compile_referenced_subjects (crates/registry-evidencectl/src/authoring.rs) bounds selector alternatives at 128 complete authorization shapes per question, while the rendered profile's runtime contract bounds authority grants at 128 per profile in total. A project whose questions each stay under the bound can still exceed it per profile; the runtime then refuses the bundle at load, naming the "authority grants" range. A pre-render aggregate bound per generated profile would move the refusal into evidencectl with the questions named.- The derived
question.schema.json (Question in crates/registry-evidence-authoring/src/model.rs, through schemars) cannot express that selector and profiles are mutually exclusive. The compiler owns the cross-field rule and the language server runs the same validate_question. Encoding it needs an untagged enum or a post-processing step over the generated schema, and both change the schema for every existing subject form. Decide whether the schema stays shape-only (and says so where it is published) or carries the rule.
- In
authoring.rs, a non-string role in a subject input becomes an empty string through as_str().unwrap_or_default(). Unreachable today because validation runs first; a refusal with the field named is the durable shape.
Origin: review of PR #865 (items 1 and 2 also raised by Codex, answered in-thread).
compile_referenced_subjects(crates/registry-evidencectl/src/authoring.rs) bounds selector alternatives at 128 complete authorization shapes per question, while the rendered profile's runtime contract bounds authority grants at 128 per profile in total. A project whose questions each stay under the bound can still exceed it per profile; the runtime then refuses the bundle at load, naming the "authority grants" range. A pre-render aggregate bound per generated profile would move the refusal into evidencectl with the questions named.question.schema.json(Questionincrates/registry-evidence-authoring/src/model.rs, through schemars) cannot express thatselectorandprofilesare mutually exclusive. The compiler owns the cross-field rule and the language server runs the samevalidate_question. Encoding it needs an untagged enum or a post-processing step over the generated schema, and both change the schema for every existing subject form. Decide whether the schema stays shape-only (and says so where it is published) or carries the rule.authoring.rs, a non-stringrolein a subject input becomes an empty string throughas_str().unwrap_or_default(). Unreachable today because validation runs first; a refusal with the field named is the durable shape.Origin: review of PR #865 (items 1 and 2 also raised by Codex, answered in-thread).