feat(substrate): v1.3 — fail-soft vocab partition with block firewall - #85
Merged
Conversation
_validate_view_trust_profile changed from raise-on-misplaced to return-tuple contract: (profile_minus_misplaced: list[str], findings: list[Finding]). Each misplaced token produces one block-severity trust-token-misplaced finding. Semantic firewall preserved: misplaced tokens are dropped from the returned profile so downstream taint/UX checks see them as absent — no silent mis-analysis path. "Fail-soft" is purely ergonomic: the structured finding carries a suggested_fix pointing the operator to the correct view, and the walker can re-prompt inline instead of surfacing an opaque ValueError. The lock cannot complete while a trust-token-misplaced finding exists (block-tier, same gate as all other block findings). Call sites updated: run_per_view now returns tuple[str, list]; CLI surfaces findings to stderr and exits 1 when any exist. Two existing tests that asserted on the raise are updated to assert on the finding. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
5 tasks
Joncik91
added a commit
that referenced
this pull request
May 15, 2026
…ype (#88) Minor release composing three Wave 2 PRs (#85, #86, #87) plus a small walker-side plumbing fixup surfaced by the Wave 3 Opus aggregate review. - Plugin marketplace bump 1.2.1 → 1.3.0 (both metadata.version and plugins[0].version) - README badges: test count 1967 → 2003, version 1.2.1 → 1.3.0 - README components line: v1.2 → v1.3 - CHANGELOG entry summarizing item 8 (catalog seed), item 9 (vocab fail-soft with block firewall), item 10 (layer5 prototype), and the walker fixup - bin/walker.py: _VIEW_TO_CATALOG_VIEW_TYPE realigned so product-input routes to input-shape and product-output routes to output-shape, the exemplar-options call site queries input-shape instead of help-text, and the input-exemplar-pi concern prompt references the input-shape view type instead of the v1.1 placeholder language. The walker's binding-suggestion path and the cross_view_gate's validation path now query the same catalog view types. No spec contract changes — v1.0/v1.1/v1.1.1/v1.2.0/v1.2.1 locked specs continue to validate. 2003 tests passing (1967 v1.2.1 baseline + 36 across the three v1.3 PRs). Zero regressions. Co-authored-by: Copilot <copilot@github.com> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
_validate_view_trust_profilefrom raise-on-misplaced to a return-tuple contract(profile, findings)so that misplaced trust tokens produce structuredblock-severitytrust-token-misplacedfindings instead of an opaqueValueError.trust-token-misplacedfinding exists (block-tier gate), because the partition's semantic guarantee must hold.Why
Two operators hit the opaque
ValueErrorduring dogfooding. The semantic partition (untrusted-input belongs to implementing-agent, not human-user) is correct and must be preserved — relaxing it would silently mislead the evaluator's taint check. The fix converts the error to a structured finding with asuggested_fixfield that names the correct view, so that the walker can re-prompt inline ("Move 'untrusted-input' to 'implementing-agent' view") instead of surfacing a stack trace.Files changed
bin/substrate_wizard.py—_validate_view_trust_profilenew contract;run_per_viewreturnstuple[str, list]; CLI surfaces findings to stderrbin/findings.py— registerstrust-token-misplacedinKNOWN_KINDSdocs/glossary.md—trust-token-misplacedentry with rationale and user_actiontests/test_substrate_wizard_partition_fail_soft.py— 7 new tests covering misplaced tokens, two misplaced in one view, correctly-placed tokens, mixed valid+misplacedtests/test_substrate_wizard.py,tests/test_v1_review_followups.py— updated to new return-tuple contractTest plan
pytest tests/test_substrate_wizard_partition_fail_soft.py— 7 tests, all greenpytest tests/test_v1_review_followups.py— updated disambiguation-hint tests assert on finding, not on raisepytest tests/— 1974 passed, zero regressionsuntrusted-inputinhuman-userview → one block finding, token not in profileaccessibility-requiredinimplementing-agentview → block finding pointing tohuman-user🤖 Generated with Claude Code