svg_conform 0.2.4 → 0.2.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f1d7de294c1bcf83f963e80f3505faa12d65d90a45ec86decb82ee828e79b1e2
-  data.tar.gz: 932524562cb5d1b9a78387725ab659dd21c5f2cf964ebbbec291202f5d87c876
+  metadata.gz: f10bc419be4fc98db66f773730223b021d90914c88fd6ce7421015c5a8a2be84
+  data.tar.gz: e70f5fe9224c41bf35e02eea2fbfa8b08fac28ceb997cb58529ca6b1a521626b
 SHA512:
-  metadata.gz: 85956fa210da5c6e1282baaeddc02c44450413a9d5b5dfebdfd73d9f7534ae83ce5b0858790db2e1f1d77498dac944ba21f1f868d97fbc202cea0eb017980c36
-  data.tar.gz: 4bcddffa2c56f0ccafaf708e99bea046787c949adb0a07d58581667e421c68abcd49e8014b58e2f225078d5ea83a5d12920c8ddedc4cd6a3daedb23920a6a502
+  metadata.gz: 8706aaee4a68d144e8edd9a5bd031eb2f5b8ca75ad5796acc85a58ff10a3fde582ea47e85cc8c41463eff42a66204148429ac3297fa2aef6bc0f022ab4a7fd5d
+  data.tar.gz: 4de2cd0a001c640514e4d7622c2225cce1dad6f6849706d6b8bbe4b9cbab1a12ff8db609c1af3313c725729f51d92d047dc02da7b79af0ca0bb2e8d485151b42

data/.gitattributes

@@ -0,0 +1 @@
+data/svg_1_1/* -text

data/.github/workflows/rake.yml

@@ -14,5 +14,8 @@ on:
 jobs:
   rake:
     uses: metanorma/ci/.github/workflows/generic-rake.yml@main
+    with:
+      # tests-passed dispatch is refused on pull_request runs; releases come from push
+      cascade: ${{ github.event_name != 'pull_request' }}
     secrets:
       pat_token: ${{ secrets.GITHUB_TOKEN }}

data/Gemfile

@@ -6,9 +6,13 @@ source "https://rubygems.org"
 gemspec
 
 gem "canon", "~>0.1.10"
-gem "lutaml-model", github: "lutaml/lutaml-model", branch: "main"
-gem "moxml", github: "lutaml/moxml", branch: "main"
-gem "leptris", ">= 1.9.365.1"
+gem "leptris", ">= 1.9.399.0"
+gem "lutaml-model", "~> 0.8.155" # rubygems line; drop the git-main float
+gem "moxml", "~> 0.6.0"
+# Temporary pin on the lens_core v1 freeze candidate (claricle/lens_core#5 merge commit, after final-review fixes);
+# replace with a released gem before release.
+gem "lens_core", git: "https://github.com/claricle/lens_core.git", ref: "d00a6e8f7c0b5365a76b43e256a2f41ef9aee4ef"
+gem "nokogiri", "~> 1.16"
 gem "openssl", "~> 3.0"
 gem "rake"
 gem "rspec"

data/Gemfile.lock

@@ -0,0 +1,272 @@
+GIT
+  remote: https://github.com/claricle/lens_core.git
+  revision: d00a6e8f7c0b5365a76b43e256a2f41ef9aee4ef
+  ref: d00a6e8f7c0b5365a76b43e256a2f41ef9aee4ef
+  specs:
+    lens_core (0.1.0)
+
+PATH
+  remote: .
+  specs:
+    svg_conform (0.2.6)
+      lutaml-model (~> 0.8.155)
+      moxml (~> 0.6.0)
+      nokogiri (~> 1.16)
+      rainbow
+      table_tennis
+      thor
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    ast (2.4.3)
+    base64 (0.3.0)
+    bigdecimal (4.1.3)
+    canon (0.1.23)
+      diff-lcs
+      json
+      moxml
+      nokogiri
+      paint
+      table_tennis
+      thor
+      unicode-name
+    concurrent-ruby (1.3.8)
+    csv (3.3.7)
+    diff-lcs (1.6.2)
+    ffi (1.17.4-aarch64-linux-gnu)
+    ffi (1.17.4-aarch64-linux-musl)
+    ffi (1.17.4-arm-linux-gnu)
+    ffi (1.17.4-arm-linux-musl)
+    ffi (1.17.4-arm64-darwin)
+    ffi (1.17.4-x64-mingw-ucrt)
+    ffi (1.17.4-x86_64-darwin)
+    ffi (1.17.4-x86_64-linux-gnu)
+    ffi (1.17.4-x86_64-linux-musl)
+    json (3.1.0)
+    language_server-protocol (3.17.0.6)
+    leptris (1.9.399.0-aarch64-linux)
+      ffi (~> 1.15)
+    leptris (1.9.399.0-aarch64-linux-musl)
+      ffi (~> 1.15)
+    leptris (1.9.399.0-arm-linux)
+      ffi (~> 1.15)
+    leptris (1.9.399.0-arm-linux-musl)
+      ffi (~> 1.15)
+    leptris (1.9.399.0-arm64-darwin)
+      ffi (~> 1.15)
+    leptris (1.9.399.0-x64-mingw-ucrt)
+      ffi (~> 1.15)
+    leptris (1.9.399.0-x86_64-darwin)
+      ffi (~> 1.15)
+    leptris (1.9.399.0-x86_64-linux)
+      ffi (~> 1.15)
+    leptris (1.9.399.0-x86_64-linux-musl)
+      ffi (~> 1.15)
+    lint_roller (1.1.0)
+    liquid (5.14.0)
+      bigdecimal
+      strscan (>= 3.1.1)
+    lutaml-model (0.8.155)
+      base64 (>= 0.1.1)
+      bigdecimal
+      canon
+      concurrent-ruby
+      liquid (>= 4.0, < 6.0)
+      moxml (>= 0.5.139, < 0.7)
+      ostruct
+      rubyzip (~> 3.7)
+      thor (~> 1.4)
+    memo_wise (1.13.0)
+    moxml (0.6.1)
+    nokogiri (1.19.4-aarch64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-aarch64-linux-musl)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm-linux-musl)
+      racc (~> 1.4)
+    nokogiri (1.19.4-arm64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x64-mingw-ucrt)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-darwin)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-linux-gnu)
+      racc (~> 1.4)
+    nokogiri (1.19.4-x86_64-linux-musl)
+      racc (~> 1.4)
+    openssl (3.3.3)
+    ostruct (0.6.3)
+    paint (2.3.0)
+    parallel (2.3.0)
+    parser (3.3.12.0)
+      ast (~> 2.4.1)
+      racc
+    prism (1.9.0)
+    racc (1.8.1)
+    rainbow (3.1.1)
+    rake (13.4.2)
+    regexp_parser (2.13.1)
+    rspec (3.13.2)
+      rspec-core (~> 3.13.0)
+      rspec-expectations (~> 3.13.0)
+      rspec-mocks (~> 3.13.0)
+    rspec-core (3.13.6)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.5)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.8)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.13.0)
+    rspec-support (3.13.7)
+    rubocop (1.92.1)
+      json (>= 2.3)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.1.0)
+      parallel (>= 1.10)
+      parser (>= 3.3.0.2)
+      rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 2.11.3, < 3.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 2.4.0, < 4.0)
+    rubocop-ast (1.50.0)
+      parser (>= 3.3.7.2)
+      prism (~> 1.7)
+    rubocop-performance (1.27.0)
+      lint_roller (~> 1.1)
+      rubocop (>= 1.89.0, < 2.0)
+      rubocop-ast (>= 1.47.1, < 2.0)
+    rubocop-rake (0.7.1)
+      lint_roller (~> 1.1)
+      rubocop (>= 1.72.1)
+    rubocop-rspec (3.10.2)
+      lint_roller (~> 1.1)
+      regexp_parser (>= 2.0)
+      rubocop (~> 1.86, >= 1.86.2)
+    ruby-progressbar (1.13.0)
+    rubyzip (3.7.0)
+    strscan (3.1.8)
+    table_tennis (1.0.0)
+      csv (~> 3.3)
+      ffi (~> 1.17)
+      memo_wise (~> 1.13)
+      paint (~> 2.3)
+      unicode-display_width (~> 3.2)
+    thor (1.5.0)
+    unicode-display_width (3.3.0)
+      unicode-emoji (~> 4.3)
+    unicode-emoji (4.3.0)
+    unicode-name (1.15.1)
+      unicode-types (~> 1.12)
+    unicode-types (1.12.0)
+
+PLATFORMS
+  aarch64-linux
+  aarch64-linux-gnu
+  aarch64-linux-musl
+  arm-linux
+  arm-linux-gnu
+  arm-linux-musl
+  arm64-darwin
+  x64-mingw-ucrt
+  x86_64-darwin
+  x86_64-linux
+  x86_64-linux-gnu
+  x86_64-linux-musl
+
+DEPENDENCIES
+  canon (~> 0.1.10)
+  lens_core!
+  leptris (>= 1.9.399.0)
+  lutaml-model (~> 0.8.155)
+  moxml (~> 0.6.0)
+  nokogiri (~> 1.16)
+  openssl (~> 3.0)
+  rake
+  rspec
+  rubocop
+  rubocop-performance
+  rubocop-rake
+  rubocop-rspec
+  svg_conform!
+
+CHECKSUMS
+  ast (2.4.3) sha256=954615157c1d6a382bc27d690d973195e79db7f55e9765ac7c481c60bdb4d383
+  base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
+  bigdecimal (4.1.3) sha256=61ebe1e5e559bdc3cc6f2c0ee7f427321fc838f59611c294356eb04d6e21cf66
+  canon (0.1.23) sha256=502646c0d50cd9e17c8867d24e5808b4adb85230482ad02157f4d4f161f74cc0
+  concurrent-ruby (1.3.8) sha256=b2f1be836e968ccc78ccfce277ea79c72a88633f22306782c16ff23fb415d1e1
+  csv (3.3.7) sha256=15a3f16f6628da8664d455eb634e7f22031bcf53044923caf56975109e71b9f8
+  diff-lcs (1.6.2) sha256=9ae0d2cba7d4df3075fe8cd8602a8604993efc0dfa934cff568969efb1909962
+  ffi (1.17.4-aarch64-linux-gnu) sha256=b208f06f91ffd8f5e1193da3cae3d2ccfc27fc36fba577baf698d26d91c080df
+  ffi (1.17.4-aarch64-linux-musl) sha256=9286b7a615f2676245283aef0a0a3b475ae3aae2bb5448baace630bb77b91f39
+  ffi (1.17.4-arm-linux-gnu) sha256=d6dbddf7cb77bf955411af5f187a65b8cd378cb003c15c05697f5feee1cb1564
+  ffi (1.17.4-arm-linux-musl) sha256=9d4838ded0465bef6e2426935f6bcc93134b6616785a84ffd2a3d82bc3cf6f95
+  ffi (1.17.4-arm64-darwin) sha256=19071aaf1419251b0a46852abf960e77330a3b334d13a4ab51d58b31a937001b
+  ffi (1.17.4-x64-mingw-ucrt) sha256=f6ff9618cfccc494138bddade27aa06c74c6c7bc367a1ea1103d80c2fcb9ed35
+  ffi (1.17.4-x86_64-darwin) sha256=aa70390523cf3235096cf64962b709b4cfbd5c082a2cb2ae714eb0fe2ccda496
+  ffi (1.17.4-x86_64-linux-gnu) sha256=9d3db14c2eae074b382fa9c083fe95aec6e0a1451da249eab096c34002bc752d
+  ffi (1.17.4-x86_64-linux-musl) sha256=3fdf9888483de005f8ef8d1cf2d3b20d86626af206cbf780f6a6a12439a9c49e
+  json (3.1.0) sha256=3ce7ccf8fde58960177a3a756c31f292a4c1e1dedee884547096a5b0604e3bd8
+  language_server-protocol (3.17.0.6) sha256=5ef2c0c138f8267e1bc631d3328347d354f96724b0af22f2c79516120443b7f0
+  lens_core (0.1.0)
+  leptris (1.9.399.0-aarch64-linux) sha256=f96125c2ceb69a48c9576dbba33d20466fd27b017ab7f54041f6bf37f0d3dc78
+  leptris (1.9.399.0-aarch64-linux-musl) sha256=feede158d84c3a46ac11da49e99ba2108a0b85a3e7113e056fa33e88f1dc694f
+  leptris (1.9.399.0-arm-linux) sha256=39046099c3d16e429966a79e5d509e120ad839bb41f3a1ed8183f0174f5a22fb
+  leptris (1.9.399.0-arm-linux-musl) sha256=b7526a73a8b06843228010fc03c00c801241ca591b1504aaf09fae8a12bb7bdb
+  leptris (1.9.399.0-arm64-darwin) sha256=f2c3e513cc31026307d4a28a92d97624fdb9dc1a67ef098a9586e0e76f250097
+  leptris (1.9.399.0-x64-mingw-ucrt) sha256=b3aced983a662307e930eed3d408d844b82d947d63f80dc6e4c48fec962d6a7b
+  leptris (1.9.399.0-x86_64-darwin) sha256=428c84f7c2e763bc2db614b1cafb49792852cd781d2c353e27206bf4aea3ce1c
+  leptris (1.9.399.0-x86_64-linux) sha256=ae235c244456b8949920d10c21bf9d8f01cf05fb6900c41bc2ef2531e01e86a8
+  leptris (1.9.399.0-x86_64-linux-musl) sha256=f7cf698c4858e132a19bf00667587ad96add7c35b3c629cbe97fdb20ef8099ce
+  lint_roller (1.1.0) sha256=2c0c845b632a7d172cb849cc90c1bce937a28c5c8ccccb50dfd46a485003cc87
+  liquid (5.14.0) sha256=e1020c2b2ee58c7a4d3bfdc7a331537bd27a783353748bff0bf27c6ac0c17065
+  lutaml-model (0.8.155) sha256=3d90f2fb4fdf41a42d4a05b62b3f6644b433070b82291a9371deaa8e68a1e02d
+  memo_wise (1.13.0) sha256=30220c38c4cef410849bc73553c58664dc2c91c6379e4a1df22aea02358b716b
+  moxml (0.6.1) sha256=5b7677258bbad372f0725a421f8adeae37b65d6f7871da2747e2c1906cdac7ea
+  nokogiri (1.19.4-aarch64-linux-gnu) sha256=1269fb644a6de405057a53dd5c762b1209b43ca7424f839454d3dbc677c31a8f
+  nokogiri (1.19.4-aarch64-linux-musl) sha256=35c65b9ce72b3bb03207bdbe7067915019dc18c1b9b59139684bd6690fdd01af
+  nokogiri (1.19.4-arm-linux-gnu) sha256=a301313e38bb065d68239e79734bcd6f56fb6efaacebde29e9abf2a4735340ca
+  nokogiri (1.19.4-arm-linux-musl) sha256=588923c101bcfa78869734d247d25b598674323e7f22474fc468f6e5647311eb
+  nokogiri (1.19.4-arm64-darwin) sha256=a46db9853286e6597b36ebc6953817d15acf3a299583eb3f89fdc6f91dd63527
+  nokogiri (1.19.4-x64-mingw-ucrt) sha256=051da97b8eccfdb5444fed40246a35e10d7298b9efe759b4cd25455ea04c587e
+  nokogiri (1.19.4-x86_64-darwin) sha256=7fd17057d3e1f00e9954a74b3cd76595d3d4a5ef233b7ed9599047c204f70551
+  nokogiri (1.19.4-x86_64-linux-gnu) sha256=379fae440b28915e3f19d752ce2dcf8465ed2b2fbefd2a7ca0dd497bc981a06a
+  nokogiri (1.19.4-x86_64-linux-musl) sha256=17dfb7c1fa194ae02fbf7c51a7afc8d278045ab3fdacfd86f91d02d7b274470b
+  openssl (3.3.3) sha256=d46902138f2987c13122fab826030a11c2bb9b8a16394215cbfc5062c5e2d335
+  ostruct (0.6.3) sha256=95a2ed4a4bd1d190784e666b47b2d3f078e4a9efda2fccf18f84ddc6538ed912
+  paint (2.3.0) sha256=327d623e4038619d5bd99ae5db07973859cd78400c7f0329eea283cef8e83be5
+  parallel (2.3.0) sha256=f75a3e904101ce6a1ccb6b8dc800cbafd42166d83330192438dcf29395167a6f
+  parser (3.3.12.0) sha256=21a6d7f755d5a24dfbdc6e6b772e4e879a52e7631a88bc5a3a134606052c9828
+  prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
+  racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
+  rainbow (3.1.1) sha256=039491aa3a89f42efa1d6dec2fc4e62ede96eb6acd95e52f1ad581182b79bc6a
+  rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701
+  regexp_parser (2.13.1) sha256=5aedb6b7c35688f51e86eef17a15374dfd287c83f4ca644b2c5f3ec50a33b44b
+  rspec (3.13.2) sha256=206284a08ad798e61f86d7ca3e376718d52c0bc944626b2349266f239f820587
+  rspec-core (3.13.6) sha256=a8823c6411667b60a8bca135364351dda34cd55e44ff94c4be4633b37d828b2d
+  rspec-expectations (3.13.5) sha256=33a4d3a1d95060aea4c94e9f237030a8f9eae5615e9bd85718fe3a09e4b58836
+  rspec-mocks (3.13.8) sha256=086ad3d3d17533f4237643de0b5c42f04b66348c28bf6b9c2d3f4a3b01af1d47
+  rspec-support (3.13.7) sha256=0640e5570872aafefd79867901deeeeb40b0c9875a36b983d85f54fb7381c47c
+  rubocop (1.92.1) sha256=a905381a5344215a79abcfe80f6c94366447e6a55347c9a525b5a24990e33f62
+  rubocop-ast (1.50.0) sha256=b9ca88300da0803ee222ad20cdb30494c0a784eed06fdc35d254b06d662788db
+  rubocop-performance (1.27.0) sha256=eeeb1374d062a368ee1c787b70eb0b0cc4b184cb1f8565f424760946146d61ce
+  rubocop-rake (0.7.1) sha256=3797f2b6810c3e9df7376c26d5f44f3475eda59eb1adc38e6f62ecf027cbae4d
+  rubocop-rspec (3.10.2) sha256=0b3e2ecc592cd10ecbf0095bb58d1e357905276e069643523cc19eb7495f65e2
+  ruby-progressbar (1.13.0) sha256=80fc9c47a9b640d6834e0dc7b3c94c9df37f08cb072b7761e4a71e22cff29b33
+  rubyzip (3.7.0) sha256=65c19294da75297a939006f3516deacc33185fbd721ff1954f7a231db6d3e121
+  strscan (3.1.8) sha256=aae2db611a225559f21ffbb71765c9a4e60fd262534a9ea84f4f11c7f32f679e
+  svg_conform (0.2.6)
+  table_tennis (1.0.0) sha256=955f76ca4debd42ee88682af8d4554a74d533c89de4f1581bc37855b15faa956
+  thor (1.5.0) sha256=e3a9e55fe857e44859ce104a84675ab6e8cd59c650a49106a05f55f136425e73
+  unicode-display_width (3.3.0) sha256=4b7aa66a4b11db50f6f7e98411215cd0dd10eaecb665d36eec5bcacb3fa0b613
+  unicode-emoji (4.3.0) sha256=11c02fa73290378c066bb0562cd4c87d8e1b706fbbe0059ca12746a4244de8ce
+  unicode-name (1.15.1) sha256=b8f2e3ca14bc24799f84a4f74d43a3612d02a051700d88bc6ca8e3bd53cda3f6
+  unicode-types (1.12.0) sha256=7e26a4352cecc2a50325a3793df834b732581ca9f25c5e29f46f3378934363f6
+
+BUNDLED WITH
+   2.7.2

data/TODO.issue-100/00-overview.md

@@ -0,0 +1,135 @@
+# Issue 100 — Spec-version profiles and shared lens diagnostics
+
+## Outcome
+
+Ship a versioned, zero-runtime-dependency `LensCore` diagnostics contract, make
+`svg_conform` emit that contract without breaking its transitional interfaces,
+and add two opt-in, corpus-backed profiles:
+
+- SVG 1.1 Full in static processing mode.
+- SVG 2 in secure static processing mode.
+
+The work ends with a pinned LensCore candidate and an observable adoption
+handoff. Publishing a LensCore gem and migrating other lens repositories are
+follow-on work, not part of this issue.
+
+## Current state
+
+- `svg_conform` defines diagnostics in several places. `ValidationContext` and
+  `ErrorTracker` collect `infos`, but `ValidationResult`,
+  `ConformanceReport`, and the `check` command project only errors and warnings.
+- `ValidationResult#to_h` and `#to_text`, Lutaml-backed
+  `ConformanceReport`, CLI JSON/YAML/table output, and the svgcheck compatibility
+  path do not share one canonical report object.
+- Profiles are Lutaml models loaded from `config/profiles/*.yml`; requirements
+  are registered independently in `lib/svg_conform/profile.rb`,
+  `lib/svg_conform/profile_compiler.rb`, and
+  `lib/svg_conform/requirements.rb`.
+- Validation supports DOM and SAX requirement hooks, with SAX as the normal
+  validation path. The current profiles describe project policies, not complete
+  SVG 1.1 Full or SVG 2 secure-static conformance.
+- `SvgConform::References::ReferenceClassifier.classify` already returns typed
+  internal-fragment, data-URI, URN, external-URL, and relative-path references.
+  `LinkValidationRequirement` consumes that API. Data URIs currently expose
+  their media type but are not decoded or syntax-checked.
+- The repository has no committed `Gemfile.lock` and no LensCore dependency.
+
+## Target design
+
+### One diagnostics contract
+
+The new `claricle/lens_core` repository owns schema version `1`, Ruby value
+objects, JSON/YAML parsers, and JSON/YAML/human renderers. A report carries its
+schema version, producer, profile identity, validity, summary counts, and an
+ordered diagnostics collection. A diagnostic has a stable severity, extensible
+kind, stable requirement ID, message, optional citations/remediation/context,
+and an optional typed location that can represent XML coordinates or binary
+offsets/records.
+
+`svg_conform` constructs that report once. Existing hashes, text/table output,
+`ConformanceReport`, and svgcheck-compatible output become projections or
+adapters over it for one transition. The adapter preserves all four existing
+channels: errors, validity errors, warnings, and infos.
+
+### Profiles as explicit requirement matrices
+
+Each profile has stable requirement IDs, normative citations, expected failure
+behavior, DOM/SAX coverage, focused fixtures, and documentation. SVG 1.1 Full
+uses the pinned 2011 Recommendation and its flat DTD, plus the Recommendation's
+Appendix G.2 handling and referenced CSS/XML-stylesheet rules. SVG 2 uses the
+pinned Candidate Recommendation and enforces secure-static processing,
+including its external-resource boundary.
+
+The profiles are additive and opt-in. Existing profile behavior and the default
+profile do not change.
+
+## Work sequence
+
+| Card | Work item | Depends on | Effort |
+| --- | --- | --- | --- |
+| 01 | Build LensCore diagnostics v1 | — | 4–7 person-days |
+| 02 | Adopt LensCore in svg_conform | 01 | 3–5 person-days |
+| 03 | Ship SVG 1.1 Full/static | 02 | 8–12 person-days |
+| 04 | Ship SVG 2 secure-static | 02, 03 shared processing/source plumbing | 4–6 person-days |
+| 05 | Freeze the candidate and adoption handoff | 01–04 | 2–4 person-days |
+
+Overall estimate: **21–34 person-days**. The range includes implementation,
+focused tests, fixtures, documentation, and integration fixes. It excludes gem
+publication, work in other lens repositories, and external review latency.
+Confidence is medium: the largest uncertainty is whether the existing XML stack
+can perform offline SVG 1.1 DTD validation without another runtime dependency;
+Card 03 resolves that with a bounded spike before implementation proceeds.
+
+## Acceptance map
+
+| Issue acceptance criterion | Planned evidence |
+| --- | --- |
+| SVG 1.1 and SVG 2 profiles ship, are documented, and each has a corpus | Cards 03 and 04 profile specs, focused fixture directories, CLI checks, and profile documentation |
+| The diagnostics model is extracted, versioned, and shaped for reuse by other lenses | Cards 01 and 02 schema/model/renderer specs plus XML and binary location examples |
+| A diagnostics JSON round-trip corpus is pinned | Card 05 byte-stable parse/render goldens tied to exact LensCore and svg_conform commits |
+| Other lenses can adopt the shape without SVG code | Card 05 host-only check and handoff manifest; actual EMF/PNG/PostScript migrations remain separate issues |
+
+## Scope boundaries
+
+Included:
+
+- LensCore schema/model/parser/renderer v1 and its zero-runtime-dependency gem.
+- The svg_conform adapter and transitional aliases.
+- SVG 1.1 Full/static and SVG 2 secure-static profiles.
+- A pinned JSON corpus and cross-repository adoption handoff.
+
+Excluded:
+
+- EMF, PNG, or PostScript implementation, fixtures, dependency changes, and
+  releases.
+- Publishing LensCore or replacing its temporary Git pin with a released gem.
+- SVG 1.1 Tiny/Basic profiles. They are a future sibling profile of
+  `svg_1_1_full_static`, to be added once the SVG 1.1 Mobile Profiles
+  specification is available as reference material; the repository's available
+  Tiny reference is for SVG Tiny 1.2.
+- Complete SVG 2 document/rendering conformance beyond secure-static processing.
+- Profile inheritance or a redesign of existing profile discovery.
+- Full-suite, full-corpus, or fuzz testing for this issue.
+
+## Normative sources
+
+- SVG 1.1 Second Edition Recommendation:
+  <https://www.w3.org/TR/2011/REC-SVG11-20110816/>
+- SVG 1.1 conformance criteria:
+  <https://www.w3.org/TR/2011/REC-SVG11-20110816/conform.html#ConformingSVGDocuments>
+- SVG 1.1 flat DTD:
+  <https://www.w3.org/Graphics/SVG/1.1/DTD/svg11-flat-20110816.dtd>
+- CSS 2 core grammar referenced by SVG 1.1:
+  <https://www.w3.org/TR/2008/REC-CSS2-20080411/grammar.html>
+- Associating Style Sheets with XML 1.0:
+  <https://www.w3.org/TR/1999/REC-xml-stylesheet-19990629/>
+- SVG 2 Candidate Recommendation snapshot:
+  <https://www.w3.org/TR/2026/CR-SVG2-20261006/>
+- SVG 2 secure-static processing mode:
+  <https://www.w3.org/TR/2026/CR-SVG2-20261006/conform.html#secure-static-mode>
+
+## Verification policy
+
+Each card names only focused specs, fixture checks, lint, and build commands.
+No card requires a full test suite, a corpus sweep, or fuzzing. Commands are run
+in the repository named by the card.

data/TODO.issue-100/01-build-lens-core-v1.md

@@ -0,0 +1,92 @@
+# 01 — Build LensCore diagnostics v1
+
+Effort: **4–7 person-days**
+
+Repository: `claricle/lens_core` (new)
+
+## Purpose
+
+Create the independent, zero-runtime-dependency gem that owns the shared
+diagnostics wire format and all of its renderers. It must be useful without
+loading svg_conform or any document-format implementation.
+
+## Contract
+
+Schema version `1` defines these public concepts:
+
+- `LensCore::Report`: `schema_version`, producer name/version, profile ID and
+  citations, validity, summary counts, ordered diagnostics, and an optional
+  caller-supplied timestamp.
+- `LensCore::Diagnostic`: severity (`error`, `warning`, or `info`), extensible
+  kind, stable requirement ID, message, citations, optional remediation,
+  JSON-safe context, and optional location.
+- `LensCore::Citation`: required absolute `uri` and optional human label.
+- `LensCore::Location`: an explicit location type plus applicable fields. XML
+  locations can carry line, column, and path; binary locations can carry byte
+  offset, byte length, record index, and record type. Absent coordinates are
+  omitted rather than populated with invented zeroes.
+
+The schema rejects an unsupported major schema version but permits new
+diagnostic `kind` values and unknown additive object members so compatible v1
+producers can evolve. Parsers return stable LensCore error classes for malformed
+JSON/YAML, unsupported versions, schema violations, unsafe YAML tags, and
+non-UTF-8 text.
+
+Rendering rules are deterministic: diagnostic input order is preserved,
+standard object keys follow schema order, extension keys are lexical, summary
+counts are derived from diagnostics, and timestamps appear only when supplied.
+JSON parsing followed by JSON rendering is byte-stable for canonical inputs.
+
+## Files and implementation
+
+- Add `lens_core.gemspec`, `Gemfile`, `Rakefile`, and `lib/lens_core.rb`. The
+  gemspec has no runtime dependencies; implementation uses Ruby's JSON, YAML,
+  and time facilities.
+- Add value objects in:
+  - `lib/lens_core/report.rb`
+  - `lib/lens_core/diagnostic.rb`
+  - `lib/lens_core/citation.rb`
+  - `lib/lens_core/location.rb`
+- Add `lib/lens_core/parsers/json.rb` and `yaml.rb`, and matching renderers in
+  `lib/lens_core/renderers/json.rb`, `yaml.rb`, and `human.rb`. Keep validation
+  and canonicalization shared rather than reimplemented in each format.
+- Add the normative machine-readable schema at
+  `schemas/lens-diagnostics-v1.json` and document field semantics, compatibility
+  rules, omission/null behavior, ordering, UTF-8 handling, and failure classes
+  in `docs/diagnostics-v1.adoc`.
+- Add `spec/lens_core/report_spec.rb`, `spec/lens_core/parsers_spec.rb`,
+  `spec/lens_core/renderers_spec.rb`, and `spec/lens_core/schema_spec.rb`, with
+  small fixtures under `spec/fixtures/v1/`. Include XML-location and
+  binary-location reports to prove the contract is not SVG-shaped; these are
+  format-neutral examples, not claims that another lens has adopted the gem.
+
+Keep the Ruby model and JSON Schema at independently readable version constants,
+so a host can report both the gem version and schema version. Do not add SVG
+names, SVG requirement IDs, or dependencies on a lens repository.
+
+## Done when
+
+- The gem builds with zero runtime dependencies and can be required in a clean
+  Ruby process.
+- Schema-valid JSON and safe YAML parse to the same report model; JSON, YAML,
+  and human renderers all include errors, warnings, and infos.
+- Canonical JSON fixtures round-trip byte-for-byte, while malformed, unsafe,
+  non-UTF-8, and unsupported-version fixtures fail with documented LensCore
+  errors.
+- XML and binary fixture locations survive parse/render without losing present
+  coordinates or manufacturing absent ones.
+- The schema, Ruby model, and documentation agree on required fields,
+  compatibility behavior, ordering, timestamp handling, and omission rules.
+- All changed Ruby passes the repository linter and the gem artifact builds.
+
+```sh
+bundle install
+bundle exec rspec spec/lens_core/report_spec.rb spec/lens_core/parsers_spec.rb spec/lens_core/renderers_spec.rb spec/lens_core/schema_spec.rb
+bundle exec rubocop
+bundle exec rake build
+```
+
+## Status
+
+State: done
+PR: https://github.com/claricle/lens_core/pull/1

data/TODO.issue-100/02-adopt-lens-core-in-svg.md

@@ -0,0 +1,123 @@
+# 02 — Adopt LensCore in svg_conform
+
+Effort: **3–5 person-days**
+
+Repository: `claricle/svg_conform`
+
+Depends on: Card 01
+
+## Purpose
+
+Make one `LensCore::Report` the canonical representation of an svg_conform
+validation result while preserving the current public and svgcheck-compatible
+surfaces for one transition.
+
+## Dependency and load boundary
+
+- Add LensCore to `Gemfile` with the HTTPS Git repository and the exact Card 01
+  candidate commit. Generate and commit `Gemfile.lock`; assert that its LensCore
+  revision equals the handoff commit.
+- Do not add an unreleased Git dependency or Bundler-only options to
+  `svg_conform.gemspec`. Replacing the temporary Git pin with a released gem
+  requirement belongs to the later release work.
+- Load LensCore from `lib/svg_conform.rb` and expose the adapter without making
+  LensCore depend on svg_conform.
+
+## Canonical mapping
+
+Add `SvgConform::Diagnostics::LensCoreAdapter` at
+`lib/svg_conform/diagnostics/lens_core_adapter.rb` with one entry point:
+
+```ruby
+SvgConform::Diagnostics::LensCoreAdapter.call(
+  validation_result,
+  filename: nil,
+  timestamp: nil
+)
+```
+
+The adapter maps:
+
+| svg_conform source | LensCore severity | LensCore kind |
+| --- | --- | --- |
+| `errors` | `error` | the issue's violation type, falling back to `validation` |
+| `validity_errors` | `error` | `validity` |
+| `warnings` | `warning` | the issue's violation type, falling back to `validation` |
+| `infos` | `info` | the issue's violation type, falling back to `notice` |
+
+It preserves the source collection order within those channels, maps explicit
+requirement IDs without generating new IDs from messages, includes available
+line/column/element-path data, carries remediation fields already exposed by
+`ValidationIssue`, and converts issue data to JSON-safe primitives. An
+unsupported object in context fails at the adapter boundary with a stable error
+rather than leaking Ruby object inspection into JSON.
+
+Add profile-level `specification_uri`/`specification_label` to `Profile` in
+`lib/svg_conform/profile.rb`, and requirement-level
+`citation_uri`/`citation_label` to `BaseRequirement` in
+`lib/svg_conform/requirements/base_requirement.rb`; map both pairs in their
+Lutaml YAML definitions. The adapter turns them into LensCore citations.
+Existing profiles may omit them; the two new profiles may not.
+
+## Public and transitional surfaces
+
+- Extend `ValidationResult` with `infos`, `info_count`, and
+  `to_lens_core_report(timestamp: nil)`. Include infos and validity errors in
+  counts/projections without changing `valid?`: only errors and validity errors
+  make a result invalid.
+- Make `ValidationResult#to_h`, `#to_json`, and text output project the canonical
+  report. Keep their current call signatures and retain file/reference/fix data
+  as documented compatibility extensions.
+- Back `ConformanceReport.from_svg_conform_result` with the same report and keep
+  its current class, factory signature, and YAML shape as a deprecated legacy
+  projection. Preserve the `use_svgcheck_mapping:` adapter and
+  `from_svgcheck_result`; svgcheck filtering happens after canonical report
+  construction and does not mutate the canonical report.
+- Route `lib/svg_conform/commands/check.rb` JSON, YAML, and table output through
+  LensCore renderers. The accepted CLI value `table` remains an alias for the
+  human renderer for compatibility.
+- Extend `ValidationContext#add_notice`,
+  `ValidationContext#add_external_reference_notice`, and
+  `Validation::ErrorTracker#add_notice` to accept an optional explicit
+  requirement ID while preserving existing calls. Store it on the existing
+  `Errors::ValidationIssue` used by the info channel. Requirements pass their
+  own stable ID so infos no longer fall back to `unknown`.
+
+Document the v1 API and transition in the proposed `docs/diagnostics.adoc`, and
+update the existing `docs/api_reference.adoc` and `docs/cli_guide.adoc`. Add
+focused specs at `spec/svg_conform/diagnostics/lens_core_adapter_spec.rb`,
+`spec/svg_conform/validation_result_spec.rb`,
+`spec/svg_conform/conformance_report_spec.rb`, and the existing command/context
+spec paths used below. Add
+`spec/fixtures/diagnostics/external-reference-info.svg` so the library and CLI
+assertions use a small SVG that emits an ordinary informational external
+reference notice without depending on later profile fixtures.
+
+## Done when
+
+- `Gemfile.lock` pins the exact LensCore candidate commit, while the gemspec has
+  no unreleased LensCore dependency.
+- One validation result containing an error, validity error, warning, and info
+  produces one schema-valid report with correct validity and per-channel
+  summary counts.
+- The library's JSON/YAML/human paths and the ordinary `check` command render
+  from that report and preserve the informational diagnostic.
+- Existing `ValidationResult`, `ConformanceReport`, table-output, and svgcheck
+  factory call signatures remain callable and are covered by compatibility
+  specs.
+- Profile and requirement citations survive YAML loading and appear in the
+  canonical report; JSON-unsafe issue context fails deterministically.
+- All changed Ruby passes the repository linter and the gem builds.
+
+```sh
+bundle install
+bundle exec rspec spec/svg_conform/diagnostics/lens_core_adapter_spec.rb spec/svg_conform/validation_result_spec.rb spec/svg_conform/conformance_report_spec.rb spec/svg_conform/validation_context_spec.rb spec/svg_conform/commands/check_command_spec.rb
+bundle exec svg_conform check spec/fixtures/diagnostics/external-reference-info.svg --profile svg_1_2_rfc --format json
+bundle exec rubocop
+bundle exec rake build
+```
+
+## Status
+
+State: done
+PR: https://github.com/claricle/svg_conform/pull/103