Dev - #545
Merged
Merged
Conversation
Remove runtime secret-name value omission
fix: consolidate runtime validation helpers
added: participant runtime lifecycle contracts
docs: register gap remediation overlay
Issue: #468 Requirement: DSL-132
Extend RuntimeDatastoreNode (runtime.datastore_services, amending ADR-048 via ADR-058) with product-neutral, observed node facts the wazuh.indexer SCN-010 capture (aptl#341) could not type: - engine_version / build_hash / build_type, JVM heap_init_bytes / heap_max_bytes (parse_ram, with init<=max), and memory_locked (mlockall) posture. - RuntimeDatastoreEnginePlugin per-node inventory carrying per-plugin version, replacing the name-only, version-dropping service-level engine_plugins list. - RuntimeDatastoreNodeEndpoint client/peer listener inventory with split address/port and an open role taxonomy, replacing the single ambiguous node address (no engine-named fields; spine stays product-neutral). New plugin/endpoint ids join the datastore service-wide stable-id namespace and register as nested child refs. Regenerated contract schemas, extended the SDL docs set, and added the changelog fragment.
added: datastore-node engine provenance and listener topology (DSL-141)
# Conflicts: # docs/explain/sdl/limitations.md # docs/explain/sdl/precedents.md # docs/explain/sdl/sections.md # docs/explain/sdl/validation.md # implementations/python/packages/aces_sdl/runtime_datastore.py # implementations/python/packages/aces_sdl/runtime_datastore_partitions.py # implementations/python/tests/test_runtime_datastore.py
…cardinality # Conflicts: # docs/explain/sdl/validation.md
added: structured datastore mapping manifests
…cardinality # Conflicts: # docs/explain/sdl/validation.md
…nality Add datastore cardinality fields
docs/decisions/adrs/README.md claimed ADRs are "immutable once accepted", but git history shows accepted ADRs substantively edited post-acceptance (ADR-048, ADR-052, and ADR-025/029/032/038/041/050), so the citability claim was unenforced and violated (review finding ADR-1, GOV-941). - ADR-059 defines the amendment policy: a substantive change to an accepted ADR is legitimate only as a superseding ADR or a recorded ## Amendments row plus an updated pin, in the same change. - adr-index.yaml pins every accepted ADR's canonical-content sha256 (canonical content = file minus its ## Amendments section). - tools/check_adr_immutability.py enforces the manifest shape, pin==hash, accepted-coverage both ways, amendment-record 1:1, and (under --base-rev/--staged) that a canonical-content change carries an amendment record. Wired into the policy nox session. - Extract shared ADR parsers into tools/policy/adr.py and move safe_repo_path into tools/policy/common.py so repo_policy and the new gate share one sanitizer/parser. - Reconcile the 8 already-amended ADRs with honest ## Amendments records so the gate starts green; rewrite the README immutability principle. - Map GOV-941 into a decision-record-governance phase in requirement_order.yaml.
feat: add ADR amendment policy and acceptance-content pin gate (GOV-941)
Add interpreted systems, dynamic epistemic logic, Kuhn information sets, noninterference/declassification, STRIPS/PDDL/PDDL2.1/PPDDL/RDDL, Dec-POMDP (Oliehoek-Amato), mean-field games, Fidge/Mattern vector time, Schwarz-Mattern, Winskel/Mazurkiewicz, Allen/Koymans/Alur-Dill, and Chockler-Halpern to the participant-semantics primary-source review and the lineage source map. Fix citation defects: CyGIL title conflation (2109.03331 vs 2304.01244), CRACK venue (Computers & Security 2020), Dec-POMDP complexity authors/venue (Bernstein, Givan, Immerman, Zilberstein; MOR 2002), HLA edition (IEEE Std 1516-2010), and CybORG sim-to-emulation claim grounding (results discussion of Standen et al. 2021).
Close the mapping_loss vocabulary (I16) and add mapping_loss_detail; add attribution_edge_refs and outcome_interpretation_refs to LifecycleEnvelope with SEM-212/SEM-215 ownership cross-refs; define the declared delivery point (DeliveryBasis, delivery_point_ref, delivered_at) and bind the visible-history projection to it; scope stable redaction tokens and their stability claims; add rollback vs append-only visible-history rules; define marking vs visibility-projection precedence (deny-first intersection); define ClassificationClaim for the event_classification null rule; bound opaque participants with a minimal-observable-trace section; make the capability meet total over affecting components (missing declarations contribute unsupported, not skipped); require a versioned reconstruction-algorithm registry for reconstruction refs. Lineage: attribute PettingZoo vs OpenSpiel contributions correctly, add Fidge/Mattern + Schwarz-Mattern for the VectorClock basis, Winskel/Mazurkiewicz for partial-order realized ordering, Berenson/Adya for the isolation vocabulary, Kuhn for perfect recall as a constructive witness, and update the structural examples for the new contract fields.
Split the coverage row that claimed SEM-214 active: SEM-215 (participant outcome interpretation) keeps its active row and artifacts; SEM-214 (derived operational context views) gets its own planned row, matching its DRAFT/wave-3 state with no artifacts. Ground Control: assign wave 2 to SEM-227, SEM-228, and SEM-229 — MUST requirements that ACTIVE SEM-213 explicitly defers to, previously wave-less (priority inversion).
Fix the PettingZoo/OpenSpiel contribution conflation inside ADR-054's context (chance nodes, mean-field states, and information-state discipline are OpenSpiel/theory surfaces, not PettingZoo), ground the framework claims in their underlying theory (Kuhn; Fagin-Halpern- Moses-Vardi; Huang-Caines-Malhame; Lasry-Lions; Fidge/Mattern; Schwarz-Mattern), and add changelog fragments for the remediation issues #511, #512, #513.
…rch notes Joint design artifacts for issue #76 (API-405/406/407/408/411): ADR-060 establishing the participant backend-facing contract surface (one carrier family on the ADR-054 base envelope; API-405 ratified as shipped; API-407 as feature_support on the same manifest block using the guarantee-strength scale; API-408 as retrieval projections with SEM-214 semantics deferred; API-411 as SEM-215 interpretation records), the normative spec section under specs/formal/runtime-contracts/, research notes with prior art, totality analysis, and design criteria, plus the architecture preflight guardrails.
docs: add related-work comparison positioning ACES against precedent systems
test: add backend conformance proof tests with seeded violations
docs: tighten citation hygiene across SDL lineage and precedent docs
Persist a local: import's resolved_source as an SDL-base-relative POSIX path instead of an absolute, machine-specific path, so a committed aces.lock.json verifies on any checkout (CI, other contributors). ResolvedModule.root_file stays the absolute runtime Path used for reads, digesting, parsing, and cycle detection; OCI lock identity and all trust, digest, signature, version, and export-hash checks are unchanged. Pre-existing absolute-path lockfiles are treated as stale and fixed by re-running aces sdl resolve. Closes #551
…amily The last_change change-ledger requirement in check_schema_publication.py (ADR-009 section 7, _check_change_ledger) was introduced on dev after the participant backend-facing contract family (ADR-060, issue #76) and the DSL-132/DSL-141 datastore additions had already landed. Per-PR CI compares schemas against dev, so those schema changes never required a ledger entry; the dev->main PR (#545) is the first evaluation against main, where all 11 schemas read as changed and the gate fails. Backfill a contract-facing last_change entry (summary + current content_hash) for each of the 11 affected published schemas so the dev->main schema publication gate passes. No schema content changes.
fix(sdl): make local import lockfile resolved_source checkout-independent
fix: backfill schema-publication ledger entries to unblock dev->main
Update the lockfile to patched versions and raise the directly-declared floors so a future re-lock cannot regress: - asyncssh 2.22.0 -> 2.23.1 (GHSA-g794-3fmp-753h, AuthorizedKeysFile %u path traversal) - cryptography 46.0.6 -> 49.0.0 (GHSA-p423-j2cm-9vmq, non-contiguous-buffer overflow) - idna 3.11 -> 3.18 (GHSA-65pc-fj4g-8rjx, encode() CVE-2024-3651 bypass) - pytest 9.0.2 -> 9.1.0 (GHSA-6w46-j5rx-g56g, tmpdir handling) - starlette 1.0.0 -> 1.3.1 (GHSA-86qp-5c8j-p5mr, missing Host-header validation) Full nox verify (hygiene, policy, lint, contracts, full pytest + integration, docs) passes under the bumped versions.
- Convert validator.py (4,139 lines) into a package of <=600-line per-seam mixin modules (core, runtime families, relationships, content/objectives, workflows, sections) behind an API-stable SemanticValidator re-export (#42). - Pure refactor: methods moved verbatim; no validation behavior, diagnostics, pass ordering, exception type, or public-API change. The #38 cycle break (PR #53) is the satisfied ordering prerequisite. - Adapt the error-vs-advisory boundary lint (test_sdl_diagnostic_boundary) to scan the package and aggregate methods across the composed mixins; its rules and synthetic negative-path fixture are unchanged, so the IMP-3/#505 control keeps full teeth. Rationale recorded on the issue. - Remove validator.py from tools/policy/oversized_allowlist.yaml; repoint the F821 forward-ref per-file-ignore to validator/_sections.py. - Repoint stale validator.py references in the semantic-coverage matrix (-> validator/__init__.py) and specs/formal prose (-> package) to the new layout.
Behavior-preserving extraction across the validator mixin package to clear the new-code complexity violations (cognitive/cyclomatic/nesting/too-many-returns/too-many-params/make-static) SonarCloud raised on the verbatim-moved validators. No validation behavior, diagnostics, pass ordering, or public-API change; guarded by the existing test suite. Adds shared context dataclasses (_WorkflowBuildState, _CompensationState, _AvailableStateContext) and per-concern helpers; drops the now-unnecessary F821 per-file-ignore.
refactor: split aces_sdl.validator into a per-seam mixin package
…umps security: bump 5 python dependencies to clear moderate dependabot advisories
Two executable spec-oracle test files re-encode formal-spec invariants as test-local predicates with no production callers, and several tests asserted that a co-authored fixture/generator satisfies those same predicates — passing by construction and overstating participant-semantics/runtime coverage. - semantics oracle: drop the catalog self-check and both Hypothesis "generator output satisfies the predicates" tests; remove the now-dead generator strategy and its imports. - runtime oracle: drop the six bare *_accepts_generated_valid_traces tests. - keep the spec/catalog drift guard, the per-invariant mutation-rejection differential tests, the *_accepts_supported_*_variants over-rejection guards, and the canonical positive control (now commented as such). - relabel both module docstrings as spec self-consistency oracles (not tests of production code), pointing to the behavioural suites that cover runtime enforcement (test_sem_211_*..test_sem_218_*, test_run_305/306/311_*). Closes #558
…Cloud) Clears the SonarCloud new_violations gate (7 findings) on the dev->main integration PR #545. The gate measures new code against main, so debt that accumulated on dev across many PRs all reads as new at the integration boundary. - Split 4 files under the SonarCloud S104 500-line threshold (all were within the repo's ADR-015 600-line cap, flagged only by Sonar's stricter default): - aces_contracts/participant_behavior.py 599 -> 466 (enums/tables -> _participant_behavior_types.py) - aces_sdl/validator/_runtime_platform.py 554 -> 463 (orchestration -> _runtime_orchestration.py) - aces_sdl/validator/_relationships.py 525 -> 239 (proxy-upstream -> _relationships_proxy.py) - aces_sdl/runtime_datastore_partitions.py 508 -> 354 (node models -> runtime_datastore_nodes.py, helpers -> _runtime_datastore_support.py) - Reduce ParticipantHistoryViewModel._validate_nested_record_scope cognitive complexity 22 -> <=15 (extract the nested walk to module helpers). - runtime_values.name_indicates_secret: 4 -> 3 returns; drop the S1309-flagged #noqa via the file's existing string-split idiom. No behavior change; public APIs preserved by re-export. Full nox verify passes.
…ogies test: trim tautological self-checks from participant spec-oracle suites
refactor: split oversized files and cut complexity to clear SonarCloud gate
|
Brad-Edwards
added a commit
that referenced
this pull request
Jul 12, 2026
Lower the non-test source-file cap in ADR-015 section 2 from 600 to 500 lines to match SonarCloud's S104 threshold, removing the 500-599 band where files were repo-compliant but failed the Sonar quality gate at the dev -> main integration PR (#545). Re-baseline _ADR015_INITIAL_OVERSIZED_FILES and tools/policy/oversized_allowlist.yaml to the files over 500 lines as of this change; the allowlist shrink-only rule continues from the new baseline. Record the change as an ADR-015 amendment and update its acceptance pin. Closes #561
Brad-Edwards
added a commit
that referenced
this pull request
Jul 12, 2026
Lower the non-test source-file cap in ADR-015 section 2 from 600 to 500 lines to match SonarCloud's S104 threshold, removing the 500-599 band where files were repo-compliant but failed the Sonar quality gate at the dev -> main integration PR (#545). Re-baseline _ADR015_INITIAL_OVERSIZED_FILES and tools/policy/oversized_allowlist.yaml to the files over 500 lines as of this change; the allowlist shrink-only rule continues from the new baseline. Record the change as an ADR-015 amendment and update its acceptance pin. Closes #561
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Related Issues
Requirement Context
aces-sdlChanges
Test Plan
uvx nox -s verifypasses, or the unchecked sessions are listed belowuvx nox -s docs)Checklist
docs/explain/reference/coding-standards.md)changelog.d/, or not neededNotes for Review