feat: enforce canonical StarIntel v0.9 runtime boundaries #119

Merged

lost-rob0t merged 3 commits from agent/v09-canonical-runtime-cutover into master

2026-08-25 07:54:41 +00:00

lost-rob0t commented

2026-08-25 06:35:59 +00:00

(Migrated from github.com)

Summary

This PR supersedes stale PR #116 against current master.

Reuse star-cl SHA b8dfbe2f9f56065ace8c3313b92ca748a115cdfa and its canonical v0.9 validator.
Enforce strict schema validation before mutation for canonical HTTP and Rabbit boundaries, including document updates.
Keep only the explicit target compatibility adapters non-strict and route legacy HTTP targets directly to documents.new.target.<actor>.
Authorize PUT /document/:id before persistence and return stable 422 schema errors.
Add Prolog contract coverage, focused Lisp/Python tests, documentation, and converged Nix/QLot locks.

Verification

Python contract tests: 18 passed.
Lisp unit suites: all passed; HTTP boundary 29/29, v0.9 runtime 7/7, authorization policy 20/20.
Schema lock check: passed.
nix flake check --show-trace: passed with an isolated cache using Nix 2.35.2.
nix build .#default --no-link --print-build-logs: passed with an isolated cache.
docker compose config --quiet: passed.
./scripts/stack-test.sh: passed with an isolated cache, including authenticated scoped denial, FTS, restart persistence, and credential persistence.
V4 quality gate nix develop --command bash scripts/check: passed.
Prolog verify/0: passed against commit 2d6d88dbc188f64fcf76b53a8411b576b62c6a44.

The initial GitHub jobs failed before test execution because a warmed runner cache rejected the old star-cl NAR hash. The lock was corrected to the clean Nix 2.35.2 value and the branch was repushed. The standalone nix run .#star-integration-tests --show-trace runner also cannot run its CouchDB suite because it provisions Valkey only; the Compose-backed stack test exercises CouchDB successfully. The V4-prescribed scripts/sync.py --check is unavailable because that script is not present in the workspace.

## Summary This PR supersedes stale PR #116 against current master. - Reuse star-cl SHA `b8dfbe2f9f56065ace8c3313b92ca748a115cdfa` and its canonical v0.9 validator. - Enforce strict schema validation before mutation for canonical HTTP and Rabbit boundaries, including document updates. - Keep only the explicit target compatibility adapters non-strict and route legacy HTTP targets directly to `documents.new.target.<actor>`. - Authorize `PUT /document/:id` before persistence and return stable 422 schema errors. - Add Prolog contract coverage, focused Lisp/Python tests, documentation, and converged Nix/QLot locks. ## Verification - Python contract tests: 18 passed. - Lisp unit suites: all passed; HTTP boundary 29/29, v0.9 runtime 7/7, authorization policy 20/20. - Schema lock check: passed. - `nix flake check --show-trace`: passed with an isolated cache using Nix 2.35.2. - `nix build .#default --no-link --print-build-logs`: passed with an isolated cache. - `docker compose config --quiet`: passed. - `./scripts/stack-test.sh`: passed with an isolated cache, including authenticated scoped denial, FTS, restart persistence, and credential persistence. - V4 quality gate `nix develop --command bash scripts/check`: passed. - Prolog `verify/0`: passed against commit `2d6d88dbc188f64fcf76b53a8411b576b62c6a44`. The initial GitHub jobs failed before test execution because a warmed runner cache rejected the old `star-cl` NAR hash. The lock was corrected to the clean Nix 2.35.2 value and the branch was repushed. The standalone `nix run .#star-integration-tests --show-trace` runner also cannot run its CouchDB suite because it provisions Valkey only; the Compose-backed stack test exercises CouchDB successfully. The V4-prescribed `scripts/sync.py --check` is unavailable because that script is not present in the workspace.