Skip to content

Commit d48821f

Browse files
authored
feat(schema): RLD loader/diagnostics contracts (LoaderFault + ResilientDiagnosticRecord) [E13/WS-A] (#280)
* feat(schema): RLD loader/diagnostics contracts — LoaderFault + ResilientDiagnosticRecord Epoch E13 / WS-A. Lands the fail-closed L1 substrate contracts the rest of the epoch stands on (the RLD Rust workspace + Lean proof remain the reference impl): - LoaderFault: typed sum with stable codes (LDR-DEP-MISSING, LDR-ABI-MISMATCH, ...); no bare abort (I5/R2). Severity is a table of the failing edge's binding class (REQUIRED->fatal, FEATURE->degraded, WEAK->info, LAZY->handled|fatal), machine-checked. - ResilientDiagnosticRecord: root-cause-first; reproKey excludes timestamps/PIDs so identical defects coalesce; privacy-by-projection (I8) telemetry tier is an allowlist projection with symbolic (path-free) fields, validator-enforced. + canonical examples (the CoreSimulator abort re-encoded + its correct FEATURE-degraded form), invariant validator (make-wired), ADR-0018. Built in an isolated worktree. * fix(registry): regenerate contract-registry.json for LoaderFault + ResilientDiagnosticRecord contract-reconciliation CI requires the registry to be regenerated whenever a schema is added; this PR's schemas were missing from it. * fix(makefile): resolve leftover rebase conflict markers A second conflict hunk (validate-multiverseal-twin-reference-impl vs validate-rld-examples target blocks) was left unresolved after the previous rebase, breaking make with 'missing separator'.
1 parent 1b15184 commit d48821f

9 files changed

Lines changed: 395 additions & 3 deletions

Makefile

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
.PHONY: validate validate-resource-contract validate-measurement validate-value-type validate-source-locator validate-sourceos-repo-manifest validate-mesh-action-registry validate-control-plane-examples validate-nlboot-examples validate-lattice-data-governai-examples validate-ops-history-examples validate-runtime-observability-examples validate-interpretability-examples validate-lifecycle-boundary-examples validate-svf-contracts validate-sync-cycle-receipts validate-onboarding-examples validate-runtime-causality-examples validate-agentic-os-examples validate-triparty-examples validate-labor-market-examples validate-supply-chain-risk-examples validate-reasoning-examples validate-mpcc-event-examples validate-knowledge-nugget-examples validate-semantic-action-examples validate-epistemic-kernel-examples validate-ab-update-examples validate-device-service-examples validate-duplicate-schema-ids validate-lawful-dispatch-receipt validate-architectural-building-block validate-agent-passport-examples validate-seam-definition-examples validate-agent-system-vocabulary validate-genesis-inception-examples validate-measurement validate-world-model-examples validate-eval-item-examples validate-ingestion-pipeline-examples validate-data-acquisition-examples validate-glossary-alignment-examples validate-data-class-examples validate-table-keys validate-dag-loop validate-vocab-currency-loop vocab-currency-dogfood validate-glossary-promotion validate-agreement validate-stopword-analysis stopword-analysis-live validate-kgram-differential validate-learned-dictionary train-dataclass-classifiers validate-assay-fleet-examples validate-image-trust-examples validate-consent-plane-examples validate-schema-references validate-fingerprint-stack validate-multiverseal-twin-examples validate-multiverseal-twin-reference-impl
1+
.PHONY: validate validate-resource-contract validate-measurement validate-value-type validate-source-locator validate-sourceos-repo-manifest validate-mesh-action-registry validate-control-plane-examples validate-nlboot-examples validate-lattice-data-governai-examples validate-ops-history-examples validate-runtime-observability-examples validate-interpretability-examples validate-lifecycle-boundary-examples validate-svf-contracts validate-sync-cycle-receipts validate-onboarding-examples validate-runtime-causality-examples validate-agentic-os-examples validate-triparty-examples validate-labor-market-examples validate-supply-chain-risk-examples validate-reasoning-examples validate-mpcc-event-examples validate-knowledge-nugget-examples validate-semantic-action-examples validate-epistemic-kernel-examples validate-ab-update-examples validate-device-service-examples validate-duplicate-schema-ids validate-lawful-dispatch-receipt validate-architectural-building-block validate-agent-passport-examples validate-seam-definition-examples validate-agent-system-vocabulary validate-genesis-inception-examples validate-measurement validate-world-model-examples validate-eval-item-examples validate-ingestion-pipeline-examples validate-data-acquisition-examples validate-glossary-alignment-examples validate-data-class-examples validate-table-keys validate-dag-loop validate-vocab-currency-loop vocab-currency-dogfood validate-glossary-promotion validate-agreement validate-stopword-analysis stopword-analysis-live validate-kgram-differential validate-learned-dictionary train-dataclass-classifiers validate-assay-fleet-examples validate-image-trust-examples validate-consent-plane-examples validate-schema-references validate-fingerprint-stack validate-multiverseal-twin-examples validate-multiverseal-twin-reference-impl validate-rld-examples
22

3-
validate: validate-data-class-examples validate-glossary-alignment-examples validate-data-acquisition-examples validate-ingestion-pipeline-examples validate-control-plane-examples validate-nlboot-examples validate-lattice-data-governai-examples validate-ops-history-examples validate-runtime-observability-examples validate-interpretability-examples validate-lifecycle-boundary-examples validate-svf-contracts validate-sync-cycle-receipts validate-onboarding-examples validate-runtime-causality-examples validate-agentic-os-examples validate-triparty-examples validate-labor-market-examples validate-supply-chain-risk-examples validate-reasoning-examples validate-mpcc-event-examples validate-knowledge-nugget-examples validate-semantic-action-examples validate-epistemic-kernel-examples validate-ab-update-examples validate-device-service-examples validate-duplicate-schema-ids validate-value-type validate-source-locator validate-sourceos-repo-manifest validate-mesh-action-registry validate-lawful-dispatch-receipt validate-architectural-building-block validate-agent-passport-examples validate-seam-definition-examples validate-agent-system-vocabulary validate-genesis-inception-examples validate-measurement validate-world-model-examples validate-eval-item-examples validate-resource-contract validate-table-keys validate-dag-loop validate-vocab-currency-loop validate-glossary-promotion validate-agreement validate-stopword-analysis validate-kgram-differential validate-learned-dictionary validate-trained-classifiers validate-multiverseal-twin-examples validate-multiverseal-twin-reference-impl validate-assay-fleet-examples validate-image-trust-examples validate-consent-plane-examples validate-schema-references validate-fingerprint-stack
3+
validate: validate-data-class-examples validate-glossary-alignment-examples validate-data-acquisition-examples validate-ingestion-pipeline-examples validate-control-plane-examples validate-nlboot-examples validate-lattice-data-governai-examples validate-ops-history-examples validate-runtime-observability-examples validate-interpretability-examples validate-lifecycle-boundary-examples validate-svf-contracts validate-sync-cycle-receipts validate-onboarding-examples validate-runtime-causality-examples validate-agentic-os-examples validate-triparty-examples validate-labor-market-examples validate-supply-chain-risk-examples validate-reasoning-examples validate-mpcc-event-examples validate-knowledge-nugget-examples validate-semantic-action-examples validate-epistemic-kernel-examples validate-ab-update-examples validate-device-service-examples validate-duplicate-schema-ids validate-value-type validate-source-locator validate-sourceos-repo-manifest validate-mesh-action-registry validate-lawful-dispatch-receipt validate-architectural-building-block validate-agent-passport-examples validate-seam-definition-examples validate-agent-system-vocabulary validate-genesis-inception-examples validate-measurement validate-world-model-examples validate-eval-item-examples validate-resource-contract validate-table-keys validate-dag-loop validate-vocab-currency-loop validate-glossary-promotion validate-agreement validate-stopword-analysis validate-kgram-differential validate-learned-dictionary validate-trained-classifiers validate-multiverseal-twin-examples validate-multiverseal-twin-reference-impl validate-assay-fleet-examples validate-image-trust-examples validate-consent-plane-examples validate-schema-references validate-fingerprint-stack validate-rld-examples
44
@echo "OK: validate"
55

66
validate-assay-fleet-examples:
@@ -258,3 +258,7 @@ validate-multiverseal-twin-examples:
258258
validate-multiverseal-twin-reference-impl:
259259
python3 -m pip install --user numpy >/dev/null
260260
cd reference/multiverseal-twin && python3 test_mvtwin.py
261+
262+
validate-rld-examples:
263+
python3 -m pip install --user jsonschema referencing >/dev/null
264+
python3 tools/validate_rld_examples.py
Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# ADR-0018: RLD loader & diagnostics contracts (LoaderFault / ResilientDiagnosticRecord)
2+
3+
Status: Accepted
4+
Date: 2026-08-03
5+
Part of: Epoch E13 (Reference-Gated Sovereign Stack), workstream WS-A
6+
7+
## Context
8+
9+
The Resilient Loader & Diagnostics (RLD) design ships as a Rust workspace + a Lean
10+
launch-completeness proof. What the fabric lacked was the *contracts* — so the loader's
11+
faults and crash records could be carried, deduped, and projected like every other typed
12+
value in the estate. This lands them, making RLD the L1 fail-closed substrate the rest of
13+
Epoch E13 (identity twin, capture receipts) stands on.
14+
15+
## Decisions
16+
17+
1. **Every fatal stop is a typed value first (I5 / R2).** `LoaderFault` is an algebraic sum
18+
with **stable codes** (`LDR-DEP-MISSING`, `LDR-ABI-MISMATCH`, …). A bare string abort is a
19+
spec violation. Non-fatal `FEATURE`/`LAZY` misses are recorded too, at `degraded`/`handled`
20+
— the "what quietly turned off" trail the reference format could not express.
21+
22+
2. **Severity is a table, not a heuristic.** The failing edge's binding class fixes severity:
23+
`REQUIRED→fatal`, `FEATURE→degraded`, `WEAK→info`, `LAZY→handled|fatal`. Machine-checked.
24+
25+
3. **Root-cause-first, diffable, coalescing.** `ResilientDiagnosticRecord` puts the typed
26+
fault as field #1; `reproKey = H(code ‖ import.name ‖ chain ‖ image_hash)` excludes
27+
timestamps/PIDs so N occurrences of a defect collapse to one bucket.
28+
29+
4. **Privacy by projection (I8), not redaction.** The telemetry tier is an *allowlist*
30+
projection of the local record; path-like fields are represented symbolically (store names,
31+
content hashes), so there is no user path to leak — enforced by the validator. This is the
32+
same discipline as the reasoning-evidence receipts and the twin's reference-gated projection
33+
(ADR-0014): **what leaves is a projection, never a scrub.**
34+
35+
## Consequences
36+
37+
- New conformant contracts `LoaderFault` + `ResilientDiagnosticRecord`, canonical examples
38+
(the reference `CoreSimulator` abort re-encoded, plus its correct `FEATURE`-degraded form),
39+
and an invariant validator wired into `make validate`.
40+
- RDR `$ref`s `LoaderFault` by `$id`; validators resolve it via a `referencing` registry.
41+
- The Rust workspace + Lean proof remain the reference implementation; these contracts are the
42+
wire/record form the fabric carries.
43+
- Ties WS-A into the E13 through-line: bind-at-capture, fail-closed, projection-not-redaction.

examples/loader_fault.json

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"type": "LoaderFault",
3+
"kind": "InterfaceMismatch",
4+
"code": "LDR-ABI-MISMATCH",
5+
"severity": "fatal",
6+
"import": {
7+
"name": "libfoo",
8+
"versionReq": ">=1.0",
9+
"binding": "REQUIRED",
10+
"requestedBy": "app",
11+
"chain": [
12+
"app"
13+
]
14+
},
15+
"want": "b3:abi-1",
16+
"got": "b3:abi-2"
17+
}
Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"id": "urn:srcos:rdr:claude-ios-sim:2026-08-03",
3+
"type": "ResilientDiagnosticRecord",
4+
"specVersion": "2.0.0",
5+
"schema": "rdr/1",
6+
"process": {
7+
"id": "pid:claude-ios-sim",
8+
"imageHash": "b3:img-abc",
9+
"entry": "_main",
10+
"profile": "prod"
11+
},
12+
"fault": {
13+
"type": "LoaderFault",
14+
"kind": "MissingProvider",
15+
"code": "LDR-DEP-MISSING",
16+
"severity": "fatal",
17+
"import": {
18+
"name": "com.apple.CoreSimulator",
19+
"versionReq": ">=0",
20+
"binding": "REQUIRED",
21+
"requestedBy": "com.facebook.FBSimulatorControl",
22+
"chain": [
23+
"com.anthropic.claude.ios-sim",
24+
"com.facebook.FBSimulatorControl"
25+
]
26+
},
27+
"searched": [
28+
{
29+
"store": "system",
30+
"result": "absent"
31+
},
32+
{
33+
"store": "cryptex",
34+
"result": "absent"
35+
}
36+
]
37+
},
38+
"phase": "seal-verify",
39+
"closure": {
40+
"coreSize": 3,
41+
"sealedManifestHash": "b3:scm-xyz"
42+
},
43+
"chain": [
44+
"com.anthropic.claude.ios-sim",
45+
"com.facebook.FBSimulatorControl"
46+
],
47+
"env": {
48+
"osBuild": "25A1",
49+
"model": "iPhone",
50+
"abiLevel": 210,
51+
"bootId": "boot-1"
52+
},
53+
"redaction": {
54+
"tier": "telemetry",
55+
"saltId": "salt-1"
56+
},
57+
"reproKey": "b3:repro-abc",
58+
"capturedAt": "2026-08-03T00:00:00Z"
59+
}
Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"id": "urn:srcos:rdr:claude-desktop:2026-08-03",
3+
"type": "ResilientDiagnosticRecord",
4+
"specVersion": "2.0.0",
5+
"schema": "rdr/1",
6+
"process": {
7+
"id": "pid:claude-desktop",
8+
"imageHash": "b3:img-def",
9+
"entry": "_main",
10+
"profile": "prod"
11+
},
12+
"fault": {
13+
"type": "LoaderFault",
14+
"kind": "MissingProvider",
15+
"code": "LDR-DEP-MISSING",
16+
"severity": "degraded",
17+
"import": {
18+
"name": "com.apple.CoreSimulator",
19+
"versionReq": ">=0",
20+
"binding": "FEATURE",
21+
"capability": "simulator-control",
22+
"requestedBy": "com.facebook.FBSimulatorControl",
23+
"chain": [
24+
"com.anthropic.claude.desktop",
25+
"com.facebook.FBSimulatorControl"
26+
]
27+
},
28+
"searched": [
29+
{
30+
"store": "system",
31+
"result": "absent"
32+
}
33+
]
34+
},
35+
"phase": "running-lazy",
36+
"closure": {
37+
"coreSize": 3,
38+
"sealedManifestHash": "b3:scm-desktop"
39+
},
40+
"chain": [
41+
"com.anthropic.claude.desktop",
42+
"com.facebook.FBSimulatorControl"
43+
],
44+
"env": {
45+
"osBuild": "25A1",
46+
"model": "Mac",
47+
"abiLevel": 210,
48+
"bootId": "boot-2"
49+
},
50+
"redaction": {
51+
"tier": "local",
52+
"saltId": "salt-2"
53+
},
54+
"reproKey": "b3:repro-def",
55+
"capturedAt": "2026-08-03T00:00:00Z"
56+
}

registry/contract-registry.json

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -811,6 +811,11 @@
811811
"path": "schemas/LivenessProfile.json",
812812
"sha256": "sha256:2ba5665d3322c3861f70c7b8e25b0c13b306c65103a53cabf190f137d3a47578"
813813
},
814+
"LoaderFault": {
815+
"$id": "https://schemas.srcos.ai/v2/LoaderFault.json",
816+
"path": "schemas/LoaderFault.json",
817+
"sha256": "sha256:f1ca80e3aeec7402ad46d6682ff35d96cd7227ae745b9e96441c6b91fd9a2684"
818+
},
814819
"LocalArtifactRef": {
815820
"$id": "https://schemas.srcos.ai/v2/LocalArtifactRef.json",
816821
"path": "schemas/LocalArtifactRef.json",
@@ -1251,6 +1256,11 @@
12511256
"path": "schemas/ReserveScenarioReport.json",
12521257
"sha256": "sha256:e4a878579aae3d3795d8d8a4fb2eb24e1159877ed6306a5fdbf6fadf3f6b4545"
12531258
},
1259+
"ResilientDiagnosticRecord": {
1260+
"$id": "https://schemas.srcos.ai/v2/ResilientDiagnosticRecord.json",
1261+
"path": "schemas/ResilientDiagnosticRecord.json",
1262+
"sha256": "sha256:4de57a2346de5316b7b501b27b339729742f8252105e446846d707751791ec2b"
1263+
},
12541264
"ResourceContract": {
12551265
"$id": "https://schemas.srcos.ai/v2/ResourceContract.json",
12561266
"path": "schemas/ResourceContract.json",
@@ -1837,5 +1847,5 @@
18371847
"sha256": "sha256:eadc32085987ffda647b090e3eba3726edd102a66d4736e239457bb74867004b"
18381848
}
18391849
},
1840-
"count": 367
1850+
"count": 369
18411851
}

schemas/LoaderFault.json

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
{
2+
"$schema": "https://json-schema.org/draft/2020-12/schema",
3+
"$id": "https://schemas.srcos.ai/v2/LoaderFault.json",
4+
"title": "LoaderFault",
5+
"description": "A typed, stable-coded fault the resilient loader (rld) constructs BEFORE any degradation or halt (invariant I5 / rule R2: no bare abort). The class of the failing import edge deterministically fixes severity (REQUIRED->fatal, FEATURE->degraded, LAZY->handled-or-fatal, WEAK->info) — the classifier is a table, not a heuristic. Degradations (non-fatal FEATURE/LAZY misses) are recorded here too, giving a full 'what quietly turned off' trail. Embedded in a ResilientDiagnosticRecord.",
6+
"type": "object",
7+
"additionalProperties": false,
8+
"required": ["type", "kind", "code", "severity"],
9+
"properties": {
10+
"type": { "const": "LoaderFault", "description": "Type discriminator; always 'LoaderFault'." },
11+
"kind": {
12+
"type": "string",
13+
"enum": ["MissingProvider", "VersionUnsatisfied", "InterfaceMismatch", "SignatureInvalid", "CorruptImage", "SandboxDenied", "ResourceExhausted"],
14+
"description": "The fault variant."
15+
},
16+
"code": {
17+
"type": "string",
18+
"enum": ["LDR-DEP-MISSING", "LDR-DEP-VERSION", "LDR-ABI-MISMATCH", "LDR-SIG-INVALID", "LDR-IMG-CORRUPT", "LDR-SBX-DENY", "LDR-RES-EXHAUST"],
19+
"description": "Stable machine code; the root-cause line is a pure lookup on this (no free-text parsing)."
20+
},
21+
"severity": {
22+
"type": "string",
23+
"enum": ["fatal", "degraded", "handled", "info"],
24+
"description": "Determined by the failing edge's binding class, not by heuristics."
25+
},
26+
"import": {
27+
"type": "object",
28+
"additionalProperties": false,
29+
"description": "The import reference that failed (present for dependency/ABI faults).",
30+
"properties": {
31+
"name": { "type": "string", "description": "Required interface name." },
32+
"versionReq": { "type": "string", "description": "Requested version range." },
33+
"binding": { "type": "string", "enum": ["REQUIRED", "FEATURE", "LAZY", "WEAK"], "description": "Binding class of the failing edge (drives severity). The reference incident's defect: this was REQUIRED where it should have been FEATURE." },
34+
"capability": { "type": "string", "description": "Feature capability token kappa, when binding=FEATURE." },
35+
"requestedBy": { "type": "string", "description": "The module that requested the import." },
36+
"chain": { "type": "array", "items": { "type": "string" }, "description": "Causal requester chain root -> ... -> requester." }
37+
}
38+
},
39+
"searched": { "type": "array", "items": { "type": "object", "additionalProperties": true }, "description": "Symbolic store queries attempted (named stores, not filesystem paths) — PII-free by construction." },
40+
"want": { "type": "string", "description": "Expected interface/ABI digest (InterfaceMismatch)." },
41+
"got": { "type": "string", "description": "Actual digest found (InterfaceMismatch)." },
42+
"hash": { "type": "string", "description": "Content hash of the offending image (SignatureInvalid/CorruptImage)." },
43+
"reason": { "type": "string", "description": "Signature-failure reason (SignatureInvalid)." },
44+
"candidate": { "type": "string", "description": "Symbolic store candidate rejected by policy (SandboxDenied)." },
45+
"rule": { "type": "string", "description": "Policy rule id that denied the load (SandboxDenied)." },
46+
"resourceKind": { "type": "string", "enum": ["VMEM", "FD", "MAPSLOTS"], "description": "Exhausted resource (ResourceExhausted)." },
47+
"limit": { "type": "integer", "description": "Resource limit hit (ResourceExhausted)." }
48+
}
49+
}

0 commit comments

Comments
 (0)