WritSet/tabellio.validation.json at main · IntelIP/WritSet · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
{
  "schemaVersion": "tabellio-validation/v0.2",
  "id": "tabellio-product-validity",
  "failFast": false,
  "requireEntireCheckpoint": true,
  "requireRunnerIdentity": true,
  "acceptance": {
    "id": "tabellio-v0.7-provenance-and-runner-identity",
    "source": "repository product contract, docs/product-validation.md, INTB-261, INTB-279, INTB-282, and TAB-18 through TAB-29",
    "risk": "high",
    "outcomes": [
      "Agent runs, checkpoints, reviews, and validation results remain bound to exact Git state.",
      "Typed validation distinguishes passed, failed, and blocked evidence.",
      "External actions and release operations remain approval-gated and fail closed.",
      "Validation worktrees and isolated home directories remain outside the repository and Git common directory and are removed after each run.",
      "Analytics validator evidence distinguishes malformed inputs from valid contract failures.",
      "The packaged cross-repository baseline binds exact repository heads, provider snapshots, and a reproducible report.",
      "Wave admission accepts only Ready, dependency-satisfied, non-overlapping, current-base work with explicit WIP and integration ownership.",
      "Local provenance survives a PostgreSQL server restart, replays deterministically, and blocks moved candidates and weak evidence.",
      "Every new typed validation result identifies the Tabellio package version and exact runner source commit."
    ],
    "invariants": [
      "Validation never publishes, deploys, or mutates a live external system.",
      "Unknown or missing cost telemetry cannot be treated as zero.",
      "A validation run cannot select a workspace root inside the repository or Git common directory.",
      "Analytics validator summaries and artifacts never copy rejected private source text.",
      "Baseline unavailable reasons remain derived from their packaged provider snapshots.",
      "Wave admission remains deterministic and performs no external mutation.",
      "Unavailable or dirty runner source identity remains explicit and is never inferred as released."
    ],
    "forbiddenOutcomes": [
      "A stale validation result is accepted for a moved head.",
      "A blocked validator is reported as passed.",
      "An unapproved external action is executed.",
      "A validation worktree, temporary HOME, dependency cache, or generated validator output is created under .git.",
      "Malformed analytics input is reported as passed or as a valid product failure.",
      "The shipped validation manifest references baseline evidence omitted from the package.",
      "Wave admission launches tasks, mutates Plane, or accepts stale, overlapping, dependency-incomplete, or unowned work.",
      "Package metadata, runner evidence, and release identity disagree."
    ],
    "requiredValidatorTypes": ["static", "schema", "semantic", "workflow", "operational", "security"]
  },
  "validators": [
    {"id": "control-plane-static", "type": "static", "argv": ["node", "scripts/tabellio-validator.mjs", "--profile", "static"], "cwd": ".", "timeoutMs": 1200000, "required": true, "evidence": null, "policy": {"metricThresholds": [], "maxCostUsd": null, "requireCostTelemetry": false}},
    {"id": "control-plane-schema", "type": "schema", "argv": ["node", "scripts/tabellio-validator.mjs", "--profile", "schema", "--validator-id", "control-plane-schema", "--out", ".artifacts/tabellio/schema.json"], "cwd": ".", "timeoutMs": 300000, "required": true, "evidence": {"path": ".artifacts/tabellio/schema.json"}, "policy": {"metricThresholds": [{"metric": "platform_contract_pass", "operator": "eq", "value": 1}], "maxCostUsd": 0, "requireCostTelemetry": true}},
    {"id": "control-plane-semantic", "type": "semantic", "argv": ["node", "scripts/tabellio-validator.mjs", "--profile", "semantic", "--validator-id", "control-plane-semantic", "--out", ".artifacts/tabellio/semantic.json"], "cwd": ".", "timeoutMs": 300000, "required": true, "evidence": {"path": ".artifacts/tabellio/semantic.json"}, "policy": {"metricThresholds": [{"metric": "validation_contract_examples_pass", "operator": "eq", "value": 1}], "maxCostUsd": 0, "requireCostTelemetry": true}},
    {"id": "control-plane-workflow", "type": "workflow", "argv": ["node", "scripts/tabellio-validator.mjs", "--profile", "workflow", "--validator-id", "control-plane-workflow", "--out", ".artifacts/tabellio/workflow.json"], "cwd": ".", "timeoutMs": 300000, "required": true, "evidence": {"path": ".artifacts/tabellio/workflow.json"}, "policy": {"metricThresholds": [{"metric": "run_review_workflows_pass", "operator": "eq", "value": 1}], "maxCostUsd": 0, "requireCostTelemetry": true}},
    {"id": "control-plane-security", "type": "security", "argv": ["node", "scripts/tabellio-validator.mjs", "--profile", "security", "--validator-id", "control-plane-security", "--out", ".artifacts/tabellio/security.json"], "cwd": ".", "timeoutMs": 300000, "required": true, "evidence": {"path": ".artifacts/tabellio/security.json"}, "policy": {"metricThresholds": [{"metric": "external_action_policy_pass", "operator": "eq", "value": 1}], "maxCostUsd": 0, "requireCostTelemetry": true}},
    {"id": "analytics-schema", "type": "schema", "argv": ["node", "scripts/tabellio-analytics-validator.mjs", "--profile", "schema", "--validator-id", "analytics-schema", "--dataset", "reports/analytics/2026-07-28-intb-261-baseline.json", "--expected-digest", "8f8071c5797af2c38abea8d81785bff259f9f42ab347ffe535c29e3c5b7fb9d5", "--source", "reports/analytics/sources/2026-07-28-condere-provider-snapshot.json", "--source", "reports/analytics/sources/2026-07-28-probanda-provider-snapshot.json", "--source", "reports/analytics/sources/2026-07-28-tabellio-provider-snapshot.json", "--source", "reports/analytics/sources/2026-07-28-vaticor-provider-snapshot.json", "--out", ".artifacts/tabellio/analytics-schema.json", "--exit-mode", "evidence"], "cwd": ".", "timeoutMs": 300000, "required": true, "evidence": {"path": ".artifacts/tabellio/analytics-schema.json"}, "policy": {"metricThresholds": [{"metric": "analytics_validator_schema_pass", "operator": "eq", "value": 1}], "maxCostUsd": 0, "requireCostTelemetry": true}},
    {"id": "analytics-semantic", "type": "semantic", "argv": ["node", "scripts/tabellio-analytics-validator.mjs", "--profile", "semantic", "--validator-id", "analytics-semantic", "--dataset", "reports/analytics/2026-07-28-intb-261-baseline.json", "--expected-digest", "8f8071c5797af2c38abea8d81785bff259f9f42ab347ffe535c29e3c5b7fb9d5", "--source", "reports/analytics/sources/2026-07-28-condere-provider-snapshot.json", "--source", "reports/analytics/sources/2026-07-28-probanda-provider-snapshot.json", "--source", "reports/analytics/sources/2026-07-28-tabellio-provider-snapshot.json", "--source", "reports/analytics/sources/2026-07-28-vaticor-provider-snapshot.json", "--required-repository", "IntelIP/Condere", "--required-repository", "IntelIP/Probanda", "--required-repository", "IntelIP/Tabellio", "--required-repository", "IntelIP/vaticor", "--out", ".artifacts/tabellio/analytics-semantic.json", "--exit-mode", "evidence"], "cwd": ".", "timeoutMs": 300000, "required": true, "evidence": {"path": ".artifacts/tabellio/analytics-semantic.json"}, "policy": {"metricThresholds": [{"metric": "analytics_validator_semantic_pass", "operator": "eq", "value": 1}, {"metric": "analytics_repository_count", "operator": "eq", "value": 4}, {"metric": "analytics_trace_count", "operator": "eq", "value": 1}], "maxCostUsd": 0, "requireCostTelemetry": true}},
    {"id": "analytics-workflow", "type": "workflow", "argv": ["node", "scripts/tabellio-analytics-validator.mjs", "--profile", "workflow", "--validator-id", "analytics-workflow", "--dataset", "reports/analytics/2026-07-28-intb-261-baseline.json", "--expected-digest", "8f8071c5797af2c38abea8d81785bff259f9f42ab347ffe535c29e3c5b7fb9d5", "--source", "reports/analytics/sources/2026-07-28-condere-provider-snapshot.json", "--source", "reports/analytics/sources/2026-07-28-probanda-provider-snapshot.json", "--source", "reports/analytics/sources/2026-07-28-tabellio-provider-snapshot.json", "--source", "reports/analytics/sources/2026-07-28-vaticor-provider-snapshot.json", "--out", ".artifacts/tabellio/analytics-workflow.json", "--exit-mode", "evidence"], "cwd": ".", "timeoutMs": 300000, "required": true, "evidence": {"path": ".artifacts/tabellio/analytics-workflow.json"}, "policy": {"metricThresholds": [{"metric": "analytics_validator_workflow_pass", "operator": "eq", "value": 1}, {"metric": "analytics_snapshot_count", "operator": "eq", "value": 4}], "maxCostUsd": 0, "requireCostTelemetry": true}},
    {"id": "analytics-operational", "type": "operational", "argv": ["node", "scripts/tabellio-analytics-validator.mjs", "--profile", "operational", "--validator-id", "analytics-operational", "--dataset", "reports/analytics/2026-07-28-intb-261-baseline.json", "--expected-digest", "8f8071c5797af2c38abea8d81785bff259f9f42ab347ffe535c29e3c5b7fb9d5", "--out", ".artifacts/tabellio/analytics-operational.json", "--exit-mode", "evidence"], "cwd": ".", "timeoutMs": 300000, "required": true, "evidence": {"path": ".artifacts/tabellio/analytics-operational.json"}, "policy": {"metricThresholds": [{"metric": "analytics_projection_25x_duration_ms", "operator": "lte", "value": 1000}], "maxCostUsd": 0, "requireCostTelemetry": true}},
    {"id": "analytics-security", "type": "security", "argv": ["node", "scripts/tabellio-analytics-validator.mjs", "--profile", "security", "--validator-id", "analytics-security", "--dataset", "reports/analytics/2026-07-28-intb-261-baseline.json", "--expected-digest", "8f8071c5797af2c38abea8d81785bff259f9f42ab347ffe535c29e3c5b7fb9d5", "--source", "reports/analytics/sources/2026-07-28-condere-provider-snapshot.json", "--source", "reports/analytics/sources/2026-07-28-probanda-provider-snapshot.json", "--source", "reports/analytics/sources/2026-07-28-tabellio-provider-snapshot.json", "--source", "reports/analytics/sources/2026-07-28-vaticor-provider-snapshot.json", "--out", ".artifacts/tabellio/analytics-security.json", "--exit-mode", "evidence"], "cwd": ".", "timeoutMs": 300000, "required": true, "evidence": {"path": ".artifacts/tabellio/analytics-security.json"}, "policy": {"metricThresholds": [{"metric": "analytics_validator_security_pass", "operator": "eq", "value": 1}], "maxCostUsd": 0, "requireCostTelemetry": true}},
    {"id": "wave-admission-schema", "type": "schema", "argv": ["node", "scripts/tabellio-validator.mjs", "--profile", "wave-admission-schema", "--validator-id", "wave-admission-schema", "--out", ".artifacts/tabellio/wave-admission-schema.json"], "cwd": ".", "timeoutMs": 300000, "required": true, "evidence": {"path": ".artifacts/tabellio/wave-admission-schema.json"}, "policy": {"metricThresholds": [{"metric": "wave_admission_schema_pass", "operator": "eq", "value": 1}], "maxCostUsd": 0, "requireCostTelemetry": true}},
    {"id": "wave-admission-negative", "type": "semantic", "argv": ["node", "scripts/tabellio-validator.mjs", "--profile", "wave-admission-semantic", "--validator-id", "wave-admission-negative", "--out", ".artifacts/tabellio/wave-admission-negative.json"], "cwd": ".", "timeoutMs": 300000, "required": true, "evidence": {"path": ".artifacts/tabellio/wave-admission-negative.json"}, "policy": {"metricThresholds": [{"metric": "wave_admission_negative_pass", "operator": "eq", "value": 1}], "maxCostUsd": 0, "requireCostTelemetry": true}},
    {"id": "wave-admission-workflow", "type": "workflow", "argv": ["node", "scripts/tabellio-validator.mjs", "--profile", "wave-admission-workflow", "--validator-id", "wave-admission-workflow", "--out", ".artifacts/tabellio/wave-admission-workflow.json"], "cwd": ".", "timeoutMs": 300000, "required": true, "evidence": {"path": ".artifacts/tabellio/wave-admission-workflow.json"}, "policy": {"metricThresholds": [{"metric": "wave_admission_workflow_pass", "operator": "eq", "value": 1}], "maxCostUsd": 0, "requireCostTelemetry": true}},
    {"id": "wave-admission-security", "type": "security", "argv": ["node", "scripts/tabellio-validator.mjs", "--profile", "wave-admission-security", "--validator-id", "wave-admission-security", "--out", ".artifacts/tabellio/wave-admission-security.json"], "cwd": ".", "timeoutMs": 300000, "required": true, "evidence": {"path": ".artifacts/tabellio/wave-admission-security.json"}, "policy": {"metricThresholds": [{"metric": "wave_admission_security_pass", "operator": "eq", "value": 1}], "maxCostUsd": 0, "requireCostTelemetry": true}},
    {"id": "provenance-workflow", "type": "workflow", "argv": ["node", "scripts/tabellio-validator.mjs", "--profile", "provenance-workflow", "--validator-id", "provenance-workflow", "--out", ".artifacts/tabellio/provenance-workflow.json"], "cwd": ".", "timeoutMs": 300000, "required": true, "evidence": {"path": ".artifacts/tabellio/provenance-workflow.json"}, "policy": {"metricThresholds": [{"metric": "provenance_workflow_pass", "operator": "eq", "value": 1}], "maxCostUsd": 0, "requireCostTelemetry": true}}
  ]
}