From e024838993d46a71486c18c1dd4bf2c2856bd42b Mon Sep 17 00:00:00 2001 From: "Mr. Denman Mills" Date: Thu, 8 Oct 2026 19:51:30 -0500 Subject: [PATCH 1/3] DEN-3033: admit actual Zed API toolchain contract through audited TJSV --- .../typespec-json-schema-peer-authority.yml | 40 ++++++++++++++++++- 1 file changed, 38 insertions(+), 2 deletions(-) diff --git a/.github/workflows/typespec-json-schema-peer-authority.yml b/.github/workflows/typespec-json-schema-peer-authority.yml index 0400a37..acacd06 100644 --- a/.github/workflows/typespec-json-schema-peer-authority.yml +++ b/.github/workflows/typespec-json-schema-peer-authority.yml @@ -4,11 +4,23 @@ on: pull_request: paths: - "test/fixtures/schema-authority-canary/**" + - "contracts/toolchain/**" + - ".cli-flags.toml" + - ".zpkg.toml" + - "Cargo.toml" + - "Cargo.lock" + - "src/flags.rs" - ".github/workflows/typespec-json-schema-peer-authority.yml" push: branches: [main, dev] paths: - "test/fixtures/schema-authority-canary/**" + - "contracts/toolchain/**" + - ".cli-flags.toml" + - ".zpkg.toml" + - "Cargo.toml" + - "Cargo.lock" + - "src/flags.rs" - ".github/workflows/typespec-json-schema-peer-authority.yml" schedule: - cron: "37 5 * * 1" @@ -41,7 +53,7 @@ jobs: test "$(git rev-parse HEAD)" = "$EXPECTED_SHA" - name: Generate Schema B and compare both peer authorities - uses: ORESoftware/typespec-json-schema-validator@5b04b08512f8a03a376dcb96818969e2d83c2d84 + uses: ORESoftware/typespec-json-schema-validator@eb669d2c2c4f0800fac54f9b5a306b550121f1ac with: typespec: test/fixtures/schema-authority-canary/main.tsp schema: test/fixtures/schema-authority-canary/authored.schema.json @@ -52,7 +64,7 @@ jobs: # This canary verifies gate admission, not unrelated product contracts. - name: Require current evidence and the canonical consumer-admission refusals - uses: ORESoftware/typespec-json-schema-validator/actions/test-consumer-admission@5b04b08512f8a03a376dcb96818969e2d83c2d84 + uses: ORESoftware/typespec-json-schema-validator/actions/test-consumer-admission@eb669d2c2c4f0800fac54f9b5a306b550121f1ac with: contract_ir: .typespec-json-schema-validator/contract-ir.json report: .typespec-json-schema-validator/report.json @@ -61,6 +73,30 @@ jobs: generated_schema: .typespec-json-schema-validator/generated/typespec.generated.schema.json expected_declarations: '["OreSchemaAuthority.AuthorityKind","OreSchemaAuthority.PeerAuthorityRegistration"]' + # Real registry API toolchain contract: this is not the two-type canary. + - name: Compare actual registry toolchain TypeSpec and Schema peers + uses: ORESoftware/typespec-json-schema-validator@eb669d2c2c4f0800fac54f9b5a306b550121f1ac + with: + typespec: contracts/toolchain/main.tsp + schema: contracts/toolchain/authored.schema.json + report: .typespec-json-schema-validator/toolchain/report.json + contract_ir: .typespec-json-schema-validator/toolchain/contract-ir.json + output_dir: .typespec-json-schema-validator/toolchain/generated + max_probes: "64" + + - name: Require current toolchain Contract IR and refusal regressions + uses: ORESoftware/typespec-json-schema-validator/actions/test-consumer-admission@eb669d2c2c4f0800fac54f9b5a306b550121f1ac + with: + contract_ir: .typespec-json-schema-validator/toolchain/contract-ir.json + report: .typespec-json-schema-validator/toolchain/report.json + typespec: contracts/toolchain/main.tsp + schema: contracts/toolchain/authored.schema.json + generated_schema: .typespec-json-schema-validator/toolchain/generated/typespec.generated.schema.json + expected_declarations: '["Zed.Api.ZedApiToolchainContract"]' + + - name: Preserve authored toolchain peers + run: git diff --exit-code -- contracts/toolchain/ + - name: Verify authored authorities were not modified shell: bash run: git diff --exit-code -- test/fixtures/schema-authority-canary/ From c8991f01751d1bf53de12179e3328821b6c1d4f7 Mon Sep 17 00:00:00 2001 From: "Mr. Denman Mills" Date: Thu, 8 Oct 2026 19:52:54 -0500 Subject: [PATCH 2/3] DEN-3033: align integer flag-count authority semantics without broadening --- contracts/toolchain/main.tsp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/contracts/toolchain/main.tsp b/contracts/toolchain/main.tsp index a4d19fc..90d4f12 100644 --- a/contracts/toolchain/main.tsp +++ b/contracts/toolchain/main.tsp @@ -17,7 +17,9 @@ model ZedApiToolchainContract { canonicalFlagsAuthority: true; strictUnknownOptions: true; dotenvDisabled: true; - flagCount: 36; + @minValue(36) + @maxValue(36) + flagCount: int32; requiredSecretEnvIgnored: true; legacyFlagsAuthorityPresent: false; } From ce97f49b1dd3666ff583dd39a8a15c5c35bb3882 Mon Sep 17 00:00:00 2001 From: "Mr. Denman Mills" Date: Thu, 8 Oct 2026 19:52:57 -0500 Subject: [PATCH 3/3] DEN-3033: align integer flag-count authority semantics without broadening --- contracts/toolchain/authored.schema.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contracts/toolchain/authored.schema.json b/contracts/toolchain/authored.schema.json index e76a79c..351bfa3 100644 --- a/contracts/toolchain/authored.schema.json +++ b/contracts/toolchain/authored.schema.json @@ -18,7 +18,7 @@ "canonicalFlagsAuthority": { "type": "boolean", "const": true }, "strictUnknownOptions": { "type": "boolean", "const": true }, "dotenvDisabled": { "type": "boolean", "const": true }, - "flagCount": { "type": "integer", "const": 36 }, + "flagCount": { "type": "integer", "minimum": 36, "maximum": 36 }, "requiredSecretEnvIgnored": { "type": "boolean", "const": true }, "legacyFlagsAuthorityPresent": { "type": "boolean", "const": false } },