Polychro v1.0.0-beta3 — "Brigantine"

What is Polychro?

Polychro is a deterministic linting engine for spec-driven development. It validates semi-structured specifications — YAML, JSON, XML, Markdown, and HTML — through composable layers (well-formedness, schema-model, ruleset, and format-aware validation) in a single embeddable pipeline with sub-second latency.

Built on Spectral's shoulders. Polychro adopts Spectral's given/then ruleset grammar — the de facto standard for API governance rules — and extends it into a fully self-contained, polyglot engine. Where Spectral requires Node.js and is narrowly focused on OpenAPI, Polychro runs as a single JVM binary with no external runtime, supports custom rule functions in JavaScript, Python, and Groovy, and lints YAML, JSON, XML, Markdown, and HTML in the same pipeline.

💡 Polychro is designed to work alongside Ikanos — validating capability specs before they reach the runtime — but it is fully standalone and works with any YAML, JSON, XML, Markdown, or HTML document.

This v1.0.0-beta3 release builds on v1.0.0-beta2 ("Shooner") with a focus on diagnostic accuracy and repo housekeeping: JSON Schema validation errors now resolve a real SourceRange instead of always returning null, the nightly quality gate's SonarQube scan is fixed, Dependabot is restricted to reduce automated PR noise, and the codebase is reorganized under a modules/ folder for clearer navigation. No breaking changes to the SPI or ruleset grammar.

✨ Highlights

📍 JSON Schema Diagnostics Now Carry a Resolved SourceRange (#107, #108)

Schema validation errors returned by JsonSchemaValidator always reported range: null, even though ruleset diagnostics on the same document carried a precise SourceRange. This made it impossible to jump straight to the offending line from a schema error — the exact issue the beta1/beta2 source-ranges epic (#38) was closing for Markdown and HTML.

• JsonSchemaValidator.toDiagnostic now resolves the diagnostic's path against the document's SourceMap, returning a real SourceRange instead of a hardcoded null
• New regression test asserts the resolved range's startLine against a schema violation, guarding against the range silently going back to null

🌙 Nightly Quality Gate — SonarQube Scan Fixed ("red nightly", #110)

The nightly SonarQube scan step had been failing. The scan now runs via the official sonarsource/sonar-scanner-cli image instead of re-invoking mvn sonar:sonar inside the generic Maven image, passes SONAR_TOKEN directly as a scanner environment variable, and points explicitly at the compiled classes (-Dsonar.java.binaries="modules/*/target/classes") now that modules live under modules/.

🤖 Dependabot Restricted (#95, #109)

All five Dependabot configs (maven, github-actions, gomod, npm, pip) now set open-pull-requests-limit: 0, disabling automated update PRs until the next manual post-release dependency pass, cutting down on routine version-bump noise.

📁 Maven Modules Moved Under modules/

Every Maven module (polychro-api, polychro-core, polychro-cli, polychro-capability, polychro-html, polychro-markdown, polychro-json-schema, polychro-json-structure, polychro-checkov, polychro-ruleset, polychro-ruleset-polyglot, polychro-rulesets, polychro-format-common, polychro-github-action, polychro-wellformedness, polychro-coverage) now lives under a modules/ subfolder, mirroring the identical reorganization shipped in Ikanos v1.0.0-beta3. All CI workflows (quality-gate.yml, nightly-quality-gate.yml, publish-cli-bin.yml), .gitignore, and inter-module pom.xml parent references were updated accordingly. Pure reorganization — no production behavior changed.

📦 Dependency Updates

• Jackson bumped from 2.20.2 to 2.21.5, and dependency management switched to importing the jackson-bom instead of pinning jackson-databind / jackson-dataformat-yaml / jackson-dataformat-xml individually — future Jackson module additions now stay version-aligned automatically
• vitest bumped from 3.2.4 to 3.2.6 in polychro-node
• polychro-capability's ikanos-engine / ikanos-spec dependencies bumped to 1.0.0-beta3 to track the sibling Ikanos release

⚠️ Known Issues & Limitations

• XML source ranges — JSON ruleset and schema diagnostics now resolve a real SourceRange, but XML (#35) still reports SourceMap.NONE; tracked under the source-ranges epic (#38)
• Tutorial known limitations carried over from beta1: non-string-key false positive on quoted HTTP status codes (#5) and .polychro.yml schema config not consumed in Step 4 (#6)
• CLI pre-built binary installation — running the binary directly is not straightforward on macOS (Gatekeeper quarantine: xattr -dr com.apple.quarantine) or Windows (SmartScreen warning, unsigned binary). Workaround: run via java -jar polychro.jar
• polychro-rulesets JaCoCo coverage — pre-existing gap on main; coverage gate not yet enforced for this module
• Checkov — requires a local Checkov installation; not bundled in the binary
• CLI pre-built binaries available for macOS ARM64, Linux AMD64, Linux ARM64, and Windows AMD64

🔢 By the Numbers

• 8 commits merged since v1.0.0-beta2
• 432 files changed, +194 / −129 lines (the high file count reflects the modules/ folder reorganization touching every module's path)
• 4 contributors

🙏 Contributors

Huge thanks to the team for shipping this release:

• @jeremnaf (Jeremie Tarnaud) — JSON Schema SourceRange resolution fix (#108), beta3 version bump
• @neyeahmed — Dependabot restriction to security-only updates (#109), Maven modules/ reorganization, release coordination
• @farah-t-trigui — nightly SonarQube scan fix (#110)
• @eskenazit — review and merge of the modules/ reorganization
• dependabot[bot] — Jackson BOM migration, vitest bump

Full Changelog: v1.0.0-beta2...v1.0.0-beta3