@dogfood-lab/schemas 1.5.0 → 1.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dogfood-lab/schemas",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "JSON schemas for the testing-os contract spine — record, finding, pattern, recommendation, doctrine, policy, scenario, submission.",
   "type": "module",
   "main": "dist/index.js",
@@ -35,7 +35,7 @@
   "devDependencies": {
     "@dogfood-lab/dogfood-swarm": "*",
     "@types/node": "^25.3.5",
-    "vitest": "^4.1.6"
+    "vitest": "^4.1.9"
   },
   "author": "mcp-tool-shop",
   "license": "MIT",

package/src/json/dogfood-record-submission.schema.json

@@ -100,7 +100,8 @@
 
     "ci_checks": {
       "type": "array",
-      "description": "Machine-evaluated CI results. Optional — not all dogfood runs include CI.",
+      "maxItems": 200,
+      "description": "Machine-evaluated CI results. Optional — not all dogfood runs include CI. Capped at 200 (resource guard; a real run reports a handful of checks).",
       "items": {
         "type": "object",
         "required": ["id", "kind", "status"],
@@ -130,7 +131,8 @@
     "scenario_results": {
       "type": "array",
       "minItems": 1,
-      "description": "Dogfood evidence. At least one scenario required.",
+      "maxItems": 1000,
+      "description": "Dogfood evidence. At least one scenario required. Capped at 1000 (resource guard for the policy engine, which evaluates per-scenario rules synchronously; a real run reports far fewer).",
       "items": {
         "type": "object",
         "required": ["scenario_id", "product_surface", "execution_mode", "verdict", "step_results"],
@@ -165,10 +167,17 @@
             "type": "string",
             "description": "Required when verdict is blocked. Verifier enforces."
           },
+          "tags": {
+            "type": "array",
+            "maxItems": 100,
+            "items": { "type": "string" },
+            "description": "Free-form scenario tags (e.g. 'smoke', 'release', 'wip', 'flaky', 'skip-ci'). Optional. Capped at 100 (resource guard). Policy may gate on these via a surface's evidence_requirements.forbidden_tags / required_tags."
+          },
           "step_results": {
             "type": "array",
             "minItems": 1,
-            "description": "Per-step execution results. Bridges scenario steps to record evidence.",
+            "maxItems": 500,
+            "description": "Per-step execution results. Bridges scenario steps to record evidence. Capped at 500 (resource guard).",
             "items": {
               "type": "object",
               "required": ["step_id", "status"],
@@ -189,6 +198,7 @@
           },
           "evidence": {
             "type": "array",
+            "maxItems": 100,
             "items": {
               "type": "object",
               "required": ["kind", "url"],

package/src/json/dogfood-record.schema.json

@@ -173,6 +173,11 @@
             "type": "string",
             "description": "Required when verdict is blocked. Verifier enforces."
           },
+          "tags": {
+            "type": "array",
+            "items": { "type": "string" },
+            "description": "Free-form scenario tags (e.g. 'smoke', 'release', 'wip', 'flaky', 'skip-ci'). Carried verbatim from the submission. Policy gates on these via a surface's evidence_requirements.forbidden_tags / required_tags."
+          },
           "step_results": {
             "type": "array",
             "minItems": 1,
@@ -282,6 +287,11 @@
           "items": { "type": "string" },
           "description": "Machine-readable reasons for rejection. Empty if accepted."
         },
+        "warnings": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Accepted-with-warning notes from warn-severity policy rules. A populated warnings array does NOT imply rejection — the record was accepted. Optional and backward-compatible: records written before this channel existed have no warnings block. Mirrors the rejection_reasons shape (one machine-readable string per matched warn-rule)."
+        },
         "provenance_remediation": {
           "type": "object",
           "properties": {

package/src/json/policy.schema.json

@@ -54,7 +54,8 @@
 
     "defaults": {
       "$ref": "#/$defs/surface_policy",
-      "description": "Default surface policy. Used when a surface has no explicit policy."
+      "description": "Default surface policy. Used when a surface has no explicit policy. VERIFY-F1: `custom_rules` is NOT permitted here — it is a repo-surface concern only. Global, non-overridable declarative rules belong in `global_rules` (which fail operationally, not submission-bad). Allowing custom_rules under defaults would make a global-origin predicate fault classify as submission-bad.",
+      "properties": { "custom_rules": false }
     },
 
     "global_rules": {
@@ -74,6 +75,19 @@
             "type": "string",
             "enum": ["reject", "warn", "info"],
             "description": "reject: fails verification. warn: accepted with warning. info: logged only."
+          },
+          "scope": {
+            "type": "string",
+            "enum": ["submission", "scenario_result"],
+            "description": "VERIFY-F1: evaluation scope of the `when` predicate. submission (default) evaluates against the whole submission and emits one reason if matched. scenario_result evaluates each scenario_result independently and emits one reason per offending element, in array order. Ignored when `when` is absent (the rule falls to the built-in id switch). See docs/policy-dsl.md."
+          },
+          "when": {
+            "$ref": "#/$defs/predicate",
+            "description": "VERIFY-F1: optional declarative VIOLATION predicate. The rule fires (per its severity) when this evaluates true. Absent => the rule is enforced by the built-in id switch instead. See docs/policy-dsl.md."
+          },
+          "reason_template": {
+            "type": "string",
+            "description": "VERIFY-F1: optional per-rule reason body. {slot} placeholders interpolate fields of the matched element (scenario_result scope) or submission (submission scope), raw and unescaped. The engine prepends `[<id>] `. Absent => the body is the rule's `description`."
           }
         }
       }
@@ -225,11 +239,153 @@
             "min_evidence_count": {
               "type": "integer",
               "minimum": 0,
-              "description": "Minimum number of evidence items across all scenarios."
+              "description": "Minimum number of evidence items required PER scenario. The verifier enforces this against each scenario_result independently, not as a sum across all scenarios."
+            },
+            "forbidden_tags": {
+              "type": "array",
+              "items": { "type": "string" },
+              "description": "Scenario tags that REJECT a scenario_result on this surface. A scenario_result whose tags include any of these (e.g. 'wip', 'flaky', 'skip-ci') fails policy. Enforced per scenario_result independently."
+            },
+            "required_tags": {
+              "type": "array",
+              "items": { "type": "string" },
+              "description": "Scenario tags that EVERY scenario_result on this surface must carry. A scenario_result missing any of these (or carrying no tags at all) fails policy. Enforced per scenario_result independently."
+            }
+          }
+        },
+        "custom_rules": {
+          "type": "array",
+          "description": "VERIFY-F1: declarative per-scenario_result rules for this surface. Each rule's `when` predicate is evaluated against every scenario_result whose product_surface matches; a match fires the rule per its severity. Custom rules can only ADD constraints (reject/warn/info) — there is no accept/except verb, so a repo policy can never weaken a non-overridable global gate. See docs/policy-dsl.md.",
+          "items": {
+            "type": "object",
+            "required": ["id", "severity", "when"],
+            "additionalProperties": false,
+            "properties": {
+              "id": {
+                "type": "string",
+                "description": "Stable rule ID for reporting and diagnostics."
+              },
+              "description": { "type": "string" },
+              "severity": {
+                "type": "string",
+                "enum": ["reject", "warn", "info"],
+                "description": "reject: fails verification. warn: accepted with warning. info: logged only. There is intentionally no 'accept' value — custom rules are additive-only (non-weakening)."
+              },
+              "when": {
+                "$ref": "#/$defs/predicate",
+                "description": "The declarative VIOLATION predicate, evaluated per scenario_result on this surface. The rule fires when this evaluates true."
+              },
+              "reason_template": {
+                "type": "string",
+                "description": "Optional per-rule reason body. {slot} placeholders interpolate the matched scenario_result's fields, raw and unescaped. The engine prepends `[<id>] `. Absent => the body is the rule's `description`."
+              }
             }
           }
         }
       }
+    },
+
+    "predicate": {
+      "description": "VERIFY-F1: a bounded, no-eval predicate node. Exactly one form per node: a leaf {field, op, value?} or a combinator (all / any / not / implies). Combinator depth is additionally capped at 5 by the evaluator (the DoS floor; not expressible in JSON Schema). See docs/policy-dsl.md.",
+      "oneOf": [
+        { "$ref": "#/$defs/predicate_leaf" },
+        { "$ref": "#/$defs/predicate_all" },
+        { "$ref": "#/$defs/predicate_any" },
+        { "$ref": "#/$defs/predicate_not" },
+        { "$ref": "#/$defs/predicate_implies" }
+      ]
+    },
+
+    "predicate_leaf": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["field", "op"],
+      "properties": {
+        "field": {
+          "type": "string",
+          "description": "Dotted field path into the evaluated data; a '[]' segment means 'any element'. The segments __proto__, constructor, and prototype are forbidden (prototype-pollution guard).",
+          "pattern": "^(?!.*(?:^|\\.)(?:__proto__|constructor|prototype)(?:$|\\.|\\[))[A-Za-z_][A-Za-z0-9_]*(?:\\[\\])?(?:\\.[A-Za-z_][A-Za-z0-9_]*(?:\\[\\])?)*$"
+        },
+        "op": {
+          "type": "string",
+          "enum": ["equals", "not_equals", "in", "not_in", "contains", "not_contains", "exists", "not_exists", "gt", "gte", "lt", "lte"],
+          "description": "Closed operator set. exists/not_exists are truthiness (not strict key-presence) and take no value."
+        },
+        "value": {
+          "description": "Comparand. Omitted for exists/not_exists. An array for in/not_in. A scalar otherwise. Numeric for gt/gte/lt/lte (a non-numeric resolved field is an eval-time policy-config: fault)."
+        }
+      },
+      "allOf": [
+        {
+          "if": { "required": ["op"], "properties": { "op": { "enum": ["exists", "not_exists"] } } },
+          "then": { "not": { "required": ["value"] } }
+        },
+        {
+          "if": { "required": ["op"], "properties": { "op": { "enum": ["equals", "not_equals", "in", "not_in", "contains", "not_contains", "gt", "gte", "lt", "lte"] } } },
+          "then": { "required": ["value"] }
+        },
+        {
+          "if": { "required": ["op"], "properties": { "op": { "enum": ["in", "not_in"] } } },
+          "then": { "properties": { "value": { "type": "array" } } }
+        }
+      ]
+    },
+
+    "predicate_all": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["all"],
+      "properties": {
+        "all": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "description": "Logical AND. True when every child predicate is true. Width capped at 64 (DoS guard; the evaluator additionally enforces a node-visit budget).",
+          "items": { "$ref": "#/$defs/predicate" }
+        }
+      }
+    },
+
+    "predicate_any": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["any"],
+      "properties": {
+        "any": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "description": "Logical OR. True when at least one child predicate is true. Width capped at 64 (DoS guard; the evaluator additionally enforces a node-visit budget).",
+          "items": { "$ref": "#/$defs/predicate" }
+        }
+      }
+    },
+
+    "predicate_not": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["not"],
+      "properties": {
+        "not": {
+          "description": "Logical NOT.",
+          "$ref": "#/$defs/predicate"
+        }
+      }
+    },
+
+    "predicate_implies": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["implies"],
+      "properties": {
+        "implies": {
+          "type": "array",
+          "minItems": 2,
+          "maxItems": 2,
+          "description": "Sugar for [antecedent, consequent]: 'antecedent requires consequent'. As a VIOLATION predicate it desugars to all(antecedent, not(consequent)) — it matches the inputs that break the implication (antecedent holds but consequent does not).",
+          "items": { "$ref": "#/$defs/predicate" }
+        }
+      }
     }
   }
 }