105 lines
6.8 KiB
Markdown
105 lines
6.8 KiB
Markdown
# Public read-only mixed source8 validation
|
|
|
|
Baseline `7b06b8ea1b7ef902ee0b3d0ec2971a9a7a1f1acd`, local-only while Gitea
|
|
publication is blocked. This bounded outcome advances the user's textual linting
|
|
and programmatic model requirements without claiming application editing parity.
|
|
The [implementation map](analysis-public-read-design-20260925/IMPLEMENTATION-MAP.md)
|
|
and [independent critique](analysis-public-read-design-20260925/CRITIQUE.md) compare
|
|
diagnostics-only, borrowed, owned and full editable-compilation alternatives.
|
|
The [acceptance review](analysis-public-read-design-20260925/ACCEPTANCE-REVIEW.md)
|
|
pins independent fixture, model, warning and boundary-diagnostic oracles.
|
|
|
|
## Selected interface and authority
|
|
|
|
Expose only `language::check_mixed_bundle(&SourceBundle, ProjectLimits)` returning
|
|
`Result<language::CheckedMixed<'_>, Vec<SourceDiagnostic>>`. The opaque, non-Clone
|
|
result offers `project() -> &Project` and `warnings() -> &[SourceDiagnostic]`.
|
|
Define it beside the existing resolved owner and re-export the type/function
|
|
through private modules. Keep its fields and constructor private. It directly
|
|
retains the actual ResolvedMixedProject; no model substitution or second parse.
|
|
|
|
The result borrows the actual complete input bundle for its lifetime. It grants
|
|
validation and immutable queries, not an editable source index, stabilized output,
|
|
save authority, ownership extraction or history installation. Preserve the real
|
|
syntax/expression/occurrence/storage owners while the witness lives. Do not add
|
|
unused public methods, artificial runtime reads or broad lint suppression merely
|
|
to accommodate retained internal fields.
|
|
|
|
Accept only schema8 with explicit UUIDs for project, every ordinary and typed
|
|
declaration, and typed parameters. Preserve canonical logical paths, include
|
|
traversal and detached-file rejection. Return complete admitted OA/SA models and
|
|
actual located warnings in existing order; errors return no partial successful
|
|
result. Preserve exact original bytes, comments and line endings. No missing-ID
|
|
generation, migration, filesystem discovery, formatter or write operation occurs.
|
|
Use clear public diagnostics for the schema/explicit-ID requirements rather than
|
|
describing the supported API as private test machinery.
|
|
|
|
## Policy and production dependency boundary
|
|
|
|
Construct fresh borrowed C=0 authority from the actual bundle and caller policy.
|
|
Derive internal Limits once by the existing source8 formula: caller source-byte
|
|
and step-reference limits, remaining ParseLimits fields UNLIMITED. Internal
|
|
entries therefore remain capped at262144 independently of caller model records;
|
|
the latter still governs actual final-model admission. Keep the existing hard
|
|
token, frame, numeric, byte and reference ceilings. Do not expose an arbitrary
|
|
profile or raw Slots constructor. Preserve Some(Borrowed) and select both text
|
|
and entry producers, then complete resolution/admission with the same policy.
|
|
|
|
Promote only the required parse/lower/resolve dependency cone. Parser mixed state
|
|
and shared helpers must compile in production coherently while existing ordinary
|
|
callers still select None. Keep private edit/index/emission machinery, fixture
|
|
constructors, retained snapshots and Pending-backed authority under cfg(test).
|
|
Use item-level gating from the reviewed map. Necessary retained allocation or
|
|
admission-evidence fields may have individually documented non-test dead-code
|
|
allowances; do not suppress whole modules/structs or weaken -D warnings.
|
|
|
|
This remains the existing logical storage policy, not an all-heap/RSS guarantee.
|
|
Independently bounded traversal, delimiter/Pratt/duplicate-name scratch and
|
|
established model/validator/numeric internals retain their documented scopes.
|
|
Preserve generic depth64, typed depth128, DEPTH_128_VALIDATED=false and the
|
|
unresolved full-pipeline small-stack limitation. Linux remains user-deferred.
|
|
|
|
## Observable acceptance
|
|
|
|
- A real non-test integration consumer uses the exported API on substantial OA
|
|
and SA multi-file fixtures with independently authored complete model oracles,
|
|
located warnings, nested ownership, cross-file/scoped references and Unicode/CRLF.
|
|
Reuse valid authored fixtures/oracles without deriving expected models from
|
|
the candidate parser or writer. Check all original bytes on success/refusal.
|
|
- Negative cases cover missing UUIDs in each required class, unsupported versions,
|
|
invalid paths/includes/cycles/detached files, malformed and duplicate/unresolved
|
|
or wrong-kind references. Assert actual diagnostic paths/spans and meaningful
|
|
error categories. Keep long ordinary analysis-constructor rejection explicit.
|
|
- Prove the real production constructor selects borrowed zero carry, both producer
|
|
modes and every derived limit through narrow internal observation; preserve
|
|
existing discriminating producer cap tests. Public tests exercise caller source,
|
|
file, edge/depth and final-model/step restrictions. The minimal78-byte fixture
|
|
reaches input admission before its C0 text44/43 boundary, so do not mislabel a
|
|
source-byte rejection as a producer-boundary test or reuse pending O152/151 caps.
|
|
Preserve existing diagnostic mapping and phase precedence: the early byte check
|
|
reports `invalid_source` with `Source8 index/output byte limit exceeded.`, not
|
|
Traversal's later `source_limit`. Use the reviewed exact spans/categories for
|
|
file, edge and depth boundaries rather than assuming a uniform limiter layer.
|
|
- Compile-fail documentation demonstrates that the result cannot outlive or permit
|
|
mutation of its source. Include a concise real usage example and public API
|
|
documentation in the established language documentation; distinguish this
|
|
bounded read contract from full source8 editing and application support.
|
|
- Run core library, the new non-test integration target, relevant existing
|
|
ordinary integration/stack controls, doctests, strict core all-target Clippy and
|
|
formatting disposition. Production Parser layout now includes mixed state:
|
|
previously test-only success is insufficient to qualify ordinary non-test
|
|
callers. Investigate concrete stack/runtime changes; no larger stack or relaxed
|
|
budgets. Reuse other valid evidence only when component inputs are unchanged.
|
|
|
|
Existing parse/compile, source-file loader, CLI, desktop, server, formatting,
|
|
update, save and history contracts remain separate. Current CLI discovery parses
|
|
ordinary syntax and unconditionally constructs editable compilation even for
|
|
Check; a new Rust API alone cannot enable mixed CLI checking. Reject a fake index,
|
|
regex include scanner or nominal command that fails before this checker. A later
|
|
CLI/discovery adapter or full editing adoption requires its own concrete outcome.
|
|
|
|
Parent owns compiler execution, synthesis, acceptance and publication. Bounded
|
|
implementation and independent source/oracle review may proceed on a distinct
|
|
local branch; no shared ownership or publication success is implied by this
|
|
contract while Gitea writes remain unavailable.
|