@am_shork/attest 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -13,6 +13,141 @@ input, removes/renames a public API or `--json` field, or changes a default
 runtime behavior an existing invocation relies on — diagnostic message text is
 not API.
 
+## [0.7.1] - 2026-08-05
+
+### Added
+
+- **`params` takes any JSON value, and the constraint moved to the place it was
+  actually protecting.** A param was a scalar or a list of scalars. The argument
+  for admitting lists — the values most likely to drift are the composite ones,
+  and rejecting them left exactly those outside the one mechanism built to pin
+  them — does not stop at a list: a `kind -> payload` table drifts harder than a
+  flat list of names, and it was the one shape still excluded. `null` comes with
+  it, because refusing it forces a sentinel (`''`, `-1`) that means something
+  else to every later reader.
+  What the old union was defending was not the registry but the **rendering**:
+  `{payloadKinds}` interpolated into a statement as `[object Object]`, in a
+  document reviewers and audit read as the system's promise. That is a property
+  of the interpolation point, so it is stated there — a new
+  **`non-scalar-interpolation`** ERROR from `check` and `verify`. Narrower and
+  truer: it refuses what actually breaks and admits the data a scenario reads,
+  which the schema rule could not tell apart. What the schema keeps is what does
+  not survive being written down — a function, a `Date`, a class instance, an
+  object whose prototype was swapped.
+  *The part that is not a schema edit.* Depth. Four obligations had exactly one
+  level of reach, which is correct only while a param cannot nest, and none of
+  them fails loudly: the canonical form behind `add-conflict` (an identical copy
+  written with its inner keys in another order would have conflicted with
+  itself), the ATX-58 control-character stripping (nested strings would have
+  gone unsanitised, reopening the hole `[0.7.0]` closed), the key order behind a
+  byte-stable rendering, and `splice.ts`, which writes a requirement back out as
+  TypeScript source and would have committed `[object Object]` into a
+  `*.reqs.ts` through `archive --apply`. Three of the four are ordering, and are
+  now one shared `sortDeep` in `order.ts` rather than three sorts a level deep —
+  they wanted the same guarantee for the same reason, which is what makes it one
+  function and not a helper each.
+  *Two divergences between the readers, which is what the differential suite is
+  for.* `null` is a keyword rather than a literal node, so the AST reader fell
+  off the end of `literalValue` and reported `registry-not-static` for the whole
+  file while the evaluating reader accepted it. And `{ __proto__: … }` swaps the
+  prototype instead of creating a key, so `z.record` copies own keys into a fresh
+  object and the taint is invisible one step later — the static reader refuses
+  that source at any depth, and the schema now refuses the object the evaluator
+  builds from it, both spellings (a literal `__proto__:` and the own key
+  `JSON.parse` produces).
+  *Rendering.* A structured param gets a fenced JSON block below the params
+  table, keys sorted at every depth (ATX-10: the same registry renders the same
+  bytes) with the fence measured against backtick runs in the value, as `code()`
+  already did. It is below the table rather than in it because a fence cannot
+  live in a table cell. And `render` defends the document on its own: it reads
+  the registry with no spec parse, so no `AttestPlan` and no `validateStructure`
+  — `attest render` runs to completion on a registry `check` refuses. Leaning on
+  the diagnostic would have left the document defended by a command nobody is
+  obliged to run first.
+  *The writing side of the `__proto__` rule.* `splice.ts` turns a requirement
+  back into TypeScript source for `--apply`, and it is the only site that does.
+  Extending it to depth meant it would have emitted a `__proto__` key as a bare
+  property — text whose *evaluation* swaps a prototype rather than being the
+  value it was handed. Unreachable through any command (the schema rejects a
+  nested `__proto__` and `z.record` drops a top-level one), and refused anyway
+  with a new `UnwritableValue`, reported as `internal-error` by the merge with
+  its account of what it had already written intact. Quoting is not the repair —
+  a quoted `__proto__` swaps the prototype in a literal exactly as the bare form
+  does, and the bracketed form that would create an own property is a computed
+  key no static reader will read. The reader's guard is worth nothing if the
+  writer can produce the file it exists to refuse.
+  *Not breaking, with one edge worth naming.* No previously-green registry goes
+  red — a structured param was `registry-invalid` before, so nothing that
+  compiled and passed now fails — and an all-scalar registry renders
+  byte-identical, so a committed `render --check` stays green across the
+  upgrade. What did widen is the exported type in a **read** position:
+  `Requirement['params'][string]` is now the recursive JSON value. The const
+  generic is untouched, so `reqs['AUTH-3'].params.idleTimeoutMin` is still the
+  literal `30` and every anti-drift test keeps its narrow type. A consumer only
+  notices if they assign an *undeclared* key to the old scalar-or-list union
+  (`Type 'null' is not assignable`), or wrote their own handler over that type
+  and does `String(v)` in it — which is the `[object Object]` defect this entry
+  fixes in `render` and `splice`, seen from outside.
+  *This overturns a standing rejection, and not on its stated terms.* *Nested
+  objects in `params`* sat under **Considered and rejected** since `[0.4.2]`,
+  raised by `mine-capablanca`, and that entry is removed by this release. Its
+  argument was that a param has two properties a table lacks: rendered as a value
+  a human checks at a glance, and read by a scenario as the one place the value
+  lives. The first is answered rather than waived — `non-scalar-interpolation`
+  keeps a table out of the *sentence*, so what a reader takes in at a glance is
+  still glance-sized, and the table is rendered below it as a block. The second
+  is answered by the criterion that admitted arrays in the first place: a
+  `kind -> payload` table drifts *harder* than a flat list, so the reason arrays
+  were let in is the reason this shape should have been.
+  **The reopening condition it named was never met, and that is worth stating
+  plainly.** The entry said it reopens on "a report where the value is genuinely
+  promised — a table an adopter owes their users"; none has been seen. This
+  shipped on the strength of the argument alone. What changed is the recognition
+  that the schema was answering the wrong question: *params for promises, plain
+  constants for tuning* is the rule, and a type can only ever check shape, so it
+  refused a promised table while admitting a list of tuning knobs. Design §11
+  now carries that as a judgement rather than a type, which is the permanent half
+  — and it is weaker than what it replaces, because nothing enforces a judgement.
+  New requirements: `ATX-7` rewritten, `ATX-63` added.
+
+### Changed
+
+- **Rationale that only a comment held now has a design section, and the comment
+  cites it.** Measured over the diffs in three eras split at `[0.3.0]` and
+  `[0.5.0]`: comment blocks got better by every specificity signal — naming a
+  symbol 50 → 60%, a measured number 3 → 13%, a causal argument 26 → 54% — and
+  roughly doubled per line of code, while the share citing a `§` went 15 → 12 →
+  11% and the design document stopped growing (sixteen sections since `[0.3.0]`,
+  105 lines against `src/`'s 2,862). **The anchoring did not fall; it never
+  scaled**, and a `§` is the only part of a comment any gate reads.
+  Nineteen blocks written since `[0.5.0]` carried the cost — ten lines or more,
+  fully argued, unanchored — and they split three ways. *Six were properties a
+  rewrite would have to preserve*, and now sit in the document: a new **§9.1**
+  for the artifacts Attest writes, an extension to **§8** (`--apply` acts on this
+  run's verdict), and one to **§5.4** (the two readers of one plan must descend
+  the same way). *Four were history* — a quadratic backtrack, a 27–84x constant
+  factor, a 47 MiB peak, an indexing cost filed as invisible — and were
+  compressed to the invariant a maintainer would otherwise re-break; every
+  measurement in them was already under `[0.7.0]`, so this deleted duplicates
+  rather than moving anything. *Ten were correct as they stood and were left
+  alone*, which is the half worth naming: `§` is low because the design document
+  stalled, not because comments are too long, so a pass that shortened comments
+  and left it at one in nine would have moved the wrong quantity and called it
+  done. Net `src/`: 29 lines removed, all of them comments and no code touched,
+  which is also how the deletion was checked.
+  **One of the six corrected the document rather than extending it.** §8
+  summarised a merge as renaming a proposed spec "in place", which is true of its
+  location and not of its imports — the delta it reads its proposed params from
+  is what moves to `archive/`, so the sentence hid the one specifier the merge
+  has to repoint.
+  *What the measurement cost.* A first pass reported the `§` share as halving,
+  25 → 12%, an artefact of bucketing by `git blame` over the current tree: that
+  sees only surviving lines, and `§`-citing comments survive better, being tied
+  to sections that do not move, so the early era was measured on its most durable
+  residue. Re-measuring from the diffs before building is what caught it.
+  The routing test this produced is in `pre-commit-check` §6, and the obligation
+  a new diagnostic code owes the CLI reference is now in §2.
+
 ## [0.7.0] - 2026-08-04
 
 ### Added
@@ -3022,82 +3157,26 @@ feedback reports are triaged into issues or `Unreleased` and deliberately not
 kept in this tree; that rule stands, and holds for anything with a reporter, a
 repro, or a state to track. What is kept here is the narrower thing this file
 already keeps one section of: a **decision with an argument attached**, where
-losing the argument would cost more than losing the task. The one entry left
-below came out of reading another repository against this one — `msw`.
-
-Eleven entries have left by being built: three together in `[0.6.0]`, and six
-under `[0.7.0]` — the verdict predicates, the nested `describe`, the runner
-the static commands loaded and could not start, the diagnosis for a spec file
-that failed to load, the six comments describing a property the code lacked, and
-the sketches now bound to the files they name — which are the first to leave by
-being **read** rather than by being reported or gated. The last of those left
-from `Under consideration` rather than from here, which is the move this file
-describes as going up before going out, and it went up on the strength of one
-thing: of its three candidates, exactly one could be measured against instances
-that had already happened.
-The second of those left *partially*: one of its three parts came back here as an
-entry of its own, because implementing the other two showed the estimate on it
-was wrong. An entry leaving is not evidence that all of it shipped, and this is
-the first time that has mattered. That returned part has now shipped as well, and
-it closed the way it said it would: the estimate was wrong because the fix was a
-new `Issue` code rather than a suppression, and what made it so was a decision
-recorded three lines from where the suppression would have gone. **The thing that
-cost the most was the thing already written down** — which is an argument for
-this section, since the note that corrected the estimate survived only because
-someone had filed the reasoning next to the code.
-`compiler-unsupported` came from building something queued here,
-which is one way an entry arrives: a gate that finds a defect on its first run
-files the defect, and the `typescript` matrix `[0.4.2]` added is what found this
-one.
-`--apply` came from an adoption report (`mine-capablanca`, 0.4.2, 34 requirements
-/ 56 scenarios / greenfield) — a third way an entry arrives: not a defect, but a
-shape the tool made an adopter work around eight times without ever erroring. It
-took `spec-in-change-dir` out with it, by a fourth way worth naming: designing one
-of `--apply`'s checks surfaced a different one, against a migration this file had
-itself shipped. **What a release costs its adopters is not fully known on the day
-it is cut** — and building the entry is what finds out, which is also how
-`--apply` discovered that one clause of its own argument here was wrong. Both are
-recorded under `[0.6.0]`, and two earlier entries from the same report left
-by shipping in `[0.5.0]` — a change's specs moving to their merged location, and
-the delta reading as the registry of what it adds — their arguments recorded
-there, including the part of the first one that turned out to be wrong.
-The entries added after `[0.6.0]` arrived a **fifth** way, and it is the
-one with no external input at all: a strict read of `src/` with nothing failing.
-Every gate in this repository was green while all three were true, which is the
-whole of what that way is for — a defect no test is shaped to ask about is
-reachable only by someone reading for it. **All three have now shipped under
-`[0.7.0]`**, and each closed having found something a strict read is
-apparently good for and a gate is not. The runner one: the gate that would have
-had to catch it *already* looked for the shape, so what the read bought was not a
-missing gate but a cost nobody had priced. The load-failure diagnosis: every gate
-was green because the report was *complete* — three ERRORs on a red run — and
-what was wrong was which three, a judgement no assertion in this repository is
-shaped to make. The third, eight items under one heading: six comments naming a
-property the code lacked and two costs beside them.
-
-**One entry has now left this section the other way — by being rejected** — and
-it is the first, which is why it is worth a line. The region-marked samples were
-decided *yes*, and building the count they rested on is what killed them: the two
-spans the entry named are not spans, and both carry a mark the entry's own rule
-excludes. It moved down with that measurement attached. The lesson is not about
-regions. **An entry can sit in `Planned` for releases on the strength of a figure
-nobody has checked**, because the section's discipline is aimed at keeping the
-*argument* rather than at re-testing the evidence under it — so the first act of
-building one should be re-measuring what it claims, not implementing what it
-proposes. That is what happened here, and it cost an hour instead of a mechanism.
-
-*What the fifth way cost and returned, now that all of it is spent.* Sixteen
-items, no external input, and nothing in the suite shaped to catch any of them.
-The returns were not evenly distributed and the split is the useful part: two
-defects a user could hit today (a report that misdiagnosed a load failure, a
-merge crossing midnight), two costs worth a second each on a real command
-(`check --eval` at 1 + N Vite servers, `control` at 27–84x), one fixed toll on
-every static invocation (~1 s), and the rest true-but-unobservable — identical
-output either way. Only the last group is genuinely optional, and it is also the
-group that would never have been found any other way, because *no observable
-symptom* is precisely the definition of what a gate cannot see. The transferable
-lesson is the batching: individually none of the unobservable ones justifies a
-commit, and together they cost about an hour.
+losing the argument would cost more than losing the task.
+
+**Where an entry went is recorded under the version that shipped it.** This
+section keeps no ledger of its own departures — one was maintained here by hand
+for several releases, and a count kept in prose with nothing to check it is a
+claim that goes wrong quietly. What is worth keeping is what the section learned
+about itself, which is three things.
+
+**An entry can sit here for releases on the strength of a figure nobody has
+checked.** The discipline aims at keeping the *argument*, not at re-testing the
+evidence under it, so the first act of building one is re-measuring what it
+claims rather than implementing what it proposes. That has paid twice: once
+killing an entry outright, when the spans it rested on turned out not to be
+spans; once correcting an entry's headline number before a line of it was
+written. **What a release costs its adopters is not known on the day it is cut**
+— several entries arrived from one adoption report, about shapes the tool made
+someone work around without ever erroring. And **the fixes with no observable
+symptom are worth batching**: individually none justifies a commit, together they
+cost about an hour, and they are the group no gate could have found, since having
+no symptom is the definition of what a gate cannot see.
 
 - **Binding the `✗` samples to fixtures whose rejection is asserted.** A sample
   showing input the engine must *reject* can be bound the way a runnable one is,
@@ -3117,6 +3196,99 @@ commit, and together they cost about an hour.
   `[0.4.3]` — that the gate and the run proving the fixture still works live in
   different suites — applies here identically.
 
+- **The child run's stdout is not Attest's, and `--json` promises it is.**
+  `runAndCollect` starts Vitest with the parent's fd 1 inherited, so a spec file
+  in the project under test writes straight to the same stream the report goes
+  to. `quiet: true` does not close it: `silent: true` suppresses Vitest's
+  *console interception*, and a bare `process.stdout.write` in a spec — at
+  collection time or inside a scenario body, both measured — goes past it
+  untouched. Neither `core/terminal.ts` nor `sanitisedLogger` is on that path at
+  all, because no Attest code is.
+  *The machine surface is the half that is actually new.* `cli/index.ts` opens
+  by stating that under `--json` "the only thing written to stdout is one
+  machine-readable report", and §9.1 records that this path "was never exposed —
+  `JSON.stringify` escapes every C0 character". Both hold for `check`, `cover`,
+  `render` and `status`, and neither holds for `verify` or `archive`: measured,
+  a spec writing `{"ok":true,"POLLUTION":"…"}` puts that document **first** on
+  stdout, ahead of the real report, so `JSON.parse` of the whole stream fails
+  (position 46) while anything reading line-wise or taking the first object
+  reads the attacker's verdict. The terminal half is the same hole and the
+  smaller finding — `ESC[2K CR` plus a forged `ERROR` header at column 0 and an
+  `OSC 0` window retitle all arrive intact — but `verify` executes project code
+  by design, so repainting a terminal is not a capability that path lacked.
+  *The fix belongs to `runAction`, not to `runner.ts`.* That function is already
+  the single convergence point for "one output, one exit code", which is the
+  same argument that put `formatCrash` in `cli/report.ts` rather than leaving a
+  copy in each `catch`: `runner.ts` would be made to hold a contract it does not
+  own, while `runAction` is the only place the promise is made.
+
+- **`render`'s document can carry raw HTML and a forged requirement section.**
+  `sanitised` is the entry §9.1 names and it strips control characters and
+  nothing else, so `statement` and `rationale` reach the Markdown by
+  concatenation exactly as written. Measured: a `rationale` containing newlines
+  and `## ATX-999` renders a whole section — heading, statement, `**Why:**` —
+  for a requirement no registry holds, sitting between two real ones and worded
+  identically; `<script>` and `<img onerror>` survive the same way. `check` and
+  `cover` see only the real id, and `render --check` cannot object, because that
+  *is* what the registry renders to now.
+  *Not an accepted risk, which is the part worth pinning.* §9.1 and the
+  reference both scope their guarantee to control characters, and the
+  reference's heading over that paragraph is "Safe to read, and safe to keep",
+  with "a site generator" named in the threat it describes. What *is* a decision
+  is that prose may be marked up — `plain()` escapes a param value precisely
+  because it is data while the statement around it is not — and that decision
+  has never been separated from allowing raw HTML or a heading. So the entry is
+  as much about stating which of the three is intended as about the escaping,
+  and if the answer is that Markdown stays and HTML and headings go, that is a
+  fourth obligation in §9.1 rather than a patch at an emitter.
+
+- **`attest init` follows a symlink out of the project root.** `runInit` does
+  `mkdir(dirname(dest), { recursive: true })` and then `writeAtomic`, and
+  neither asks whether `dest` is still under `root`. A `.claude/skills/attest`
+  planted in the repository as a link to anywhere the user can write is followed
+  by both: measured on Windows with a junction, a file at the target holding
+  `USER OWNED FILE - DO NOT OVERWRITE` came back holding the skill. The report
+  prints the relative path, so nothing on screen says where it went.
+  *`write.ts` is not the gap and neither is `targets.ts`'s content.* The `wx`
+  flag defends the *temporary* path against a planted link and does exactly
+  that; the destination's directory was never in its scope. And `workflowBody()`
+  is a pure function of nothing, so no byte of the checked project reaches the
+  file — the exposure is the path, not the content, which is `targets.ts`'s
+  first rule ("Attest owns the path") being an assumption rather than a check.
+  The check belongs beside `resolveTargets`, which is already all-or-nothing for
+  the same reason: a name known to be unwritable must not leave half a set
+  behind.
+
+- **A deeply nested literal takes `check` down before either reader sees it.**
+  40 KB of `[[[…]]]` in a `params` value exhausts the stack inside
+  `ts.createSourceFile` — TypeScript's own recursive-descent parser, so
+  `literalValue`'s recursion is never reached and hardening it would change
+  nothing. `parser.ts` opens with the same call, so `verify` takes it too, and
+  `loadRegistry` reads with `Promise.all`, so one file ends the whole command.
+  *It fails closed, which is why this is a repair and not an emergency.*
+  Measured: `internal-error`, `ok: false`, exit 1, and a well-formed `--json`
+  envelope. What it costs is that the command this project tells people to run
+  first on an untrusted fork MR can be made to say nothing but that, forever.
+  The shape of the fix is already in `locate.ts`: `unreadableFiles` exists to
+  say "this file could not be read" without ending the run, and a `RangeError`
+  out of a single `read` or `parseSpecFile` is that, so a hostile file scraps
+  only itself and `check`'s breadth contract survives it.
+
+- **`status` prints one line the sanitiser never sees.** `cli/index.ts` writes
+  `Change: ${result.change}` bare, while `formatStatus` puts the same value
+  through `inline` twice, three lines apart in the same output. Measured with a
+  directory named with U+009B — the C1 CSI the class in `control` exists for,
+  and one NTFS permits — the header carried `c2 9b` raw while the closing
+  `Not a verdict:` line carried a space. A change name is a directory name in
+  the repository under test, and the workflow `init` writes tells an agent to
+  run `attest status <name>`, so the value is the project's to choose.
+  *One `inline()` call, and the entry is here for the reason rather than the
+  fix.* §9.1 says a stream has no entry, only writes, so the obligation sits on
+  every write or not at all — and this is the second time a single missed write
+  has been the whole defect, after the two `catch` blocks that printed a raw
+  stack beside sanitised diagnostics. The sweep filed above under `ATX-37` is
+  what would have found it; this is one more measurement in favour of it.
+
 ## Under consideration
 
 Candidates with **no decision yet**, between the two sections either side of it
@@ -3388,6 +3560,41 @@ have to gather again.
   because a project whose requirement count only rises should have decided in
   advance what would make one leave.
 
+- **The `cmd.exe` quoting in `tests/consumer.spec.ts` guards one character of
+  several.** `shellArg` asserts the argument holds no `"` and then quotes only
+  when it holds whitespace, so an argument with none goes to the shell bare —
+  and `&`, `|`, `^`, `<`, `>`, `(` are metacharacters there that the assertion
+  does not name. The fix is one character class, which is why the entry is not
+  about the fix.
+  *What blocks the decision is that no input reaches it.* Both arguments are
+  either a literal flag or a path from `mkdtemp`, `NEEDS_SHELL` is win32 only
+  and CI is Linux, and the one path an attacker could plausibly influence — the
+  checkout directory on a fork MR pipeline — comes from a GitLab project path,
+  whose character set excludes every metacharacter above. So this is an
+  observation with no attack path, and the honest question is not whether to
+  widen the class but whether the comment above it should stop claiming more
+  than the assertion covers: it says "the assertion keeps that true" about
+  arguments generally, where what it checks is one character. Widening the class
+  and leaving the prose is the change that would look like a fix and settle
+  nothing.
+
+- **A loader that fails to start leaves its scratch directory behind.**
+  `createLoader` calls `mkdtempSync` and writes the stub *before* `createServer`,
+  and the only `rm` of that directory is inside the `close` of the object
+  `createServer` returns — so a throw from it leaks one `attest-loader-*` per
+  invocation, which on a CI runner is one per build. That is the exact failure
+  shape the comment on `close` records as already fixed, surviving on the other
+  path.
+  *What blocks it is that nothing has been made to throw there.* With
+  `configFile: false` Vite still reads the `package.json` at the root to decide
+  `type`, so a malformed one in the checked project is the obvious candidate and
+  it is the project's to write — but it was not tried, and an entry claiming a
+  trigger it has not seen is the thing this section exists to not accumulate.
+  The repair is three lines (a `try` around the two calls that `rm`s and
+  rethrows) and is not what the decision turns on; measuring whether the throw
+  is reachable at all is, because if it is not, this is a leak with no input
+  that produces it.
+
 ## Considered and rejected
 
 Decisions **not** to build something, kept where they can be found before the
@@ -3712,42 +3919,8 @@ requirement, and human review at propose is still the whole answer. What is
 rejected is grouping as a way to assist it, and this reopens only on a
 contradiction that grouping would have caught.
 
-### Nested objects in `params`, so a lookup table can be registry-owned
-
-Raised by `mine-capablanca` (0.4.2) and explicitly not as a request, which is
-why it is recorded with its own answer rather than left as a complaint about a
-message. A `params` value is a scalar or a list of scalars; a table — piece kind
-to weight, tier to limit — is refused, and the only way to register one is to
-split it across parallel arrays, which reads worse in the rendered spec than it
-buys. *What rejected it: the two properties a param has, and a table has
-neither.* A param is **rendered into `SPEC.md` as a value a human checks at a
-glance**, and it is **read by a scenario as the one place that value lives**. A
-nested object fails the first by construction — there is no reading of a
-five-row table that a reviewer verifies the way they verify `30`. It fails the
-second more quietly: a table has many readers by definition, so "the one place"
-becomes "the one file", which is what an ordinary module already is. The
-schema's own comment records where the line was drawn and why arrays were let
-in — list constants are the most drift-prone values, and an array still has one
-owner read by one scenario. A table does not clear that bar; the reason arrays
-did is exactly the reason it does not.
-*The reporter's own resolution is the argument's strongest form.* The table went
-to a shared module, is not registry-owned, and **nothing was lost** — because a
-piece-value table is tuning, not a promise. That is the rule design §11 now
-states — *params for promises, plain constants for tuning* — derived
-independently by the same adopter before it was written anywhere. Under it this
-candidate is not a limitation of `params` at all: it is a value that was never a
-requirement's to hold, and §11 carries this rejection's own argument in the same
-paragraph, as the rule stated over the type rather than over the value.
-*What ships instead*, in `[0.5.0]`: the refusal now says what is accepted
-instead of `Invalid input`, and `troubleshooting.md` states the constraint and
-where such a value belongs — the reporter's actual ask, which was for the
-decision to be visible rather than discovered by reading the shipped `.d.ts`.
-The permanent half goes to design §11 with the params rule, not here.
-*This reopens on* a report where the value is genuinely promised — a table an
-adopter owes their users, whose rows a reviewer would want in the rendered spec.
-None has been seen; the one that raised it was tuning.
-
-[Unreleased]: https://gitlab.com/Pseudorca/attest/-/compare/v0.7.0...main
+[Unreleased]: https://gitlab.com/Pseudorca/attest/-/compare/v0.7.1...main
+[0.7.1]: https://gitlab.com/Pseudorca/attest/-/tags/v0.7.1
 [0.7.0]: https://gitlab.com/Pseudorca/attest/-/tags/v0.7.0
 [0.6.0]: https://gitlab.com/Pseudorca/attest/-/tags/v0.6.0
 [0.5.0]: https://gitlab.com/Pseudorca/attest/-/tags/v0.5.0

package/README.md

@@ -12,9 +12,9 @@ The killer move against drift: values a requirement **promises** (timeouts,
 limits, budgets) live **once** in its `params`, and tests read them from there —
 so a number is physically impossible to drift between the spec and the assertion.
 Values that merely tune behaviour stay ordinary constants; nothing is owed to
-anyone when a tuning knob changes. A param may be a scalar or an array of
-scalars, so list-shaped constants (vendor blacklists, id sets) get the same
-single source as a lone number.
+anyone when a tuning knob changes. A param may be any JSON value, so a
+composite constant — a vendor blacklist, a `kind -> payload` table — gets the
+same single source as a lone number, which is where drift is worst.
 
 What that does not buy is a warning when you change the value. `check` runs
 nothing, so editing a param leaves it at `✓ No issues` — nothing became unbound,
@@ -157,7 +157,7 @@ Every diagnostic carries a `code`, and every code has a section in
 ```
 ERROR   registry-not-static (requirements/upload.reqs.ts:5)
     Value is not a literal.
-    → https://gitlab.com/Pseudorca/attest/-/blob/v0.7.0/docs/en/troubleshooting.md#registry-not-static
+    → https://gitlab.com/Pseudorca/attest/-/blob/v0.7.1/docs/en/troubleshooting.md#registry-not-static
 ```
 
 The anchor **is** the code, so the link cannot point somewhere the section

package/dist/core/apply.js

@@ -3,7 +3,7 @@
 // Map<id, Requirement>, with content-compare on ADDED and already-synced
 // no-ops on RENAMED.
 import { RequirementIdSchema, RequirementSchema } from './schema.js';
-import { byCodeUnit } from './order.js';
+import { byCodeUnit, sortDeep } from './order.js';
 /**
  * The ids a delta ADDs — the scope of the first-red obligation (design §6).
  *
@@ -185,16 +185,13 @@ function canonical(req) {
     return JSON.stringify({
         statement: req.statement,
         rationale: req.rationale,
-        params: sortKeys(req.params),
+        // Deep, not one level: a param is a JSON value, so the nested keys of a
+        // kind -> payload table are as much a part of this string as the top-level
+        // ones, and the failure is identical one level down — an identical copy
+        // written with its inner keys in another order reported as `add-conflict`
+        // against itself. Code-unit order throughout, and `sortDeep` says why.
+        params: sortDeep(req.params),
         outOfScope: [...req.outOfScope],
     });
 }
-// Code-unit order, not localeCompare: this string is a *verdict input*.
-// localeCompare calls some distinct keys equal, and a stable sort then leaves
-// them in insertion order — so the canonical form would encode how the params
-// happened to be written, and `add-conflict` would report a requirement as
-// conflicting with an identical copy of itself.
-function sortKeys(obj) {
-    return Object.fromEntries(Object.entries(obj).sort(([a], [b]) => byCodeUnit(a, b)));
-}
 //# sourceMappingURL=apply.js.map

package/dist/core/docs.d.ts

@@ -8,7 +8,7 @@
  * and the `##` headings of both language documents, so landing here cannot
  * produce a dead link.
  */
-export declare const ISSUE_CODES: readonly ["add-conflict", "add-invalid", "added-id-unmerged", "apply-no-prefix-owner", "apply-unsupported-delta", "change-not-found", "compiler-unsupported", "declared-not-run", "duplicate-prefix", "duplicate-requirement", "empty-spec", "internal-error", "invalid-change-name", "missing-spec-doc", "modify-invalid", "modify-missing", "never-red", "orphan-test", "possible-drift", "proposed-spec-name-taken", "proposed-spec-unclaimed", "rationale-placeholder", "registry-invalid", "registry-no-default", "registry-not-static", "rename-source-missing", "rename-target-exists", "rename-target-invalid", "spec-in-change-dir", "spec-load-failed", "stale-spec-doc", "tests-red", "unbound-param", "uncovered-requirement", "unknown-target"];
+export declare const ISSUE_CODES: readonly ["add-conflict", "add-invalid", "added-id-unmerged", "apply-no-prefix-owner", "apply-unsupported-delta", "change-not-found", "compiler-unsupported", "declared-not-run", "duplicate-prefix", "duplicate-requirement", "empty-spec", "internal-error", "invalid-change-name", "missing-spec-doc", "modify-invalid", "modify-missing", "never-red", "non-scalar-interpolation", "orphan-test", "possible-drift", "proposed-spec-name-taken", "proposed-spec-unclaimed", "rationale-placeholder", "registry-invalid", "registry-no-default", "registry-not-static", "rename-source-missing", "rename-target-exists", "rename-target-invalid", "spec-in-change-dir", "spec-load-failed", "stale-spec-doc", "tests-red", "unbound-param", "uncovered-requirement", "unknown-target"];
 export type IssueCode = (typeof ISSUE_CODES)[number];
 /**
  * The page explaining `code`, or `undefined` when nothing explains it.

package/dist/core/docs.js

@@ -36,6 +36,7 @@ export const ISSUE_CODES = [
     'modify-invalid',
     'modify-missing',
     'never-red',
+    'non-scalar-interpolation',
     'orphan-test',
     'possible-drift',
     'proposed-spec-name-taken',

package/dist/core/locate.d.ts

@@ -141,13 +141,11 @@ export declare function idPrefix(id: string): string;
  * displayed, they become the child run's `include` globs, where a Windows
  * separator would silently match nothing.
  *
- * Each source is parsed as it arrives rather than after all of them. The
- * previous `Promise.all(files.map(readFile))` held every spec file in memory at
- * once — measured at ~47 MiB on a synthetic tree of 6000 files — for input size
- * that is not ours to choose, since `check` is the command this project tells
- * people to run first on an untrusted fork MR. Parsing at the point of arrival
- * makes the peak `PARSE_CONCURRENCY` sources instead of `files.length`, and the
- * plan is the only thing that still grows with the tree.
+ * Each source is parsed as it arrives rather than after all of them, so the peak
+ * is `PARSE_CONCURRENCY` sources rather than `files.length` and the plan is the
+ * only thing still growing with the tree. Reading them all first is the shape to
+ * avoid: input size is not ours to choose here, `check` being what this project
+ * tells people to run first on an untrusted fork MR. Measured in `[0.7.0]`.
  *
  * `findFiles` above is deliberately left unbounded: its fan-out is real, but the
  * failure it invites is descriptor exhaustion, which no measurement on either

package/dist/core/locate.js

@@ -294,13 +294,11 @@ const PARSE_CONCURRENCY = 32;
  * displayed, they become the child run's `include` globs, where a Windows
  * separator would silently match nothing.
  *
- * Each source is parsed as it arrives rather than after all of them. The
- * previous `Promise.all(files.map(readFile))` held every spec file in memory at
- * once — measured at ~47 MiB on a synthetic tree of 6000 files — for input size
- * that is not ours to choose, since `check` is the command this project tells
- * people to run first on an untrusted fork MR. Parsing at the point of arrival
- * makes the peak `PARSE_CONCURRENCY` sources instead of `files.length`, and the
- * plan is the only thing that still grows with the tree.
+ * Each source is parsed as it arrives rather than after all of them, so the peak
+ * is `PARSE_CONCURRENCY` sources rather than `files.length` and the plan is the
+ * only thing still growing with the tree. Reading them all first is the shape to
+ * avoid: input size is not ours to choose here, `check` being what this project
+ * tells people to run first on an untrusted fork MR. Measured in `[0.7.0]`.
  *
  * `findFiles` above is deliberately left unbounded: its fan-out is real, but the
  * failure it invites is descriptor exhaustion, which no measurement on either

package/dist/core/merge.js

@@ -30,7 +30,7 @@
 // at runtime on the happy path, and a later reordering would look harmless.
 import { mkdir, readFile, rename, stat } from 'node:fs/promises';
 import { join, dirname, basename } from 'node:path';
-import { repointImport, spliceRequirements } from './splice.js';
+import { repointImport, spliceRequirements, UnwritableValue } from './splice.js';
 import { writeAtomic } from './write.js';
 import { idPrefix } from './locate.js';
 import { addedIds } from './apply.js';
@@ -178,7 +178,32 @@ export async function applyMerge(input) {
     }
     for (const file of [...byFile.keys()].sort(byCodeUnit)) {
         const source = await readFile(file, 'utf8');
-        const spliced = spliceRequirements(file, source, byFile.get(file));
+        let spliced;
+        try {
+            spliced = spliceRequirements(file, source, byFile.get(file));
+        }
+        catch (err) {
+            // The emitter refused a value it cannot write as source — today only a
+            // `__proto__` param key, which the schema rejects before `--apply` runs.
+            // Caught rather than left to the CLI's crash envelope so the account of
+            // what this merge had already written survives: `--apply` is destructive
+            // and half a merge reported as a bare stack is the shape a resume cannot
+            // read. The write for *this* file has not happened — the throw is in the
+            // text generation, above `writeAtomic`.
+            if (!(err instanceof UnwritableValue))
+                throw err;
+            return {
+                issues: [
+                    {
+                        level: 'ERROR',
+                        code: 'internal-error',
+                        file: relativePath(root, file),
+                        message: `${relativePath(root, file)} could not be written: ${err.message}.`,
+                    },
+                ],
+                written,
+            };
+        }
         if (spliced === undefined) {
             // Unreachable through the command — the gate read this file as a literal
             // moments ago — so it is reported as the internal inconsistency it is

package/dist/core/order.d.ts

@@ -1,3 +1,20 @@
 /** Compare by UTF-16 code unit — the same order as a bare `Array#sort()`. */
 export declare function byCodeUnit(a: string, b: string): number;
+/**
+ * A JSON value with every object's keys in code-unit order, at every depth.
+ *
+ * `JSON.stringify` writes object keys in insertion order, which is *how the
+ * source happened to be written* — the thing this module exists to keep out of
+ * anything compared or committed. Two callers need the same guarantee for the
+ * same reason, one depth apart:
+ *
+ * - `apply.ts` canonicalises a requirement to decide `add-conflict`, so an
+ *   identical copy written with its keys in another order must not read as a
+ *   conflict with itself.
+ * - `render.ts` emits a structured param as JSON, and ATX-10 holds the same
+ *   registry to the same bytes.
+ *
+ * Arrays keep their order: an array is data whose order is part of the value.
+ */
+export declare function sortDeep<T>(value: T): T;
 //# sourceMappingURL=order.d.ts.map