": "sha256:0ef6ed9f582d15475ec9b5358be05194b372f1fbc1935cc3a175e31e6c526736", + "vectors/documents/uri-invalid.json": "sha256:2c8f6c238143c7dfa4381ab81b78365bfd43902a7eea09b872f1ee37ca0789ba", + "vectors/documents/uri-ipv6-compressed.json": "sha256:6c59778a6d517c252840226d8a3056280777b04e76bf6759c731343f7d01080b", + "vectors/documents/uri-ipv6-double-compression.json": "sha256:b1be77321cd95c07b4ecf8baaba8751028b831e2787ba8ab6ee2a9c5e884193e", + "vectors/documents/uri-ipv6-ipv4-tail.json": "sha256:2c26026d56fe5564dad671c20ad55b0237d5137a291edf56c455bd217f6340c2", + "vectors/documents/uri-ipv6-leading-zero-ipv4-tail-pack.json": "sha256:0ea4f86f542fcfe5a183050daac17f5d43796995965096773ba7481c5ad93e4e", + "vectors/documents/uri-ipv6-leading-zero-ipv4-tail.json": "sha256:88efbe036d7386812662a46c154cf1521caf9864a9e676d35036038af754a81f", + "vectors/documents/uri-ipvfuture-invalid-version.json": "sha256:399ba24e5ffb43360654f3c641fc002f61d8cb2f920eed0480808912bbccc2ed", + "vectors/documents/uri-ipvfuture-lowercase-pack.json": "sha256:ebd7ca932ab1557442af46b391d5e1b980c9398a7213d4682a3308732be4cf5a", + "vectors/documents/uri-ipvfuture-lowercase.json": "sha256:13c1a9fff73cddc63b779e619a622cc05e6ffeb4d5eb2d544a43acfe80973bbd", + "vectors/documents/uri-ipvfuture-uppercase-pack.json": "sha256:6992d4add7edc8a3dec0679b28dd58a4838d2cf5f218b4f702081583e9cb8c6b", + "vectors/documents/uri-ipvfuture-uppercase.json": "sha256:0ce1badc441db3a4290400dab23f2d8e5afee8fc0bf799abdb7cb01140e9ff10", + "vectors/documents/uri-numeric-regname-leading-zeros.json": "sha256:2ab9c70bc4c613fabe5bcbacd27ca79b73b08803e918f1755b3735ebcd96ca6f", + "vectors/documents/uri-path-raw-brackets-pack.json": "sha256:c0e3ef08c4644024d87d26ed4d77a5c14b1b7f46c8ca0a4b0ce7d8157ade7208", + "vectors/documents/uri-path-raw-brackets.json": "sha256:b70d9a76a3b38f58a0f2b075c9ecfe6803b6e0a404c2b526000f85a86b244f67", + "vectors/documents/uri-percent-brackets.json": "sha256:52ed06084ad97c026b15ece99674e6d638d26509506b62ce3d5195da7acd5a63", + "vectors/documents/uri-percent-incomplete.json": "sha256:f8db4efe5972393c15cd0c8ad8cbe88262ac02845d8863781cad83f970fa212b", + "vectors/documents/uri-percent-nonhex.json": "sha256:4a239d1009d314a9a0e285848fb1eba211a5574e17907253936aa6820f98534b", + "vectors/documents/uri-percent-regname-pack.json": "sha256:50e9179933d3bab136e4872f25874e556cc9b1508410dd945ad564a2a3e90daa", + "vectors/documents/uri-percent-regname.json": "sha256:86ea9309a59ba683a85c73442c2638d56aa21f2e9e4f020d3954b043ab7c5f06", + "vectors/documents/uri-percent-unicode.json": "sha256:5f062c610d9c546cba55951e3f9921b0de142ac382dac7d4a00e69ba65cf890f", + "vectors/documents/uri-query-raw-brackets.json": "sha256:8d24bd52b12805ba9c602f113ca47c0a1dd141fc35577c09e0581c033ee46e24", + "vectors/documents/uri-raw-unicode.json": "sha256:15bf301598d90e8a1e001973df95a1cb04021e1cb7a4385bf3ca0ef8eecebf7a", + "vectors/documents/uri-rootless-raw-brackets-pack.json": "sha256:a2b8f1d350ac991ebfd9f94ce6e53e40d19485e1f8ec7baaeb91f2ba279418ca", + "vectors/documents/uri-rootless-raw-brackets.json": "sha256:4143f4d8d6e9df42e8a8ab8e011b9404b719f4e400dcb25d360d2ac80ff2b39d", + "vectors/documents/uri-userinfo-percent-brackets.json": "sha256:85c63cc716e50e0020cd419f636caf824afbe22826df6abc135cc7433cf4253f", + "vectors/manifest.json": "sha256:953177df0e844ad78ebe145d21c9f1e760336eda4ed20247331493c44be8eedd", + "vectors.schema.json": "sha256:4843941ad1884306a896f5ced516dede695cb4a3fb8512973f3a54860d4a1a88", + "verify.py": "sha256:d8bface7de0c795ac04c6d2a307fb3d881b5a496514c04818d35ca2ef7ea68c3" + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/capabilities.json b/internal/policy/official/conformance/policy/1.0.0/capabilities.json new file mode 100644 index 00000000..fc21f6d3 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/capabilities.json @@ -0,0 +1,74 @@ +{ + "capability": "jps-policy-companion-offline", + "maturity": "draft", + "formatVersions": [ + "1.0.0" + ], + "consumerSpecVersions": [ + "0.2.0-draft" + ], + "kinds": [ + "policy", + "governing-adoption" + ], + "features": [ + "exact-byte-sha256", + "utf8-section-anchors", + "scoped-total-coverage", + "typed-core-pack-references", + "optional-jps-canon-identity", + "multiple-media-types" + ], + "limits": { + "documentBytes": 262144, + "documentDepth": 32, + "numberLiteralCharacters": 128, + "exponentMagnitude": 308, + "materialBytes": 1048576, + "originalBytes": 4194304, + "distinctRetainedBytes": 16777216, + "materialRegistrations": 16, + "versionCharacters": 256, + "sections": 64, + "sources": 16, + "governingPolicies": 16, + "consumerElementsPerSection": 64, + "textCharacters": 4096, + "uriCharacters": 2048, + "localIdCharacters": 128, + "mediaTypeCharacters": 128, + "sourceRefsPerSection": 16, + "scopeSectionIds": 64, + "coverageRecordsPerPolicy": 64, + "informationalSources": 16, + "canonicalIntegerMagnitude": 9007199254740991 + }, + "excludes": [ + "stable-format", + "graph-consumers", + "evaluation", + "full-core-semantics", + "signatures", + "review-assertion-trust", + "live-authority", + "permissions", + "currency", + "source-fetch", + "automatic-migration", + "independent-interoperability-evidence" + ], + "refusalCodes": [ + "input-over-bound", + "invalid-json", + "invalid-selector", + "unsupported-format", + "invalid-document", + "missing-material", + "reference-mismatch", + "invalid-anchor", + "invalid-coverage", + "invalid-consumer", + "unsupported-canonical-identity", + "invalid-carrier" + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/check_vectors.py b/internal/policy/official/conformance/policy/1.0.0/check_vectors.py new file mode 100644 index 00000000..3dc5f45f --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/check_vectors.py @@ -0,0 +1,58 @@ +#!/usr/bin/env python3 +"""Run the static draft agreement vectors; not a JPS conformance claim.""" + +import argparse +import json +from pathlib import Path + +import verify as v + + +def source_bytes(source, root): + if "repeatByte" in source: + return bytes([source["repeatByte"]]) * source["byteLength"] + path = v.local_path(root, source["path"], allow_nested=True) + # Vectors deliberately include one byte over the registration bound. + return v.read_local(path, v.MAX_ORIGINAL_BYTES + 1) + + +def case_result(case): + try: + raw = source_bytes(case["document"], v.HERE) + except v.ContractError as error: + return {"status": "refused", "code": error.code} + registrations = [(item["content"], item["source"]) for item in case["materials"]] + return v.verify_input(raw, registrations, load_material=lambda source: source_bytes(source, v.HERE)) + + +def run_vectors(manifest_path=None): + manifest_path = Path(manifest_path) if manifest_path else v.HERE / "vectors/manifest.json" + manifest = v.read_json(v.read_local(manifest_path, v.MAX_DOCUMENT_BYTES)) + v.check_schema("vectors", manifest) + ids, answers = set(), [] + for case in manifest["cases"]: + v.require(case["id"] not in ids, "invalid-carrier") + ids.add(case["id"]) + actual = case_result(case) + answers.append((case["id"], actual, case["expected"])) + return answers + + +def main(argv=None): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("manifest", type=Path, nargs="?") + args = parser.parse_args(argv) + try: + answers = run_vectors(args.manifest) + failed = [name for name, actual, expected in answers if actual != expected] + answer = {"status": "mismatch" if failed else "matched", "cases": len(answers), "maturity": "draft"} + if failed: + answer["caseIds"] = failed + except v.ContractError as error: + answer = {"status": "refused", "code": error.code} + print(json.dumps(answer, separators=(",", ":"))) + return 0 if answer["status"] == "matched" else 1 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/data-access/adoption.json b/internal/policy/official/conformance/policy/1.0.0/examples/data-access/adoption.json new file mode 100644 index 00000000..e6e67e2c --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/data-access/adoption.json @@ -0,0 +1,75 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:c4912216ef58c754473bdda95be7322126ab2970bd75bea9306f342927d974e4", + "byteLength": 1558, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:d20e694ca1f99d0b3c8e239fdec3e5d1122dc875986ef5ed3651a52b3fba2473" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/data-access/consumer-pack.json b/internal/policy/official/conformance/policy/1.0.0/examples/data-access/consumer-pack.json new file mode 100644 index 00000000..a292cbe5 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/data-access/consumer-pack.json @@ -0,0 +1,62 @@ +{ + "specVersion": "0.2.0-draft", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "title": "Data access — synthetic interpretation", + "description": "Synthetic RFC material only. No operational authorization or external action.", + "decision": { + "intent": "Apply the retained automated eligibility clause.", + "question": "Is this request eligible for the automated path?" + }, + "outcomes": [ + { + "id": "eligible", + "label": "Eligible for review" + }, + { + "id": "ineligible", + "label": "Ineligible" + }, + { + "id": "review", + "label": "Human review needed" + } + ], + "rules": [ + { + "id": "eligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": true + }, + "outcome": "eligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + }, + { + "id": "ineligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": false + }, + "outcome": "ineligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + } + ], + "fallbackOutcome": "review", + "escalation": { + "triggers": [ + "unknown", + "no-match" + ], + "target": { + "kind": "human-role", + "name": "Synthetic reviewer" + } + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/data-access/fixture.json b/internal/policy/official/conformance/policy/1.0.0/examples/data-access/fixture.json new file mode 100644 index 00000000..4d9d3a3f --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/data-access/fixture.json @@ -0,0 +1,58 @@ +{ + "fixtureVersion": "1", + "synthetic": true, + "scenario": "data-access", + "materials": [ + { + "path": "narrative.txt", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + } + }, + { + "path": "source.txt", + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + }, + { + "path": "interpretation.txt", + "content": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "path": "consumer-pack.json", + "content": { + "bytesDigest": "sha256:c4912216ef58c754473bdda95be7322126ab2970bd75bea9306f342927d974e4", + "byteLength": 1558, + "mediaType": "application/json" + } + }, + { + "path": "policy.json", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + } + }, + { + "path": "adoption.json", + "content": { + "bytesDigest": "sha256:98294b5df0876cc793f236fa5184380aa37f2e459e1f630a5e613237404c2ec0", + "byteLength": 2352, + "mediaType": "application/json" + } + } + ], + "policy": "policy.json", + "consumer": "consumer-pack.json", + "adoption": "adoption.json" +} diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/data-access/interpretation.txt b/internal/policy/official/conformance/policy/1.0.0/examples/data-access/interpretation.txt new file mode 100644 index 00000000..4aa6c667 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/data-access/interpretation.txt @@ -0,0 +1,4 @@ +SYNTHETIC REVIEW BASIS; no person approved this fixture. +The eligible and ineligible rules interpret the automated eligibility clause. +The fallbackOutcome routes an unmatched classification to review; unknown facts escalate. +Other coverage is stated explicitly. diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/data-access/narrative.txt b/internal/policy/official/conformance/policy/1.0.0/examples/data-access/narrative.txt new file mode 100644 index 00000000..bd5e6867 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/data-access/narrative.txt @@ -0,0 +1,10 @@ +SYNTHETIC RFC PROTOTYPE — Data access + +Automated release +Only de-identified datasets may be released through this automated path. Identifiable datasets are refused; missing classification goes to a data steward. + +Restricted requests +A data steward reviews restricted requests through the manual access process. This pack cannot grant an exception. + +Quarterly audit +Review the access log quarterly. A separate audit implementation is still needed. diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/data-access/policy.json b/internal/policy/official/conformance/policy/1.0.0/examples/data-access/policy.json new file mode 100644 index 00000000..ae2a479e --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/data-access/policy.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/data-access/source.txt b/internal/policy/official/conformance/policy/1.0.0/examples/data-access/source.txt new file mode 100644 index 00000000..794f4622 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/data-access/source.txt @@ -0,0 +1,5 @@ +SYNTHETIC ORIGINAL SOURCE; NOT AN APPROVED POLICY + +Clause 1: Only de-identified datasets may be released through this automated path. Identifiable datasets are refused; missing classification goes to a data steward. +Clause 2: A data steward reviews restricted requests through the manual access process. This pack cannot grant an exception. +Clause 3: Review the access log quarterly. A separate audit implementation is still needed. diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/procurement/adoption.json b/internal/policy/official/conformance/policy/1.0.0/examples/procurement/adoption.json new file mode 100644 index 00000000..9c55f540 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/procurement/adoption.json @@ -0,0 +1,97 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/procurement/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/procurement/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:d810d8b3972a4bbc31cd3deb7ada4de965f1ad59bf753cec6748f943213cbcee", + "byteLength": 1725, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:205a2afdc68ebd46d5b022256fadec6bd071bc8e34faff481f288c20df008f60" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/procurement/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:539587356d8c0942f6e2c98ec09311e9c55fc4efcc6b9f8845e58db817a8dc58", + "byteLength": 2793, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:f0ef6fe0bb4703eaf6b2c1edf2f12712dffc139e887317c46fc82d83dba71275" + } + }, + "scope": { + "kind": "sections", + "sectionIds": [ + "eligibility", + "conflict-review", + "invoice-payment", + "purchase-scope" + ], + "reviewBasis": { + "bytesDigest": "sha256:14e401b11a917a3275bc18c2d85f547bfd71cf34a706e160ec54621603b36de2", + "byteLength": 402, + "mediaType": "text/plain" + } + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:14e401b11a917a3275bc18c2d85f547bfd71cf34a706e160ec54621603b36de2", + "byteLength": 402, + "mediaType": "text/plain" + } + }, + { + "sectionId": "conflict-review", + "status": "awaiting-interpretation", + "explanation": "Synthetic open work item: agree the conflict threshold before implementation." + }, + { + "sectionId": "invoice-payment", + "status": "out-of-scope", + "rationale": "This pack assesses eligibility only; treasury payment reconciliation is a separate process." + }, + { + "sectionId": "purchase-scope", + "status": "implemented", + "consumerElements": [ + { + "kind": "applicability" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:14e401b11a917a3275bc18c2d85f547bfd71cf34a706e160ec54621603b36de2", + "byteLength": 402, + "mediaType": "text/plain" + } + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/procurement/consumer-pack.json b/internal/policy/official/conformance/policy/1.0.0/examples/procurement/consumer-pack.json new file mode 100644 index 00000000..0745b386 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/procurement/consumer-pack.json @@ -0,0 +1,68 @@ +{ + "specVersion": "0.2.0-draft", + "id": "https://example.invalid/policy-companion-prototype/procurement/pack", + "version": "1.0.0", + "title": "Procurement — synthetic interpretation", + "description": "Synthetic RFC material only. No operational authorization or external action.", + "decision": { + "intent": "Apply the retained automated eligibility clause.", + "question": "Is this request eligible for the automated path?" + }, + "outcomes": [ + { + "id": "eligible", + "label": "Eligible for review" + }, + { + "id": "ineligible", + "label": "Ineligible" + }, + { + "id": "review", + "label": "Human review needed" + } + ], + "rules": [ + { + "id": "eligible", + "when": { + "op": "fact", + "path": "/procurement/competitiveProcedureDocumented", + "operator": "equals", + "value": true + }, + "outcome": "eligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + }, + { + "id": "ineligible", + "when": { + "op": "fact", + "path": "/procurement/competitiveProcedureDocumented", + "operator": "equals", + "value": false + }, + "outcome": "ineligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + } + ], + "fallbackOutcome": "review", + "escalation": { + "triggers": [ + "unknown", + "no-match" + ], + "target": { + "kind": "human-role", + "name": "Synthetic reviewer" + } + }, + "applicability": { + "op": "fact", + "path": "/request/kind", + "operator": "equals", + "value": "purchase" + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/procurement/fixture.json b/internal/policy/official/conformance/policy/1.0.0/examples/procurement/fixture.json new file mode 100644 index 00000000..2bb9dd50 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/procurement/fixture.json @@ -0,0 +1,58 @@ +{ + "fixtureVersion": "1", + "synthetic": true, + "scenario": "procurement", + "materials": [ + { + "path": "narrative.txt", + "content": { + "bytesDigest": "sha256:993a73c70afdc16c94368982d1e951c85c90838d1f750a7001c2942dc9834b94", + "byteLength": 621, + "mediaType": "text/plain" + } + }, + { + "path": "source.txt", + "content": { + "bytesDigest": "sha256:4681b36d52396d3faef09e4a7c551d829920362beb47a1bfb32c2d6c4d82763b", + "byteLength": 591, + "mediaType": "text/plain" + } + }, + { + "path": "interpretation.txt", + "content": { + "bytesDigest": "sha256:14e401b11a917a3275bc18c2d85f547bfd71cf34a706e160ec54621603b36de2", + "byteLength": 402, + "mediaType": "text/plain" + } + }, + { + "path": "consumer-pack.json", + "content": { + "bytesDigest": "sha256:d810d8b3972a4bbc31cd3deb7ada4de965f1ad59bf753cec6748f943213cbcee", + "byteLength": 1725, + "mediaType": "application/json" + } + }, + { + "path": "policy.json", + "content": { + "bytesDigest": "sha256:539587356d8c0942f6e2c98ec09311e9c55fc4efcc6b9f8845e58db817a8dc58", + "byteLength": 2793, + "mediaType": "application/json" + } + }, + { + "path": "adoption.json", + "content": { + "bytesDigest": "sha256:e9c871b2e7dc7448e46b2d4d347beb504bbe0a691be11df4283a95a693208703", + "byteLength": 3055, + "mediaType": "application/json" + } + } + ], + "policy": "policy.json", + "consumer": "consumer-pack.json", + "adoption": "adoption.json" +} diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/procurement/interpretation.txt b/internal/policy/official/conformance/policy/1.0.0/examples/procurement/interpretation.txt new file mode 100644 index 00000000..cc2bd1f5 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/procurement/interpretation.txt @@ -0,0 +1,5 @@ +SYNTHETIC REVIEW BASIS; no person approved this fixture. +The eligible and ineligible rules interpret the competitive-procedure clause. +The applicability condition alone implements purchase scope; it is not a rule ID. +Missing facts need review. Other coverage is stated explicitly. +The selected scope includes eligibility, conflict review, invoice payment and purchase scope; public notice is excluded. diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/procurement/narrative.txt b/internal/policy/official/conformance/policy/1.0.0/examples/procurement/narrative.txt new file mode 100644 index 00000000..646937a8 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/procurement/narrative.txt @@ -0,0 +1,16 @@ +SYNTHETIC RFC PROTOTYPE — Procurement + +Competitive procedure +Automated eligibility requires a documented competitive procedure. A missing record requires a procurement reviewer. + +Supplier conflicts +Supplier relationships require a conflict review. The threshold for a material relationship needs clarification. + +Invoice payment +Treasury performs payment reconciliation outside this eligibility interpretation. + +Public notice +Publish the award notice through the separate communications process. + +Purchase scope +This eligibility pack applies only to purchase requests; other requests remain outside this automated path. diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/procurement/policy.json b/internal/policy/official/conformance/policy/1.0.0/examples/procurement/policy.json new file mode 100644 index 00000000..00b19b27 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/procurement/policy.json @@ -0,0 +1,106 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/procurement/policy", + "version": "1.0.0", + "title": "Procurement — synthetic policy content", + "managementMode": "externally-managed", + "content": { + "bytesDigest": "sha256:993a73c70afdc16c94368982d1e951c85c90838d1f750a7001c2942dc9834b94", + "byteLength": 621, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Competitive procedure", + "anchor": { + "startByte": 41, + "endByte": 181, + "bytesDigest": "sha256:a8d58fa560d792bbc0848b517b47a04d01fa928a4315de4be423d9756745714f" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "conflict-review", + "title": "Supplier conflicts", + "anchor": { + "startByte": 181, + "endByte": 314, + "bytesDigest": "sha256:ed53cc9edccb33c00c4692bcc84593e249117f9dbc4045d57e5e8f85458c7c94" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "invoice-payment", + "title": "Invoice payment", + "anchor": { + "startByte": 314, + "endByte": 413, + "bytesDigest": "sha256:f6803f2ffa7356a3aad889d20987a00614d8145193c521107845092745db9d1d" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + }, + { + "id": "public-notice", + "title": "Public notice", + "anchor": { + "startByte": 413, + "endByte": 497, + "bytesDigest": "sha256:b6d68243578efb748244d55bcfe5f7bb730faa1c939c6a910f4e6e26b79b34f9" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 4" + } + ] + }, + { + "id": "purchase-scope", + "title": "Purchase scope", + "anchor": { + "startByte": 498, + "endByte": 621, + "bytesDigest": "sha256:13498f448247cfd988d4d59046ae766abb0559cf902093cdf8f650543f37ed26" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 5" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "procurement-original" + }, + "sourceRevision": "fictional-revision-a", + "content": { + "bytesDigest": "sha256:4681b36d52396d3faef09e4a7c551d829920362beb47a1bfb32c2d6c4d82763b", + "byteLength": 591, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/procurement/source.txt b/internal/policy/official/conformance/policy/1.0.0/examples/procurement/source.txt new file mode 100644 index 00000000..c5913acb --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/procurement/source.txt @@ -0,0 +1,7 @@ +SYNTHETIC ORIGINAL SOURCE; NOT AN APPROVED POLICY + +Clause 1: Automated eligibility requires a documented competitive procedure. A missing record requires a procurement reviewer. +Clause 2: Supplier relationships require a conflict review. The threshold for a material relationship needs clarification. +Clause 3: Treasury performs payment reconciliation outside this eligibility interpretation. +Clause 4: Publish the award notice through the separate communications process. +Clause 5: This eligibility pack applies only to purchase requests; other requests remain outside this automated path. diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/refunds/adoption.json b/internal/policy/official/conformance/policy/1.0.0/examples/refunds/adoption.json new file mode 100644 index 00000000..6af1ea97 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/refunds/adoption.json @@ -0,0 +1,87 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/refunds/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/refunds/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:2a049f10cd8c5d4fc81200976507a8563d0bc1fca19fa9691fc1601507512e38", + "byteLength": 1924, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:d20723faedbed6ee066dd3330e4b72848702e92dfbeb68b757f6ed0a95e4a2c5" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/refunds/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:8e3a487de4b15a1bc6c824e6dedd2e1b4fe16f4b3c4430a76b46e943ef2565ff", + "byteLength": 2375, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:e287b7208c0e870d1ee04188bc57f614096210f740d0f95fbf11d1324dc93704" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:63f58f37957f808e98c67db11ac9d835286733336e47ae24f28b974d431b9862", + "byteLength": 301, + "mediaType": "text/plain" + } + }, + { + "sectionId": "damaged-goods", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "fraud-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + }, + { + "sectionId": "damaged-routing", + "status": "implemented", + "consumerElements": [ + { + "kind": "exception", + "id": "damaged-routing" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:63f58f37957f808e98c67db11ac9d835286733336e47ae24f28b974d431b9862", + "byteLength": 301, + "mediaType": "text/plain" + } + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/refunds/consumer-pack.json b/internal/policy/official/conformance/policy/1.0.0/examples/refunds/consumer-pack.json new file mode 100644 index 00000000..07323779 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/refunds/consumer-pack.json @@ -0,0 +1,76 @@ +{ + "specVersion": "0.2.0-draft", + "id": "https://example.invalid/policy-companion-prototype/refunds/pack", + "version": "1.0.0", + "title": "Refunds — synthetic interpretation", + "description": "Synthetic RFC material only. No operational authorization or external action.", + "decision": { + "intent": "Apply the retained automated eligibility clause.", + "question": "Is this request eligible for the automated path?" + }, + "outcomes": [ + { + "id": "eligible", + "label": "Eligible for review" + }, + { + "id": "ineligible", + "label": "Ineligible" + }, + { + "id": "review", + "label": "Human review needed" + } + ], + "rules": [ + { + "id": "eligible", + "when": { + "op": "fact", + "path": "/purchase/withinReturnWindow", + "operator": "equals", + "value": true + }, + "outcome": "eligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + }, + { + "id": "ineligible", + "when": { + "op": "fact", + "path": "/purchase/withinReturnWindow", + "operator": "equals", + "value": false + }, + "outcome": "ineligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + } + ], + "fallbackOutcome": "review", + "escalation": { + "triggers": [ + "unknown", + "no-match" + ], + "target": { + "kind": "human-role", + "name": "Synthetic reviewer" + } + }, + "exceptions": [ + { + "id": "damaged-routing", + "description": "Route damaged goods to review; this does not perform the manual inspection.", + "when": { + "op": "fact", + "path": "/purchase/damaged", + "operator": "equals", + "value": true + }, + "effect": "escalate", + "onUnknown": "escalate" + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/refunds/fixture.json b/internal/policy/official/conformance/policy/1.0.0/examples/refunds/fixture.json new file mode 100644 index 00000000..e1a86a90 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/refunds/fixture.json @@ -0,0 +1,58 @@ +{ + "fixtureVersion": "1", + "synthetic": true, + "scenario": "refunds", + "materials": [ + { + "path": "narrative.txt", + "content": { + "bytesDigest": "sha256:909d57f27b7359c777dfb2ea07d859408a13504bf8dded27807889f7cde52969", + "byteLength": 486, + "mediaType": "text/plain" + } + }, + { + "path": "source.txt", + "content": { + "bytesDigest": "sha256:ae72534013fc75083b184765e7a558b71b5e4674720aa56e8960844fd712c6c0", + "byteLength": 474, + "mediaType": "text/plain" + } + }, + { + "path": "interpretation.txt", + "content": { + "bytesDigest": "sha256:63f58f37957f808e98c67db11ac9d835286733336e47ae24f28b974d431b9862", + "byteLength": 301, + "mediaType": "text/plain" + } + }, + { + "path": "consumer-pack.json", + "content": { + "bytesDigest": "sha256:2a049f10cd8c5d4fc81200976507a8563d0bc1fca19fa9691fc1601507512e38", + "byteLength": 1924, + "mediaType": "application/json" + } + }, + { + "path": "policy.json", + "content": { + "bytesDigest": "sha256:8e3a487de4b15a1bc6c824e6dedd2e1b4fe16f4b3c4430a76b46e943ef2565ff", + "byteLength": 2375, + "mediaType": "application/json" + } + }, + { + "path": "adoption.json", + "content": { + "bytesDigest": "sha256:7c7cd121fc4510fff19b8bcaf120ce1a9cb3f7e60b8e811ce9be917799367bc8", + "byteLength": 2729, + "mediaType": "application/json" + } + } + ], + "policy": "policy.json", + "consumer": "consumer-pack.json", + "adoption": "adoption.json" +} diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/refunds/interpretation.txt b/internal/policy/official/conformance/policy/1.0.0/examples/refunds/interpretation.txt new file mode 100644 index 00000000..61258de1 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/refunds/interpretation.txt @@ -0,0 +1,4 @@ +SYNTHETIC REVIEW BASIS; no person approved this fixture. +The eligible and ineligible rules interpret the return-window clause. +The damaged-routing exception alone routes damaged goods to a specialist; physical inspection remains manual. +Missing facts need review. Other coverage is stated explicitly. diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/refunds/narrative.txt b/internal/policy/official/conformance/policy/1.0.0/examples/refunds/narrative.txt new file mode 100644 index 00000000..1cf4b905 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/refunds/narrative.txt @@ -0,0 +1,13 @@ +SYNTHETIC RFC PROTOTYPE — Refunds + +Return window +The automated path accepts only purchases within the published return window. Missing purchase dates require a returns specialist. + +Damaged goods +A returns specialist handles damaged goods through the manual inspection process. + +Fraud review +Potential repeated-claim abuse needs a separate reviewed implementation. + +Damaged goods routing +Damaged goods bypass automated eligibility and go to a returns specialist for manual inspection. diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/refunds/policy.json b/internal/policy/official/conformance/policy/1.0.0/examples/refunds/policy.json new file mode 100644 index 00000000..b3531a29 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/refunds/policy.json @@ -0,0 +1,91 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/refunds/policy", + "version": "1.0.0", + "title": "Refunds — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:909d57f27b7359c777dfb2ea07d859408a13504bf8dded27807889f7cde52969", + "byteLength": 486, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Return window", + "anchor": { + "startByte": 37, + "endByte": 183, + "bytesDigest": "sha256:838ea4e242523a398e18a4006aa1488cc2032eb23f503f2c2dc2539339cc757a" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "damaged-goods", + "title": "Damaged goods", + "anchor": { + "startByte": 183, + "endByte": 280, + "bytesDigest": "sha256:ac0263d8b10debc2e8fb9090bb1b55c80a5766a4d192f23f0f640062ba5c82d4" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "fraud-review", + "title": "Fraud review", + "anchor": { + "startByte": 280, + "endByte": 366, + "bytesDigest": "sha256:9117339f1340e981a232894965d79f3f2a9f8116ffc347142c7dc7d9bc2631c3" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + }, + { + "id": "damaged-routing", + "title": "Damaged goods routing", + "anchor": { + "startByte": 367, + "endByte": 486, + "bytesDigest": "sha256:a47d45dfa15bb16514328ff9e1de346be10d045a194597e6c44e1f598ab17ab1" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 4" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "refunds-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:ae72534013fc75083b184765e7a558b71b5e4674720aa56e8960844fd712c6c0", + "byteLength": 474, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/examples/refunds/source.txt b/internal/policy/official/conformance/policy/1.0.0/examples/refunds/source.txt new file mode 100644 index 00000000..614029ef --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/examples/refunds/source.txt @@ -0,0 +1,6 @@ +SYNTHETIC ORIGINAL SOURCE; NOT AN APPROVED POLICY + +Clause 1: The automated path accepts only purchases within the published return window. Missing purchase dates require a returns specialist. +Clause 2: A returns specialist handles damaged goods through the manual inspection process. +Clause 3: Potential repeated-claim abuse needs a separate reviewed implementation. +Clause 4: Damaged goods bypass automated eligibility and go to a returns specialist for manual inspection. diff --git a/internal/policy/official/conformance/policy/1.0.0/fixture.schema.json b/internal/policy/official/conformance/policy/1.0.0/fixture.schema.json new file mode 100644 index 00000000..a9edb55d --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/fixture.schema.json @@ -0,0 +1,67 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://judgmentpack.org/schema/policy/1.0.0/fixture.schema.json", + "title": "Local synthetic draft fixture carrier; not a release envelope", + "type": "object", + "additionalProperties": false, + "required": [ + "fixtureVersion", + "synthetic", + "scenario", + "materials", + "policy", + "consumer", + "adoption" + ], + "properties": { + "fixtureVersion": { + "const": "1" + }, + "synthetic": { + "const": true + }, + "scenario": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "materials": { + "type": "array", + "minItems": 1, + "maxItems": 16, + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "path", + "content" + ], + "properties": { + "path": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "content": { + "$ref": "https://judgmentpack.org/schema/policy/1.0.0/common.schema.json#/$defs/retainedContent" + } + } + } + }, + "policy": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "consumer": { + "type": "string", + "minLength": 1, + "maxLength": 128 + }, + "adoption": { + "type": "string", + "minLength": 1, + "maxLength": 128 + } + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/prototype-0.0.2-pin.json b/internal/policy/official/conformance/policy/1.0.0/prototype-0.0.2-pin.json new file mode 100644 index 00000000..24a7b0e9 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/prototype-0.0.2-pin.json @@ -0,0 +1,33 @@ +{ + "commit": "8a56a95d555c17640d2db4984363b779536b3c2a", + "proposalVersion": "0.0.2", + "files": { + "README.md": "sha256:031cc9fa743c7d3af5cc482a514cfba106d510e16364febe0e58ce8bf9830e16", + "common.schema.json": "sha256:97d25d9c7778c68bdd94506227a0061923a5ef5fc9bc5f0a101f1ac2449d0d33", + "examples/data-access/adoption.json": "sha256:f6cf887488c12b0ba5331a048f5a9661a557021f5abfc5662a95524915ec1529", + "examples/data-access/consumer-pack.json": "sha256:c4912216ef58c754473bdda95be7322126ab2970bd75bea9306f342927d974e4", + "examples/data-access/fixture.json": "sha256:575edeed43ceb0b72a3a204caacbc51ba10e52075b7cbeea134b02876e550ec8", + "examples/data-access/interpretation.txt": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "examples/data-access/narrative.txt": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "examples/data-access/policy.json": "sha256:75a7659ed5086c7728af95db0b56b15fdc914a51982b16627fc884cfc9dca50d", + "examples/data-access/source.txt": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "examples/procurement/adoption.json": "sha256:b5b94a06dba7d12748fe3f854bdb5e5da9c14736aeff8d7416e94946891fd063", + "examples/procurement/consumer-pack.json": "sha256:d810d8b3972a4bbc31cd3deb7ada4de965f1ad59bf753cec6748f943213cbcee", + "examples/procurement/fixture.json": "sha256:241d3fd3f06c0cc0572d5237bcbbae9c88bd688fdfe7b41809bd90497ebfbf4b", + "examples/procurement/interpretation.txt": "sha256:14e401b11a917a3275bc18c2d85f547bfd71cf34a706e160ec54621603b36de2", + "examples/procurement/narrative.txt": "sha256:993a73c70afdc16c94368982d1e951c85c90838d1f750a7001c2942dc9834b94", + "examples/procurement/policy.json": "sha256:e9bbe247d5aa7537aef08c951b88c0881e381046e357abaa05ea255e208ee852", + "examples/procurement/source.txt": "sha256:4681b36d52396d3faef09e4a7c551d829920362beb47a1bfb32c2d6c4d82763b", + "examples/refunds/adoption.json": "sha256:fd474eed584ae6305ea535bf1d044734f8d754fcc907b0d28b65a318b5ea4b5d", + "examples/refunds/consumer-pack.json": "sha256:2a049f10cd8c5d4fc81200976507a8563d0bc1fca19fa9691fc1601507512e38", + "examples/refunds/fixture.json": "sha256:2029192a538db356e9beb137e35377d00db61dda52cb7ba622d3d5e4343b6f22", + "examples/refunds/interpretation.txt": "sha256:63f58f37957f808e98c67db11ac9d835286733336e47ae24f28b974d431b9862", + "examples/refunds/narrative.txt": "sha256:909d57f27b7359c777dfb2ea07d859408a13504bf8dded27807889f7cde52969", + "examples/refunds/policy.json": "sha256:5391763b2d9a72533e7566cce910a43cb5ab740dd0587d7383f3adf153ba9970", + "examples/refunds/source.txt": "sha256:ae72534013fc75083b184765e7a558b71b5e4674720aa56e8960844fd712c6c0", + "governing-adoption.schema.json": "sha256:4108f3ac476b989483affbf0ddfa2e933f7be5c579c472f7b7b3aa976299f779", + "policy.schema.json": "sha256:d653ce7e855dce678aeadebac18de2afbc5bdcb23412fcf52f3d30b5be3d4dbd", + "test_prototype.py": "sha256:bdb05fe954cb75ddc859e58e81ed29c22e7181fb224068dcc55dfb59106858ef", + "verify.py": "sha256:ad6774c7eed831e1a586b9a313c33cb35b471db5cb41ee2212f1643135e27ea0" + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/test_contract.py b/internal/policy/official/conformance/policy/1.0.0/test_contract.py new file mode 100644 index 00000000..1ca13650 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/test_contract.py @@ -0,0 +1,250 @@ +"""Focused draft agreement/carrier checks, outside the adopted corpus.""" + +import copy +import json +import subprocess +import sys +import unittest +from pathlib import Path +from tempfile import TemporaryDirectory + +from jsonschema import FormatChecker + +import check_vectors +import verify as v + + +class ContractTests(unittest.TestCase): + def test_archived_candidate_and_all_promoted_input_bytes_are_frozen(self): + pin = json.loads((v.HERE / "candidate-1.0.0-pin.json").read_bytes()) + old = v.ROOT / "rfcs/policy-companion-contract" + for name, digest in pin["files"].items(): + with self.subTest(candidate=name): + self.assertEqual(v.spec_canon.digest_of((old / name).read_bytes()), digest) + actual = {str(path.relative_to(old)) for path in old.rglob("*") + if path.is_file() and "__pycache__" not in str(path)} + self.assertEqual(actual, set(pin["files"])) + for directory in ("examples", "vectors/documents"): + for path in (v.HERE / directory).rglob("*"): + if path.is_file(): + self.assertEqual(path.read_bytes(), (old / path.relative_to(v.HERE)).read_bytes()) + previous = json.loads((old / "vectors/manifest.json").read_bytes()) + promoted = json.loads((v.HERE / "vectors/manifest.json").read_bytes()) + self.assertEqual(promoted, json.loads(json.dumps(previous).replace("proposed-draft", "draft"))) + + def test_official_schema_identity_changes_preserve_closed_input_grammar(self): + def grammar(value): + if isinstance(value, dict): + return {key: grammar(child) for key, child in value.items() + if key not in ("$id", "title", "description")} + if isinstance(value, list): + return [grammar(child) for child in value] + if isinstance(value, str): + for name in ("common", "policy", "governing-adoption"): + value = value.replace(f"https://judgmentpack.org/schema/policy/1.0.0/{name}.schema.json", + f"urn:jps:proposal:policy-companion:1.0.0:{name}") + return value + for name in ("common", "policy", "governing-adoption"): + old = json.loads((v.ROOT / "rfcs/policy-companion-contract" / f"{name}.schema.json").read_bytes()) + new = json.loads((v.SCHEMAS / f"{name}.schema.json").read_bytes()) + self.assertEqual(grammar(old), grammar(new)) + self.assertEqual(new["$id"], f"https://judgmentpack.org/schema/policy/1.0.0/{name}.schema.json") + + def test_consumer_schema_is_frozen_to_its_named_core_release(self): + retained = (v.SCHEMAS / "consumer-core-0.2.0-draft.schema.json").read_bytes() + schema = json.loads(retained) + self.assertEqual(schema["$id"], "https://judgmentpack.org/schema/0.2.0-draft/judgment-pack-core.schema.json") + self.assertEqual(schema["properties"]["specVersion"]["const"], "0.2.0-draft") + previous = v.VALIDATORS + try: + v.VALIDATORS = v.validators() + self.assertEqual(v.VALIDATORS["core"].schema, schema) + finally: + v.VALIDATORS = previous + + def test_static_manifest_exact_results(self): + answers = check_vectors.run_vectors() + self.assertEqual(len(answers), 124) + for name, actual, expected in answers: + with self.subTest(vector=name): + self.assertEqual(actual, expected) + self.assertLess(len(json.dumps(actual)), 128) + codes = {actual.get("code") for _, actual, _ in answers} + self.assertTrue(set(v.CODES) <= codes) + + def test_three_domain_bundles_and_declared_coverage(self): + states, kinds = set(), set() + for directory in sorted((v.HERE / "examples").iterdir()): + with self.subTest(domain=directory.name): + self.assertEqual(v.verify_bundle(directory), v.VALID) + manifest, material, by_path = v.load_bundle(directory) + adoption = v.read_companion(by_path[manifest["adoption"]]) + for governing in adoption["governingPolicies"]: + for coverage in governing["coverage"]: + states.add(coverage["status"]) + kinds.update(item["kind"] for item in coverage.get("consumerElements", [])) + self.assertEqual(states, {"implemented", "manual", "awaiting-interpretation", "awaiting-implementation", "out-of-scope"}) + self.assertEqual(kinds, {"rule", "exception", "applicability", "fallback"}) + + def test_historical_prototype_is_byte_frozen(self): + pin = json.loads((v.HERE / "prototype-0.0.2-pin.json").read_bytes()) + old = v.ROOT / "rfcs/policy-companion-prototype" + self.assertEqual(pin["commit"], "8a56a95d555c17640d2db4984363b779536b3c2a") + self.assertEqual(pin["proposalVersion"], "0.0.2") + for name, digest in pin["files"].items(): + with self.subTest(path=name): + self.assertEqual(v.spec_canon.digest_of((old / name).read_bytes()), digest) + actual = {str(path.relative_to(old)) for path in old.rglob("*") if path.is_file() and "__pycache__" not in str(path)} + self.assertEqual(actual, set(pin["files"])) + + def test_source_consumer_narrative_and_review_bytes_preserved(self): + old = v.ROOT / "rfcs/policy-companion-prototype/examples" + for directory in sorted((v.HERE / "examples").iterdir()): + for name in ("source.txt", "consumer-pack.json", "narrative.txt", "interpretation.txt"): + with self.subTest(domain=directory.name, role=name): + self.assertEqual((directory / name).read_bytes(), (old / directory.name / name).read_bytes()) + + def test_discovery_matches_retained_record_and_cli(self): + retained = json.loads((v.HERE / "capabilities.json").read_bytes()) + self.assertEqual(retained, v.CAPABILITY) + self.assertEqual(retained["formatVersions"], ["1.0.0"]) + self.assertEqual(retained["maturity"], "draft") + self.assertIn("live-authority", retained["excludes"]) + self.assertIn("independent-interoperability-evidence", retained["excludes"]) + completed = subprocess.run([sys.executable, str(v.HERE / "verify.py"), "--capabilities"], capture_output=True, check=False) + self.assertEqual(completed.returncode, 0) + self.assertEqual(completed.stderr, b"") + self.assertEqual(json.loads(completed.stdout), retained) + + def test_cli_refusal_does_not_echo_retained_input_or_paths(self): + manifest = json.loads((v.HERE / "examples/data-access/fixture.json").read_bytes()) + secret = b"fictional-private-title-must-not-be-echoed" + with TemporaryDirectory() as temporary: + directory = Path(temporary) + for entry in manifest["materials"]: + raw = (v.HERE / "examples/data-access" / entry["path"]).read_bytes() + if entry["path"] == "narrative.txt": + raw += secret # Intentionally stale declared exact hash/length. + (directory / entry["path"]).write_bytes(raw) + (directory / "fixture.json").write_text(json.dumps(manifest)) + completed = subprocess.run([sys.executable, str(v.HERE / "verify.py"), str(directory)], capture_output=True, check=False) + self.assertEqual(completed.returncode, 1) + self.assertEqual(completed.stdout, b'{"status":"refused","code":"reference-mismatch"}\n') + self.assertEqual(completed.stderr, b"") + self.assertNotIn(secret, completed.stdout) + self.assertNotIn(temporary.encode(), completed.stdout) + + def test_local_fixture_carrier_refuses_paths_unknown_fields_and_missing_files(self): + original = json.loads((v.HERE / "examples/data-access/fixture.json").read_bytes()) + with TemporaryDirectory() as temporary: + directory = Path(temporary) + for mutation, code in ((lambda d: d["materials"][0].update(path="../outside.txt"), "invalid-carrier"), + (lambda d: d.update(approved=True), "invalid-carrier"), + (lambda d: None, "missing-material")): + manifest = copy.deepcopy(original) + mutation(manifest) + (directory / "fixture.json").write_text(json.dumps(manifest)) + self.assertEqual(v.verify_bundle(directory), {"status": "refused", "code": code}) + symlink = directory / "narrative.txt" + symlink.symlink_to(v.HERE / "examples/data-access/narrative.txt") + (directory / "fixture.json").write_text(json.dumps(original)) + self.assertEqual(v.verify_bundle(directory), {"status": "refused", "code": "invalid-carrier"}) + + def test_cli_refuses_nul_material_path_with_bounded_json(self): + manifest = json.loads((v.HERE / "examples/data-access/fixture.json").read_bytes()) + manifest["materials"][0]["path"] = "fictional-private\x00path.txt" + with TemporaryDirectory() as temporary: + directory = Path(temporary) + (directory / "fixture.json").write_text(json.dumps(manifest)) + completed = subprocess.run([sys.executable, str(v.HERE / "verify.py"), str(directory)], capture_output=True, check=False) + self.assertEqual(completed.returncode, 1) + self.assertEqual(completed.stdout, b'{"status":"refused","code":"invalid-carrier"}\n') + self.assertEqual(completed.stderr, b"") + + def test_vector_carrier_nul_paths_have_safe_results_and_no_cli_traceback(self): + expected = {"status": "refused", "code": "invalid-carrier"} + source = {"path": "vectors/private\x00transport.bin"} + case = {"id": "nul-transport", "document": {"path": "examples/data-access/policy.json"}, + "materials": [{"source": source, "content": v.identity(b"x", "text/plain")}], "expected": expected} + self.assertEqual(check_vectors.case_result(case), expected) + root_nul = {**case, "document": source, "materials": []} + self.assertEqual(check_vectors.case_result(root_nul), expected) + manifest = {"vectorSuiteVersion": "1", "maturity": "draft", "synthetic": True, "cases": [case]} + with TemporaryDirectory() as temporary: + path = Path(temporary) / "manifest.json" + path.write_text(json.dumps(manifest)) + completed = subprocess.run([sys.executable, str(v.HERE / "check_vectors.py"), str(path)], capture_output=True, check=False) + self.assertEqual(completed.returncode, 0) + self.assertEqual(completed.stdout, b'{"status":"matched","cases":1,"maturity":"draft"}\n') + self.assertEqual(completed.stderr, b"") + + def test_failed_registration_is_atomic(self): + material = {} + first = v.identity(b"x", "text/plain") + v.register_material(first, b"x", material) + before = copy.deepcopy(material) + with self.assertRaises(v.ContractError) as caught: + v.register_material(first, b"changed", material) + self.assertEqual(caught.exception.code, "reference-mismatch") + self.assertEqual(material, before) + wrong_type = v.identity(b"x", "text/markdown") + self.assertEqual(v.result(lambda: v.resolve(wrong_type, material)), {"status": "refused", "code": "reference-mismatch"}) + + def test_schema_version_pattern_is_exact_without_trailing_newline_alias(self): + raw = (v.HERE / "examples/data-access/policy.json").read_bytes() + manifest, material, _ = v.load_bundle(v.HERE / "examples/data-access") + document = v.read_companion(raw) + for version in ("0.0.0", "42.7.999", "9" * 252 + ".0.0"): + document["version"] = version + v.check_schema("policy", document) + for version in ("1x0x0", "1.0.0\n", "01.0.0", "1.0.0+build"): + document["version"] = version + self.assertEqual(v.result(lambda: v.check_schema("policy", document)), {"status": "refused", "code": "invalid-document"}) + + def test_uri_matrix_covers_policy_and_consuming_core_without_global_override(self): + manifest, material, by_path = v.load_bundle(v.HERE / "examples/data-access") + base = v.read_companion(by_path[manifest["policy"]]) + cases = json.loads((v.HERE / "vectors/manifest.json").read_bytes())["cases"] + count = 0 + for case in cases: + if not case["id"].startswith("uri-"): + continue + count += 1 + document = v.read_companion(check_vectors.source_bytes(case["document"], v.HERE)) + policy = copy.deepcopy(base) + policy["id"] = document["consumer"]["id"] if document["kind"] == "governing-adoption" else document["id"] + with self.subTest(vector=case["id"], root="policy"): + self.assertEqual(v.result(lambda: v.check_policy(policy, material)), case["expected"]) + if document["kind"] == "governing-adoption": + reference = document["consumer"]["content"] + entry = next(item for item in case["materials"] if item["content"] == reference) + pack = v.strict_json(check_vectors.source_bytes(entry["source"], v.HERE)) + expected = v.VALID if case["expected"]["status"] == "valid" else {"status": "refused", "code": "invalid-consumer"} + with self.subTest(vector=case["id"], root="consuming-pack"): + self.assertEqual(v.result(lambda: v.check_schema("core", pack)), expected) + self.assertEqual(count, 21) # Twenty added cases plus the original relative-ID refusal. + self.assertIsNot(FormatChecker().checkers["uri"][0], v.candidate_uri) + + def test_uri_adoption_vectors_preserve_every_pack_byte_except_id_token(self): + original = (v.HERE / "examples/data-access/consumer-pack.json").read_bytes() + original_id = json.dumps(json.loads(original)["id"]).encode() + cases = json.loads((v.HERE / "vectors/manifest.json").read_bytes())["cases"] + count = 0 + for case in cases: + if not case["id"].startswith("uri-"): + continue + document = v.read_companion(check_vectors.source_bytes(case["document"], v.HERE)) + if document["kind"] != "governing-adoption": + continue + count += 1 + entry = next(item for item in case["materials"] if item["content"] == document["consumer"]["content"]) + retained = check_vectors.source_bytes(entry["source"], v.HERE) + new_id = json.dumps(document["consumer"]["id"]).encode() + with self.subTest(vector=case["id"]): + self.assertEqual(retained.count(new_id), 1) + self.assertEqual(retained.replace(new_id, original_id, 1), original) + self.assertEqual(count, 7) + + +if __name__ == "__main__": + unittest.main() diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors.schema.json b/internal/policy/official/conformance/policy/1.0.0/vectors.schema.json new file mode 100644 index 00000000..eebdd1ad --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors.schema.json @@ -0,0 +1,203 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://judgmentpack.org/schema/policy/1.0.0/vectors.schema.json", + "title": "Draft agreement-vector carrier; not a release envelope", + "type": "object", + "additionalProperties": false, + "required": [ + "vectorSuiteVersion", + "maturity", + "synthetic", + "cases" + ], + "properties": { + "vectorSuiteVersion": { + "const": "1" + }, + "maturity": { + "const": "draft" + }, + "synthetic": { + "const": true + }, + "cases": { + "type": "array", + "minItems": 1, + "maxItems": 128, + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "id", + "document", + "materials", + "expected" + ], + "properties": { + "id": { + "type": "string", + "minLength": 1, + "maxLength": 128, + "pattern": "^[a-z][a-z0-9-]*$" + }, + "document": { + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "required": [ + "path" + ], + "properties": { + "path": { + "type": "string", + "minLength": 1, + "maxLength": 256 + } + } + }, + { + "type": "object", + "additionalProperties": false, + "required": [ + "repeatByte", + "byteLength" + ], + "properties": { + "repeatByte": { + "type": "integer", + "minimum": 0, + "maximum": 255 + }, + "byteLength": { + "type": "integer", + "minimum": 0, + "maximum": 4194305 + } + } + } + ] + }, + "materials": { + "type": "array", + "maxItems": 17, + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "source", + "content" + ], + "properties": { + "source": { + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "required": [ + "path" + ], + "properties": { + "path": { + "type": "string", + "minLength": 1, + "maxLength": 256 + } + } + }, + { + "type": "object", + "additionalProperties": false, + "required": [ + "repeatByte", + "byteLength" + ], + "properties": { + "repeatByte": { + "type": "integer", + "minimum": 0, + "maximum": 255 + }, + "byteLength": { + "type": "integer", + "minimum": 0, + "maximum": 4194305 + } + } + } + ] + }, + "content": { + "type": "object", + "additionalProperties": false, + "required": [ + "bytesDigest", + "byteLength", + "mediaType" + ], + "properties": { + "bytesDigest": { + "type": "string", + "pattern": "^sha256:[0-9a-f]{64}(?![\\s\\S])" + }, + "byteLength": { + "type": "integer", + "minimum": 0, + "maximum": 4194305 + }, + "mediaType": { + "type": "string", + "maxLength": 128, + "pattern": "^[a-z0-9!#$&^_.+-]+/[a-z0-9!#$&^_.+-]+(?![\\s\\S])" + } + }, + "description": "Generic fixture-carrier reference; consuming roles impose their own bounds." + } + } + } + }, + "expected": { + "oneOf": [ + { + "const": { + "status": "valid", + "formatVersion": "1.0.0", + "maturity": "draft" + } + }, + { + "type": "object", + "additionalProperties": false, + "required": [ + "status", + "code" + ], + "properties": { + "status": { + "const": "refused" + }, + "code": { + "enum": [ + "input-over-bound", + "invalid-json", + "invalid-selector", + "unsupported-format", + "invalid-document", + "missing-material", + "reference-mismatch", + "invalid-anchor", + "invalid-coverage", + "invalid-consumer", + "unsupported-canonical-identity", + "invalid-carrier" + ] + } + } + } + ] + } + } + } + } + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/README.md b/internal/policy/official/conformance/policy/1.0.0/vectors/README.md new file mode 100644 index 00000000..1a6056cb --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/README.md @@ -0,0 +1,103 @@ +# Policy offline-reader agreement vectors + +[manifest.json](manifest.json) supplies exact draft inputs and exact expected +results for independent readers to execute. These synthetic fixtures alone do +not establish a released JPS corpus. Publication requires the exact +`policy-v1.0.0-draft.1` tag and a maintainer-published GitHub release. The fixtures +supply no independently authored implementation evidence. No case asserts +approval, live authority, complete organizational coverage or permission. + +The manifest is closed under [vectors.schema.json](../vectors.schema.json). It has +`vectorSuiteVersion: "1"`, `maturity: "draft"`, `synthetic: true` and +`cases`. This carrier version is local test scaffolding, distinct from the +companion `formatVersion` and artifact `version`; it is not a release envelope. +All paths are relative to **conformance/policy/1.0.0/**, the versioned corpus root, +regardless of the manifest's location. A path must resolve inside that root, +including after resolving symlinks; absolute paths and escaping paths refuse. +NUL-containing paths and path-normalization failures are `invalid-carrier`. +Do not fetch any URI in a document or reference. + +Each case is exactly `{id, document, materials, expected}`: + +- `id` is a unique readable test identifier. +- `document` describes exact root companion bytes using the source grammar below. +- `materials` is an **ordered** array of `{source, content}` registrations. `source` + yields exact retained bytes; `content` independently declares the raw digest, + byte length and media type. Do not repair a mismatching declaration, normalize + bytes, derive a new declaration, or infer an unregistered media type. +- `expected` is the complete result object to compare with the draft reader result. + JSON object member order is irrelevant; names, values and absence of any extra + members must agree. Compare both valid and refusal objects, not only exit codes. + +The complete closed source grammar has only two alternatives: + +```json +{"path":"examples/data-access/policy.json"} +{"repeatByte":120,"byteLength":1048576} +``` + +For `path`, read the file's bytes exactly; no text conversion or newline changes. +For `repeatByte`, allocate **exactly** `byteLength` copies of the unsigned byte +`repeatByte` (integer 0–255), with no prefix, suffix or encoding. `byteLength` is an +integer 0–4,194,305. A value of zero generates empty bytes. There are no mutations, +JSON reserialization instructions, interpolation, automatic reference rebinding or +other generators. One byte above a normal maximum is intentionally representable +to test refusal. Static document files already carry every altered field and exact +reference; readers do not need the Python scripts used during authoring. + +To run a case, first measure/parse/select/canonical-domain-check its root bytes as +[contract §5](../../../../spec/policy.md#5-resource-limits-and-refusal-classifications) specifies. +Then check the input's registration count (maximum 16), register materials in list +order (acquiring one source immediately before its registration and checking +declarations and distinct-byte budget), and validate the root +schema and its semantic references. Root bytes themselves are subject to the +262,144-byte limit and count toward the distinct-material budget only when +explicitly registered. A referenced Policy or Pack must be retained in materials; +the carrier does not implicitly register the root or fetch a missing digest. +Return the **first** failing phase's bounded result. Carrier preparation errors +such as an invalid path are `invalid-carrier`; an unavailable file is +`missing-material`. These are never successful document readings. + +The compound transport/ordering vectors intentionally name a missing file +(`vectors/intentionally-missing-transport.bin`) or a NUL-containing path. These +are test harness transport inputs, not absent files that a port should create, +repair or fetch. Some earlier root/registration refusals must prevent acquisition +of those later sources. The `vector-carrier-nul-path` case actually reaches its +malformed path and returns `invalid-carrier`. The result for each case includes +these transport refusals; the harness compares them with `expected` and continues +to the next case. Carrier-manifest schema/setup failures remain harness failures. + +The manifest includes one over-bound registration count and one over-bound +original reference; its own carrier schema permits those counterexamples. No +candidate reader must accept them. Aggregate boundary vectors include separately +registered identical bytes under two media types; both resolve, and the bytes +spend the aggregate budget only once. Every role independently applies its size +limit. Raw Core numeric extensions include fractional, exponent and unsafe integer +literals; expected results distinguish optional canonical identity from raw pins. + +The 20 additional URI vectors assert the candidate's scheme-bearing RFC 3986 `URI` +grammar in Policy IDs and consuming-Pack references. They cover complete-string assertion, percent-encoding, +IPv6/IPvFuture, registered names, Unicode and component-specific brackets. Their +expected results describe URI syntax, not URL fetching or a dependency's quirks; +valid query/fragment content remains supported. Original retained materials are +unchanged. The earlier 104 vectors retain their exact inputs and expectations. +Seven cases are complete adoptions whose consuming Pack ID and exact consumer +reference agree. Their retained Pack files change only the ID string token; +every other original Pack byte, including number literals and whitespace, remains +unchanged. Raw digest/length and optional canonical identity are refreshed for +those synthetic candidate bytes. Valid percent-encoded hosts and IPvFuture `v`/`V` +must pass the candidate's consuming-Pack structural checker as well as its +reference grammar; invalid brackets, final LF and leading-zero IPv4 tails refuse. + +Run the reference harness with the repository's pinned dependencies: + +```sh +python conformance/policy/1.0.0/check_vectors.py +``` + +Successful harness output is exactly +`{"status":"matched","cases":124,"maturity":"draft"}`; this is harness +agreement, not the result for an individual document or a conformance claim. Each +refusal vector's exact output is retained in the manifest. The harness and schema +are optional conveniences: another language can read these same bytes and the +source grammar directly, without importing Python or mutable prototype helpers. diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/aggregate-max.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/aggregate-max.json new file mode 100644 index 00000000..9a63cd46 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/aggregate-max.json @@ -0,0 +1,25 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881", + "byteLength": 1, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "all", + "title": "All", + "anchor": { + "startByte": 0, + "endByte": 1, + "bytesDigest": "sha256:2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881" + } + } + ], + "sourceProvenance": [] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/aggregate-over.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/aggregate-over.json new file mode 100644 index 00000000..9a63cd46 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/aggregate-over.json @@ -0,0 +1,25 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881", + "byteLength": 1, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "all", + "title": "All", + "anchor": { + "startByte": 0, + "endByte": 1, + "bytesDigest": "sha256:2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881" + } + } + ], + "sourceProvenance": [] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/aggregate-shared-media-counted-once.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/aggregate-shared-media-counted-once.json new file mode 100644 index 00000000..9a63cd46 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/aggregate-shared-media-counted-once.json @@ -0,0 +1,25 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881", + "byteLength": 1, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "all", + "title": "All", + "anchor": { + "startByte": 0, + "endByte": 1, + "bytesDigest": "sha256:2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881" + } + } + ], + "sourceProvenance": [] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-empty-range.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-empty-range.json new file mode 100644 index 00000000..562186a1 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-empty-range.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 41, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-outside-narrative.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-outside-narrative.json new file mode 100644 index 00000000..801e4b1a --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-outside-narrative.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 999999, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-over-bound.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-over-bound.json new file mode 100644 index 00000000..632c1534 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-over-bound.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 1048577, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-stale-digest.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-stale-digest.json new file mode 100644 index 00000000..6213ac8f --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-stale-digest.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:0000000000000000000000000000000000000000000000000000000000000000" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-utf8-split.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-utf8-split.json new file mode 100644 index 00000000..29ccbc02 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/anchor-utf8-split.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 25, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/approval-field.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/approval-field.json new file mode 100644 index 00000000..c282482b --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/approval-field.json @@ -0,0 +1,77 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ], + "approved": true +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-build.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-build.json new file mode 100644 index 00000000..3bdf3da3 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-build.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0+build", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-independent.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-independent.json new file mode 100644 index 00000000..3ac9ae59 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-independent.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "7.3.42", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-leading-zero.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-leading-zero.json new file mode 100644 index 00000000..a86fd80b --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-leading-zero.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.00.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-max-256.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-max-256.json new file mode 100644 index 00000000..202c6a3b --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-max-256.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-newline.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-newline.json new file mode 100644 index 00000000..33a0dca7 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-newline.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0\n", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-number.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-number.json new file mode 100644 index 00000000..3cfddc4e --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-number.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": 1, + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-over-256.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-over-256.json new file mode 100644 index 00000000..bf40bfcc --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-over-256.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-two-components.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-two-components.json new file mode 100644 index 00000000..4a25db33 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/artifact-two-components.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/bom.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/bom.json new file mode 100644 index 00000000..22fdca1b --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/bom.json @@ -0,0 +1 @@ +{} \ No newline at end of file diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/companion-float.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/companion-float.json new file mode 100644 index 00000000..e967560d --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/companion-float.json @@ -0,0 +1 @@ +{"formatVersion":"1.0.0","n":1.0} \ No newline at end of file diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/companion-unsafe-integer.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/companion-unsafe-integer.json new file mode 100644 index 00000000..ea15b97d --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/companion-unsafe-integer.json @@ -0,0 +1 @@ +{"formatVersion":"1.0.0","n":9007199254740992} \ No newline at end of file diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-fallback-unknown-pack.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-fallback-unknown-pack.json new file mode 100644 index 00000000..a10ed874 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-fallback-unknown-pack.json @@ -0,0 +1,62 @@ +{ + "specVersion": "0.2.0-draft", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "title": "Data access — synthetic interpretation", + "description": "Synthetic RFC material only. No operational authorization or external action.", + "decision": { + "intent": "Apply the retained automated eligibility clause.", + "question": "Is this request eligible for the automated path?" + }, + "outcomes": [ + { + "id": "eligible", + "label": "Eligible for review" + }, + { + "id": "ineligible", + "label": "Ineligible" + }, + { + "id": "review", + "label": "Human review needed" + } + ], + "rules": [ + { + "id": "eligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": true + }, + "outcome": "eligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + }, + { + "id": "ineligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": false + }, + "outcome": "ineligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + } + ], + "fallbackOutcome": "unknown", + "escalation": { + "triggers": [ + "unknown", + "no-match" + ], + "target": { + "kind": "human-role", + "name": "Synthetic reviewer" + } + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-fallback-unknown.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-fallback-unknown.json new file mode 100644 index 00000000..2db44594 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-fallback-unknown.json @@ -0,0 +1,71 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:8c7a49e4b3b81d1880e64bdee1734c4805a1c4daffc599683ce098d47e0c2011", + "byteLength": 1559, + "mediaType": "application/json" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-graph.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-graph.json new file mode 100644 index 00000000..95714df7 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-graph.json @@ -0,0 +1,75 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "graph", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:c4912216ef58c754473bdda95be7322126ab2970bd75bea9306f342927d974e4", + "byteLength": 1558, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:d20e694ca1f99d0b3c8e239fdec3e5d1122dc875986ef5ed3651a52b3fba2473" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-rule-id-duplicate-pack.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-rule-id-duplicate-pack.json new file mode 100644 index 00000000..ef28391b --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-rule-id-duplicate-pack.json @@ -0,0 +1,74 @@ +{ + "specVersion": "0.2.0-draft", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "title": "Data access — synthetic interpretation", + "description": "Synthetic RFC material only. No operational authorization or external action.", + "decision": { + "intent": "Apply the retained automated eligibility clause.", + "question": "Is this request eligible for the automated path?" + }, + "outcomes": [ + { + "id": "eligible", + "label": "Eligible for review" + }, + { + "id": "ineligible", + "label": "Ineligible" + }, + { + "id": "review", + "label": "Human review needed" + } + ], + "rules": [ + { + "id": "eligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": true + }, + "outcome": "eligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + }, + { + "id": "ineligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": false + }, + "outcome": "ineligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + }, + { + "id": "eligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": true + }, + "outcome": "eligible", + "onUnknown": "escalate", + "description": "different" + } + ], + "fallbackOutcome": "review", + "escalation": { + "triggers": [ + "unknown", + "no-match" + ], + "target": { + "kind": "human-role", + "name": "Synthetic reviewer" + } + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-rule-id-duplicate.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-rule-id-duplicate.json new file mode 100644 index 00000000..85a16d8a --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/consumer-rule-id-duplicate.json @@ -0,0 +1,71 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:93560dbc1b0537cf834d02b2607dade6b9a6407c5a37caf36954822762f0c312", + "byteLength": 1828, + "mediaType": "application/json" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-raw-pack.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-raw-pack.json new file mode 100644 index 00000000..cc3aa167 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-raw-pack.json @@ -0,0 +1,67 @@ +{ + "specVersion": "0.2.0-draft", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "title": "Data access — synthetic interpretation", + "description": "Synthetic RFC material only. No operational authorization or external action.", + "decision": { + "intent": "Apply the retained automated eligibility clause.", + "question": "Is this request eligible for the automated path?" + }, + "outcomes": [ + { + "id": "eligible", + "label": "Eligible for review" + }, + { + "id": "ineligible", + "label": "Ineligible" + }, + { + "id": "review", + "label": "Human review needed" + } + ], + "rules": [ + { + "id": "eligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": true + }, + "outcome": "eligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + }, + { + "id": "ineligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": false + }, + "outcome": "ineligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + } + ], + "fallbackOutcome": "review", + "escalation": { + "triggers": [ + "unknown", + "no-match" + ], + "target": { + "kind": "human-role", + "name": "Synthetic reviewer" + } + }, + "extensions": { + "com.example.candidate": { + "candidate-number": 1.5 + } + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-raw.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-raw.json new file mode 100644 index 00000000..d825392a --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-raw.json @@ -0,0 +1,71 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:9a2b3c06074ead90e9b34d3213ad9b5665ad05c548dfa9cc3be57e8e9f23634b", + "byteLength": 1648, + "mediaType": "application/json" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-requested-canon-pack.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-requested-canon-pack.json new file mode 100644 index 00000000..cc3aa167 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-requested-canon-pack.json @@ -0,0 +1,67 @@ +{ + "specVersion": "0.2.0-draft", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "title": "Data access — synthetic interpretation", + "description": "Synthetic RFC material only. No operational authorization or external action.", + "decision": { + "intent": "Apply the retained automated eligibility clause.", + "question": "Is this request eligible for the automated path?" + }, + "outcomes": [ + { + "id": "eligible", + "label": "Eligible for review" + }, + { + "id": "ineligible", + "label": "Ineligible" + }, + { + "id": "review", + "label": "Human review needed" + } + ], + "rules": [ + { + "id": "eligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": true + }, + "outcome": "eligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + }, + { + "id": "ineligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": false + }, + "outcome": "ineligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + } + ], + "fallbackOutcome": "review", + "escalation": { + "triggers": [ + "unknown", + "no-match" + ], + "target": { + "kind": "human-role", + "name": "Synthetic reviewer" + } + }, + "extensions": { + "com.example.candidate": { + "candidate-number": 1.5 + } + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-requested-canon.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-requested-canon.json new file mode 100644 index 00000000..ba4e1229 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-decimal-requested-canon.json @@ -0,0 +1,75 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:9a2b3c06074ead90e9b34d3213ad9b5665ad05c548dfa9cc3be57e8e9f23634b", + "byteLength": 1648, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:0000000000000000000000000000000000000000000000000000000000000000" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-308-pack.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-308-pack.json new file mode 100644 index 00000000..34312ff1 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-308-pack.json @@ -0,0 +1,67 @@ +{ + "specVersion": "0.2.0-draft", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "title": "Data access — synthetic interpretation", + "description": "Synthetic RFC material only. No operational authorization or external action.", + "decision": { + "intent": "Apply the retained automated eligibility clause.", + "question": "Is this request eligible for the automated path?" + }, + "outcomes": [ + { + "id": "eligible", + "label": "Eligible for review" + }, + { + "id": "ineligible", + "label": "Ineligible" + }, + { + "id": "review", + "label": "Human review needed" + } + ], + "rules": [ + { + "id": "eligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": true + }, + "outcome": "eligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + }, + { + "id": "ineligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": false + }, + "outcome": "ineligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + } + ], + "fallbackOutcome": "review", + "escalation": { + "triggers": [ + "unknown", + "no-match" + ], + "target": { + "kind": "human-role", + "name": "Synthetic reviewer" + } + }, + "extensions": { + "com.example.candidate": { + "candidate-number": 1e308 + } + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-308.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-308.json new file mode 100644 index 00000000..cf42a308 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-308.json @@ -0,0 +1,71 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:52bd1104aedcc81011f2b0aaac2f5a3e082dc96b7a9c490cf441a005d3e3667e", + "byteLength": 1650, + "mediaType": "application/json" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-over-pack.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-over-pack.json new file mode 100644 index 00000000..12548437 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-over-pack.json @@ -0,0 +1,67 @@ +{ + "specVersion": "0.2.0-draft", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "title": "Data access — synthetic interpretation", + "description": "Synthetic RFC material only. No operational authorization or external action.", + "decision": { + "intent": "Apply the retained automated eligibility clause.", + "question": "Is this request eligible for the automated path?" + }, + "outcomes": [ + { + "id": "eligible", + "label": "Eligible for review" + }, + { + "id": "ineligible", + "label": "Ineligible" + }, + { + "id": "review", + "label": "Human review needed" + } + ], + "rules": [ + { + "id": "eligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": true + }, + "outcome": "eligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + }, + { + "id": "ineligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": false + }, + "outcome": "ineligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + } + ], + "fallbackOutcome": "review", + "escalation": { + "triggers": [ + "unknown", + "no-match" + ], + "target": { + "kind": "human-role", + "name": "Synthetic reviewer" + } + }, + "extensions": { + "com.example.candidate": { + "candidate-number": 1e309 + } + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-over.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-over.json new file mode 100644 index 00000000..9f9e334a --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-exponent-over.json @@ -0,0 +1,71 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:7d593e7fac09abf836b599e7719f33850381bd60d5aa8c078a7cf2d43c494843", + "byteLength": 1650, + "mediaType": "application/json" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-128-pack.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-128-pack.json new file mode 100644 index 00000000..c4d31e6d --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-128-pack.json @@ -0,0 +1,67 @@ +{ + "specVersion": "0.2.0-draft", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "title": "Data access — synthetic interpretation", + "description": "Synthetic RFC material only. No operational authorization or external action.", + "decision": { + "intent": "Apply the retained automated eligibility clause.", + "question": "Is this request eligible for the automated path?" + }, + "outcomes": [ + { + "id": "eligible", + "label": "Eligible for review" + }, + { + "id": "ineligible", + "label": "Ineligible" + }, + { + "id": "review", + "label": "Human review needed" + } + ], + "rules": [ + { + "id": "eligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": true + }, + "outcome": "eligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + }, + { + "id": "ineligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": false + }, + "outcome": "ineligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + } + ], + "fallbackOutcome": "review", + "escalation": { + "triggers": [ + "unknown", + "no-match" + ], + "target": { + "kind": "human-role", + "name": "Synthetic reviewer" + } + }, + "extensions": { + "com.example.candidate": { + "candidate-number": 99999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 + } + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-128.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-128.json new file mode 100644 index 00000000..8045ac88 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-128.json @@ -0,0 +1,71 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:0a694f57fa21a82551738a128022578c837b332848866db302da838c70b8e3c7", + "byteLength": 1773, + "mediaType": "application/json" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-over-128-pack.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-over-128-pack.json new file mode 100644 index 00000000..3fc39e1b --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-over-128-pack.json @@ -0,0 +1,67 @@ +{ + "specVersion": "0.2.0-draft", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "title": "Data access — synthetic interpretation", + "description": "Synthetic RFC material only. No operational authorization or external action.", + "decision": { + "intent": "Apply the retained automated eligibility clause.", + "question": "Is this request eligible for the automated path?" + }, + "outcomes": [ + { + "id": "eligible", + "label": "Eligible for review" + }, + { + "id": "ineligible", + "label": "Ineligible" + }, + { + "id": "review", + "label": "Human review needed" + } + ], + "rules": [ + { + "id": "eligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": true + }, + "outcome": "eligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + }, + { + "id": "ineligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": false + }, + "outcome": "ineligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + } + ], + "fallbackOutcome": "review", + "escalation": { + "triggers": [ + "unknown", + "no-match" + ], + "target": { + "kind": "human-role", + "name": "Synthetic reviewer" + } + }, + "extensions": { + "com.example.candidate": { + "candidate-number": 999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 + } + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-over-128.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-over-128.json new file mode 100644 index 00000000..be3380c4 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-number-over-128.json @@ -0,0 +1,71 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:bceb1d327714090d58fb463516779aeb50168299e0ff0d2a9de21a7ff5421114", + "byteLength": 1774, + "mediaType": "application/json" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-raw-pack.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-raw-pack.json new file mode 100644 index 00000000..72575108 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-raw-pack.json @@ -0,0 +1,67 @@ +{ + "specVersion": "0.2.0-draft", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "title": "Data access — synthetic interpretation", + "description": "Synthetic RFC material only. No operational authorization or external action.", + "decision": { + "intent": "Apply the retained automated eligibility clause.", + "question": "Is this request eligible for the automated path?" + }, + "outcomes": [ + { + "id": "eligible", + "label": "Eligible for review" + }, + { + "id": "ineligible", + "label": "Ineligible" + }, + { + "id": "review", + "label": "Human review needed" + } + ], + "rules": [ + { + "id": "eligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": true + }, + "outcome": "eligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + }, + { + "id": "ineligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": false + }, + "outcome": "ineligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + } + ], + "fallbackOutcome": "review", + "escalation": { + "triggers": [ + "unknown", + "no-match" + ], + "target": { + "kind": "human-role", + "name": "Synthetic reviewer" + } + }, + "extensions": { + "com.example.candidate": { + "candidate-number": 9007199254740992 + } + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-raw.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-raw.json new file mode 100644 index 00000000..230eb4dc --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-raw.json @@ -0,0 +1,71 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:2857116756d73d0babfcd3ede480fd8d462ea95bfcbc234c5e80983b3c4b9910", + "byteLength": 1661, + "mediaType": "application/json" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-requested-canon-pack.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-requested-canon-pack.json new file mode 100644 index 00000000..72575108 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-requested-canon-pack.json @@ -0,0 +1,67 @@ +{ + "specVersion": "0.2.0-draft", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "title": "Data access — synthetic interpretation", + "description": "Synthetic RFC material only. No operational authorization or external action.", + "decision": { + "intent": "Apply the retained automated eligibility clause.", + "question": "Is this request eligible for the automated path?" + }, + "outcomes": [ + { + "id": "eligible", + "label": "Eligible for review" + }, + { + "id": "ineligible", + "label": "Ineligible" + }, + { + "id": "review", + "label": "Human review needed" + } + ], + "rules": [ + { + "id": "eligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": true + }, + "outcome": "eligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + }, + { + "id": "ineligible", + "when": { + "op": "fact", + "path": "/dataset/deidentified", + "operator": "equals", + "value": false + }, + "outcome": "ineligible", + "onUnknown": "escalate", + "description": "Synthetic interpretation of the retained automated eligibility clause." + } + ], + "fallbackOutcome": "review", + "escalation": { + "triggers": [ + "unknown", + "no-match" + ], + "target": { + "kind": "human-role", + "name": "Synthetic reviewer" + } + }, + "extensions": { + "com.example.candidate": { + "candidate-number": 9007199254740992 + } + } +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-requested-canon.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-requested-canon.json new file mode 100644 index 00000000..a11d5f73 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/core-unsafe-int-requested-canon.json @@ -0,0 +1,75 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:2857116756d73d0babfcd3ede480fd8d462ea95bfcbc234c5e80983b3c4b9910", + "byteLength": 1661, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:0000000000000000000000000000000000000000000000000000000000000000" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/coverage-duplicate.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/coverage-duplicate.json new file mode 100644 index 00000000..c05cf61d --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/coverage-duplicate.json @@ -0,0 +1,75 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:c4912216ef58c754473bdda95be7322126ab2970bd75bea9306f342927d974e4", + "byteLength": 1558, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:d20e694ca1f99d0b3c8e239fdec3e5d1122dc875986ef5ed3651a52b3fba2473" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "eligibility", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/coverage-omitted.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/coverage-omitted.json new file mode 100644 index 00000000..b8d4f284 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/coverage-omitted.json @@ -0,0 +1,70 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:c4912216ef58c754473bdda95be7322126ab2970bd75bea9306f342927d974e4", + "byteLength": 1558, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:d20e694ca1f99d0b3c8e239fdec3e5d1122dc875986ef5ed3651a52b3fba2473" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/coverage-outside.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/coverage-outside.json new file mode 100644 index 00000000..fa81751e --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/coverage-outside.json @@ -0,0 +1,75 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:c4912216ef58c754473bdda95be7322126ab2970bd75bea9306f342927d974e4", + "byteLength": 1558, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:d20e694ca1f99d0b3c8e239fdec3e5d1122dc875986ef5ed3651a52b3fba2473" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "unknown", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/depth-32.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/depth-32.json new file mode 100644 index 00000000..0d73e241 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/depth-32.json @@ -0,0 +1 @@ +[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[0]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]] \ No newline at end of file diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/depth-33.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/depth-33.json new file mode 100644 index 00000000..b9777e0a --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/depth-33.json @@ -0,0 +1 @@ +[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[0]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]] \ No newline at end of file diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/desk-managed-alias-refused.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/desk-managed-alias-refused.json new file mode 100644 index 00000000..497f3947 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/desk-managed-alias-refused.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "desk-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/document-max-bytes.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/document-max-bytes.json new file mode 100644 index 00000000..b50b49e7 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/document-max-bytes.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] + } diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/duplicate-json.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/duplicate-json.json new file mode 100644 index 00000000..27e3b357 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/duplicate-json.json @@ -0,0 +1 @@ +{"formatVersion":"1.0.0","formatVersion":"1.0.0"} \ No newline at end of file diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/duplicate-policy-identity.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/duplicate-policy-identity.json new file mode 100644 index 00000000..4aefa2b8 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/duplicate-policy-identity.json @@ -0,0 +1,128 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:c4912216ef58c754473bdda95be7322126ab2970bd75bea9306f342927d974e4", + "byteLength": 1558, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:d20e694ca1f99d0b3c8e239fdec3e5d1122dc875986ef5ed3651a52b3fba2473" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + }, + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access. Extra synthetic note." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-0.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-0.json new file mode 100644 index 00000000..a4f77172 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-0.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "0.0.2", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-2.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-2.json new file mode 100644 index 00000000..f86d98ec --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-2.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "2.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-before-canon.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-before-canon.json new file mode 100644 index 00000000..a56a64b0 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-before-canon.json @@ -0,0 +1 @@ +{"formatVersion":"7.0.0","n":1.5} \ No newline at end of file diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-before-shape.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-before-shape.json new file mode 100644 index 00000000..004c1fcc --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-before-shape.json @@ -0,0 +1,4 @@ +{ + "formatVersion": "7.0.0", + "approved": true +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-bool.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-bool.json new file mode 100644 index 00000000..d1fe556d --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-bool.json @@ -0,0 +1,76 @@ +{ + "formatVersion": true, + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-int.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-int.json new file mode 100644 index 00000000..be645a97 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-int.json @@ -0,0 +1,76 @@ +{ + "formatVersion": 1, + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-leading-zero.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-leading-zero.json new file mode 100644 index 00000000..4b3ce9a5 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-leading-zero.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "01.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-missing.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-missing.json new file mode 100644 index 00000000..a8bb3dd5 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-missing.json @@ -0,0 +1,75 @@ +{ + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-newline.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-newline.json new file mode 100644 index 00000000..caf99a61 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-newline.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0\n", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-patch.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-patch.json new file mode 100644 index 00000000..c915f2d9 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-patch.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.1", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-short.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-short.json new file mode 100644 index 00000000..0e07cff7 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-short.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-suffix.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-suffix.json new file mode 100644 index 00000000..673bade3 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-suffix.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0-rc.1", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-unicode.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-unicode.json new file mode 100644 index 00000000..2db0c46f --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-unicode.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "١.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-v-prefix.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-v-prefix.json new file mode 100644 index 00000000..1fdc7fa0 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/format-v-prefix.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "v1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/informational-max.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/informational-max.json new file mode 100644 index 00000000..a51fddb8 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/informational-max.json @@ -0,0 +1,82 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:c4912216ef58c754473bdda95be7322126ab2970bd75bea9306f342927d974e4", + "byteLength": 1558, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:d20e694ca1f99d0b3c8e239fdec3e5d1122dc875986ef5ed3651a52b3fba2473" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ], + "informationalSources": [ + { + "bytesDigest": "sha256:8f990ba0b577b51cf009ea049368c16bbda1b21e1b93be07a824758bb253c39b", + "byteLength": 1048576, + "mediaType": "text/plain" + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/informational-over.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/informational-over.json new file mode 100644 index 00000000..efe294ef --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/informational-over.json @@ -0,0 +1,82 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:c4912216ef58c754473bdda95be7322126ab2970bd75bea9306f342927d974e4", + "byteLength": 1558, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:d20e694ca1f99d0b3c8e239fdec3e5d1122dc875986ef5ed3651a52b3fba2473" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ], + "informationalSources": [ + { + "bytesDigest": "sha256:154b8ed3c2383ce429058768595935faf7851b5c38db2b1732594be1d88bc05a", + "byteLength": 1048577, + "mediaType": "text/plain" + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/invalid-utf8.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/invalid-utf8.json new file mode 100644 index 00000000..307ff4b1 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/invalid-utf8.json @@ -0,0 +1 @@ +{"x":""} \ No newline at end of file diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/kind-id-confusion.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/kind-id-confusion.json new file mode 100644 index 00000000..50f4b41e --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/kind-id-confusion.json @@ -0,0 +1,75 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:c4912216ef58c754473bdda95be7322126ab2970bd75bea9306f342927d974e4", + "byteLength": 1558, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:d20e694ca1f99d0b3c8e239fdec3e5d1122dc875986ef5ed3651a52b3fba2473" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "exception", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/limited-scope-missing-basis.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/limited-scope-missing-basis.json new file mode 100644 index 00000000..048cb7e1 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/limited-scope-missing-basis.json @@ -0,0 +1,92 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/procurement/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/procurement/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:d810d8b3972a4bbc31cd3deb7ada4de965f1ad59bf753cec6748f943213cbcee", + "byteLength": 1725, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:205a2afdc68ebd46d5b022256fadec6bd071bc8e34faff481f288c20df008f60" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/procurement/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:539587356d8c0942f6e2c98ec09311e9c55fc4efcc6b9f8845e58db817a8dc58", + "byteLength": 2793, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:f0ef6fe0bb4703eaf6b2c1edf2f12712dffc139e887317c46fc82d83dba71275" + } + }, + "scope": { + "kind": "sections", + "sectionIds": [ + "eligibility", + "conflict-review", + "invoice-payment", + "purchase-scope" + ] + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:14e401b11a917a3275bc18c2d85f547bfd71cf34a706e160ec54621603b36de2", + "byteLength": 402, + "mediaType": "text/plain" + } + }, + { + "sectionId": "conflict-review", + "status": "awaiting-interpretation", + "explanation": "Synthetic open work item: agree the conflict threshold before implementation." + }, + { + "sectionId": "invoice-payment", + "status": "out-of-scope", + "rationale": "This pack assesses eligibility only; treasury payment reconciliation is a separate process." + }, + { + "sectionId": "purchase-scope", + "status": "implemented", + "consumerElements": [ + { + "kind": "applicability" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:14e401b11a917a3275bc18c2d85f547bfd71cf34a706e160ec54621603b36de2", + "byteLength": 402, + "mediaType": "text/plain" + } + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/limited-scope-unknown.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/limited-scope-unknown.json new file mode 100644 index 00000000..84aac041 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/limited-scope-unknown.json @@ -0,0 +1,98 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/procurement/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/procurement/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:d810d8b3972a4bbc31cd3deb7ada4de965f1ad59bf753cec6748f943213cbcee", + "byteLength": 1725, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:205a2afdc68ebd46d5b022256fadec6bd071bc8e34faff481f288c20df008f60" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/procurement/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:539587356d8c0942f6e2c98ec09311e9c55fc4efcc6b9f8845e58db817a8dc58", + "byteLength": 2793, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:f0ef6fe0bb4703eaf6b2c1edf2f12712dffc139e887317c46fc82d83dba71275" + } + }, + "scope": { + "kind": "sections", + "sectionIds": [ + "eligibility", + "conflict-review", + "invoice-payment", + "purchase-scope", + "unknown" + ], + "reviewBasis": { + "bytesDigest": "sha256:14e401b11a917a3275bc18c2d85f547bfd71cf34a706e160ec54621603b36de2", + "byteLength": 402, + "mediaType": "text/plain" + } + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:14e401b11a917a3275bc18c2d85f547bfd71cf34a706e160ec54621603b36de2", + "byteLength": 402, + "mediaType": "text/plain" + } + }, + { + "sectionId": "conflict-review", + "status": "awaiting-interpretation", + "explanation": "Synthetic open work item: agree the conflict threshold before implementation." + }, + { + "sectionId": "invoice-payment", + "status": "out-of-scope", + "rationale": "This pack assesses eligibility only; treasury payment reconciliation is a separate process." + }, + { + "sectionId": "purchase-scope", + "status": "implemented", + "consumerElements": [ + { + "kind": "applicability" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:14e401b11a917a3275bc18c2d85f547bfd71cf34a706e160ec54621603b36de2", + "byteLength": 402, + "mediaType": "text/plain" + } + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/malformed-over-depth.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/malformed-over-depth.json new file mode 100644 index 00000000..bd942c38 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/malformed-over-depth.json @@ -0,0 +1 @@ +[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[[0]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]] \ No newline at end of file diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/missing-governing-policy.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/missing-governing-policy.json new file mode 100644 index 00000000..f9d2742b --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/missing-governing-policy.json @@ -0,0 +1,21 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:c4912216ef58c754473bdda95be7322126ab2970bd75bea9306f342927d974e4", + "byteLength": 1558, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:d20e694ca1f99d0b3c8e239fdec3e5d1122dc875986ef5ed3651a52b3fba2473" + } + }, + "governingPolicies": [] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/missing-narrative.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/missing-narrative.json new file mode 100644 index 00000000..ae2a479e --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/missing-narrative.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/multiple-json.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/multiple-json.json new file mode 100644 index 00000000..afcb0c48 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/multiple-json.json @@ -0,0 +1 @@ +{}{} \ No newline at end of file diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/multiple-policy-identities.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/multiple-policy-identities.json new file mode 100644 index 00000000..3c1da034 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/multiple-policy-identities.json @@ -0,0 +1,128 @@ +{ + "formatVersion": "1.0.0", + "kind": "governing-adoption", + "id": "https://example.invalid/policy-companion-contract/data-access/adoption", + "version": "1.0.0", + "consumer": { + "kind": "pack", + "id": "https://example.invalid/policy-companion-prototype/data-access/pack", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:c4912216ef58c754473bdda95be7322126ab2970bd75bea9306f342927d974e4", + "byteLength": 1558, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:d20e694ca1f99d0b3c8e239fdec3e5d1122dc875986ef5ed3651a52b3fba2473" + } + }, + "governingPolicies": [ + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:6abbd1b965ff006e210b8a98c4a8db6eb0bb795c1f8a995d3be343aa1a984f51", + "byteLength": 2019, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:8e9de4d2824a3186354e4ab410f4b0c744afa452796ce089bc0461adee63bce5" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + }, + { + "policy": { + "kind": "policy", + "id": "https://example.invalid/second-policy", + "version": "1.0.0", + "content": { + "bytesDigest": "sha256:144558275929f298692344329199afd892f5d74f1bc8aa70bea4bda14e98d627", + "byteLength": 1988, + "mediaType": "application/json" + }, + "canonicalIdentity": { + "profile": "jps-canon", + "canonicalDigest": "sha256:1589cd845a13aa22ceef347d11dcc34d1b7ad27ade2f30c13979a0dc541c0a42" + } + }, + "scope": { + "kind": "whole-policy" + }, + "coverage": [ + { + "sectionId": "eligibility", + "status": "implemented", + "consumerElements": [ + { + "kind": "rule", + "id": "eligible" + }, + { + "kind": "rule", + "id": "ineligible" + }, + { + "kind": "fallback" + } + ], + "reviewBasis": { + "bytesDigest": "sha256:7c649cafae58eb11498332c03a107be64fb7d72fcbedebe2c5da32aa801d55f8", + "byteLength": 262, + "mediaType": "text/plain" + } + }, + { + "sectionId": "exception-review", + "status": "manual", + "handoff": "Fictional specialist uses the documented manual review queue; this statement grants no role or access." + }, + { + "sectionId": "audit-review", + "status": "awaiting-implementation", + "explanation": "Synthetic open work item: develop and review a separate implementation." + } + ] + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/narrative-max.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/narrative-max.json new file mode 100644 index 00000000..1654a29c --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/narrative-max.json @@ -0,0 +1,40 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:8f990ba0b577b51cf009ea049368c16bbda1b21e1b93be07a824758bb253c39b", + "byteLength": 1048576, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "all", + "title": "All bytes", + "anchor": { + "startByte": 0, + "endByte": 1, + "bytesDigest": "sha256:2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881" + } + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/narrative-over.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/narrative-over.json new file mode 100644 index 00000000..472bee02 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/narrative-over.json @@ -0,0 +1,40 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:154b8ed3c2383ce429058768595935faf7851b5c38db2b1732594be1d88bc05a", + "byteLength": 1048577, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "all", + "title": "All bytes", + "anchor": { + "startByte": 0, + "endByte": 1, + "bytesDigest": "sha256:2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881" + } + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:9a4f335306e2a8e4fbcf73f5a5bad14f45369fa22985756181eeb8ea1ee217dd", + "byteLength": 433, + "mediaType": "text/plain" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/nonfinite.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/nonfinite.json new file mode 100644 index 00000000..b955cad2 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/nonfinite.json @@ -0,0 +1 @@ +NaN \ No newline at end of file diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/number-literal-over-128.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/number-literal-over-128.json new file mode 100644 index 00000000..7f06a63b --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/number-literal-over-128.json @@ -0,0 +1 @@ +{"formatVersion":"1.0.0","n":999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999} \ No newline at end of file diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/opaque-original.json b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/opaque-original.json new file mode 100644 index 00000000..de7caf77 --- /dev/null +++ b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/opaque-original.json @@ -0,0 +1,76 @@ +{ + "formatVersion": "1.0.0", + "kind": "policy", + "id": "https://example.invalid/policy-companion-contract/data-access/policy", + "version": "1.0.0", + "title": "Data access — synthetic policy content", + "managementMode": "workspace-managed", + "content": { + "bytesDigest": "sha256:801a0d0969c0ffe5b95d12bbdc593c823a995ea28ccdb894b0beb7de370ba172", + "byteLength": 449, + "mediaType": "text/plain" + }, + "sections": [ + { + "id": "eligibility", + "title": "Automated release", + "anchor": { + "startByte": 41, + "endByte": 215, + "bytesDigest": "sha256:95eac1de35b93fdd947821f9336f8441a4ae4ffd69473e4ee332951b150c3896" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 1" + } + ] + }, + { + "id": "exception-review", + "title": "Restricted requests", + "anchor": { + "startByte": 215, + "endByte": 351, + "bytesDigest": "sha256:d2f664a5c4e515f11a5e05c0a2be36d4de7600b0b2d4f33f81dfafed55b441e8" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 2" + } + ] + }, + { + "id": "audit-review", + "title": "Quarterly audit", + "anchor": { + "startByte": 351, + "endByte": 449, + "bytesDigest": "sha256:7f4e8c2f9f2a9ad8f3276c6610f9e9a140833edfd9b46dbf825a1638ab8b6a6e" + }, + "sourceRefs": [ + { + "sourceId": "retained-original", + "location": "Clause 3" + } + ] + } + ], + "sourceProvenance": [ + { + "id": "retained-original", + "source": { + "provider": "synthetic-fixture", + "accountId": "fictional-organization", + "resourceId": "data-access-original" + }, + "sourceRevision": null, + "content": { + "bytesDigest": "sha256:af7777006b9a8e6b9ffd9dbc25f3d4f3c54331e9f74948ba9d1facdf63b1a8be", + "byteLength": 16, + "mediaType": "application/pdf" + } + } + ] +} diff --git a/internal/policy/official/conformance/policy/1.0.0/vectors/documents/opaque-original.pdf b/internal/policy/official/conformance/policy/1.0.0/vectors/documents/opaque-original.pdf new file mode 100644 index 0000000000000000000000000000000000000000..6e5d30d03fe1de8a86fda3a9ba4184f4c7bca647 GIT binary patch literal 16 XcmY!laB