graceful-boundaries 1.5.0 → 1.5.2

package/CONFORMANCE.md

@@ -29,7 +29,7 @@ A passing run reports the highest level the service satisfies. The verifier is t
 
 ## Test suite
 
-`evals/` ships 250 tests across 12 files:
+`evals/` ships 259 tests across 12 files:
 
 | File | Coverage |
 |---|---|

package/README.md

@@ -5,7 +5,7 @@ A specification for how services communicate their operational limits to humans
 **[gracefulboundaries.dev](https://gracefulboundaries.dev)**
 
 [![License: CC-BY-4.0](https://img.shields.io/badge/License-CC--BY--4.0-lightgrey.svg)](https://creativecommons.org/licenses/by/4.0/)
-[![Version](https://img.shields.io/badge/version-1.5.0-blue.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-1.5.2-blue.svg)](CHANGELOG.md)
 [![Tests](https://img.shields.io/github/actions/workflow/status/snapsynapse/graceful-boundaries/test.yml?label=tests)](https://github.com/snapsynapse/graceful-boundaries/actions)
 [![ClawHub](https://img.shields.io/badge/ClawHub-83%20installs-blue)](https://clawhub.ai/snapsynapse/graceful-boundaries)
 
@@ -141,7 +141,7 @@ npx graceful-boundaries check https://your-service.com --check-cloaking
 
 ![Checker output: Siteline confirms Level 4, Google confirms Level 0](imgs/checker-demo.svg)
 
-Or clone and run from the project root with `node evals/check.js <url>`. Run the unit test suite (250 tests, no dependencies):
+Or clone and run from the project root with `node evals/check.js <url>`. Run the unit test suite (259 tests, no dependencies):
 
 ```bash
 npm test
@@ -190,7 +190,7 @@ The shortest path from "read the spec" to "conformant service":
 
 1. **Copy a middleware example** -- dependency-free Level 2 implementations (Level 4 with one flag) for [Express, FastAPI, Cloudflare Workers, and Hono](examples/middleware/).
 2. **Copy the nearest limits.json** -- complete discovery responses for a [SaaS API, free scanner, LLM API, and content site](examples/limits/).
-3. **Validate your bodies** -- published [JSON Schemas](schema/) for refusals, 429s, and the discovery endpoint, served at `https://gracefulboundaries.dev/schema/`. Importable into OpenAPI and CI validators.
+3. **Validate your body shapes** -- published [JSON Schemas](schema/) for refusals, 429s, and the discovery endpoint, served at `https://gracefulboundaries.dev/schema/`. Importable into OpenAPI and CI validators; run the checker for origin-aware SC-6 URL safety and conformance.
 4. **Verify** -- `npx graceful-boundaries check https://your-service.example`, then gate it in CI with the GitHub Action above.
 5. **Declare** -- add yourself to [ADOPTERS.md](ADOPTERS.md) and embed a [conformance badge](ADOPTERS.md#badges).
 
@@ -239,6 +239,8 @@ npx graceful-boundaries check https://siteline.to
 
 Services implementing the spec are listed in [ADOPTERS.md](ADOPTERS.md), which also covers how to add yours and embed a conformance badge.
 
+The [adoption validation plan](docs/adoption-validation.md) defines the evidence required before deferred fields or extensions are promoted. Registered services are rechecked weekly, with point-in-time JSON results retained as workflow artifacts rather than presented as certification.
+
 ## Security
 
 The specification includes a [threat model and security audit](SECURITY-AUDIT.md) covering rate limit calibration attacks, security posture disclosure, validation oracles, content cloaking via agent-signaling headers, action boundary risks, untrusted machine-readable guidance, and other considerations (SC-1 through SC-16), all addressed in the spec.
@@ -249,7 +251,7 @@ Graceful Boundaries is free and open. If your team relies on this spec, consider
 
 ## License
 
-CC-BY-4.0. Use it, adapt it, build on it. Attribution required.
+The specification and documentation are CC-BY-4.0. The checker and reference code are MIT licensed. See [LICENSE-SPEC](LICENSE-SPEC) and [LICENSE](LICENSE).
 
 ## About
 

package/evals/check.js

@@ -16,6 +16,7 @@
  *   node evals/check.js https://your-service.com --limits-path /api/limits
  *   node evals/check.js https://your-service.com --json
  *   node evals/check.js https://your-service.com --check-cloaking
+ *   node evals/check.js https://your-service.com --min-level 2
  */
 
 const REQUIRED_REFUSAL_FIELDS = ["error", "detail", "limit", "retryAfterSeconds", "why"];
@@ -33,14 +34,27 @@ const OPTIONAL_LIMIT_NUMBER_FIELDS = [
 
 function parseArgs(argv) {
   const args = argv.slice(2);
-  const options = { baseUrl: null, limitsPath: null, json: false, checkCloaking: false, minLevel: null };
+  const options = {
+    baseUrl: null,
+    limitsPath: null,
+    json: false,
+    checkCloaking: false,
+    minLevel: null,
+    errors: [],
+  };
 
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--limits-path" && i + 1 < args.length) {
       options.limitsPath = args[++i];
     } else if (args[i] === "--min-level" && i + 1 < args.length) {
-      const parsed = Number.parseInt(args[++i], 10);
-      options.minLevel = Number.isInteger(parsed) ? parsed : null;
+      const raw = args[++i];
+      if (!/^[0-4]$/.test(raw)) {
+        options.errors.push(`--min-level must be an integer from 0 to 4, got "${raw}"`);
+      } else {
+        options.minLevel = Number(raw);
+      }
+    } else if (args[i] === "--min-level") {
+      options.errors.push("--min-level requires a value from 0 to 4");
     } else if (args[i] === "--json") {
       options.json = true;
     } else if (args[i] === "--check-cloaking") {
@@ -933,6 +947,11 @@ function assessLevel(limitsResults, refusalCheck, proactiveHeaders) {
 async function main() {
   const options = parseArgs(process.argv);
 
+  if (options.errors.length > 0) {
+    for (const error of options.errors) console.error(error);
+    process.exit(1);
+  }
+
   if (!options.baseUrl) {
     console.error("Usage: node evals/check.js <base-url> [--limits-path /path] [--json] [--check-cloaking] [--min-level N]");
     console.error("");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graceful-boundaries",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "A specification for how services communicate their operational limits to humans and autonomous agents.",
   "license": "CC-BY-4.0 AND MIT",
   "bin": {

package/schema/limits.schema.json

@@ -23,15 +23,18 @@
     },
     "changelog": {
       "type": "string",
+      "$comment": "SC-6 same-origin/relative URL safety is origin-dependent and cannot be fully enforced by this standalone schema. Use evals/check.js or equivalent origin-aware validation.",
       "description": "URL to a changelog resource for limit changes. Must be a relative path or same-origin absolute URL."
     },
     "feed": {
       "type": "string",
+      "$comment": "SC-6 same-origin/relative URL safety is origin-dependent and cannot be fully enforced by this standalone schema. Use evals/check.js or equivalent origin-aware validation.",
       "description": "URL to a feed (JSON Feed, Atom, RSS) for change notifications. Must be a relative path or same-origin absolute URL."
     },
     "extensions": {
       "type": "object",
       "additionalProperties": { "type": "string" },
+      "$comment": "SC-6 same-origin/relative URL safety for extension URLs is origin-dependent and cannot be fully enforced by this standalone schema. Use evals/check.js or equivalent origin-aware validation.",
       "description": "Named extension discovery URLs (e.g. actionBoundaries). Each value must be a relative path or same-origin absolute URL. Presence does not affect Level 1-4 conformance."
     },
     "limits": {

package/schema/refusal.schema.json

@@ -52,10 +52,12 @@
     },
     "cachedResultUrl": {
       "type": "string",
+      "$comment": "SC-6 same-origin/relative URL safety is origin-dependent and cannot be fully enforced by this standalone schema. Use evals/check.js or equivalent origin-aware validation.",
       "description": "URL to retrieve the cached result. Must be a relative path or same-origin absolute URL (SC-6)."
     },
     "alternativeEndpoint": {
       "type": "string",
+      "$comment": "SC-6 same-origin/relative URL safety is origin-dependent and cannot be fully enforced by this standalone schema. Use evals/check.js or equivalent origin-aware validation.",
       "description": "A different endpoint that may serve the need. Must be a relative path or same-origin absolute URL (SC-6)."
     },
     "upgradeUrl": {
@@ -89,6 +91,7 @@
     },
     "scanUrl": {
       "type": "string",
+      "$comment": "SC-6 same-origin/relative URL safety is origin-dependent and cannot be fully enforced by this standalone schema. Use evals/check.js or equivalent origin-aware validation.",
       "description": "Endpoint to create the missing resource. Not a trust bypass (SC-8)."
     },
     "statusUrl": {

package/spec.md

@@ -1,7 +1,7 @@
 # Graceful Boundaries
 
-**Version:** 1.5.0
-**Date:** 2026-06-09
+**Version:** 1.5.2
+**Date:** 2026-07-21
 **Status:** Released
 **License:** CC-BY-4.0 (spec.md, docs/) + MIT (code in evals/)
 **URL:** https://gracefulboundaries.dev