metaobjects 1.0.4__tar.gz → 1.0.5rc1__tar.gz

{metaobjects-1.0.4 → metaobjects-1.0.5rc1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: metaobjects
-Version: 1.0.4
+Version: 1.0.5rc1
 Summary: Cross-language metadata standard: declare typed entities once, generate idiomatic drift-checked code across languages — Python port.
 Project-URL: Homepage, https://metaobjects.dev
 Project-URL: Repository, https://github.com/metaobjectsdev/metaobjects

{metaobjects-1.0.4 → metaobjects-1.0.5rc1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "metaobjects"
-version = "1.0.4"
+version = "1.0.5rc1"
 description = "Cross-language metadata standard: declare typed entities once, generate idiomatic drift-checked code across languages — Python port."
 readme = "README.md"
 requires-python = ">=3.11"

{metaobjects-1.0.4 → metaobjects-1.0.5rc1}/src/metaobjects/library/embedded_library.py

@@ -11,7 +11,7 @@ EMBEDDED_LIBRARY: dict[str, str] = {
     'ai/model': '# library/ai/model.yaml — the CORE layer: the LLM-call trace envelope.\n#\n# Adopters opt in via `libraries: ["ai"]`, then `extends: "metaobjects::ai::LlmCallBase"`.\n#\n# This layer declares NO `source.rdb`, so opting into `"ai"` alone adds zero tables and\n# zero generated code — the design is present and resolvable, and nothing else happens\n# until the adopter adds `"ai/db"`. See library/iam/model.yaml for the full rationale.\n#\n# This file was split out of the former `library/ai/llm-call.yaml`, which shipped the\n# abstract base and a concrete `LlmCall` carrying `source.rdb` together. That was\n# recorded as an accepted wart on the grounds that splitting would change what existing\n# `ai` adopters get; a sweep of the estate found there are none, so it was closed rather\n# than documented (FR-043 Amendment 1).\nmetadata:\n  package: metaobjects::ai\n  children:\n    - object.entity:\n        name: LlmCallBase\n        abstract: true\n        children:\n          - field.uuid:     { name: traceId }\n          - field.uuid:     { name: spanId }\n          - field.uuid:     { name: parentSpanId }\n          - field.string:   { name: sessionId }\n          - field.string:   { name: callType }\n          - field.string:   { name: system }\n          - field.string:   { name: requestModel }\n          - field.string:   { name: responseModel }\n          - field.int:      { name: inputTokens }\n          - field.int:      { name: outputTokens }\n          - field.currency: { name: costMinor, currency: USD }\n          - field.int:      { name: latencyMs }\n          - field.string:   { name: finishReason }\n          - field.string:   { name: status }\n          - field.string:   { name: errorDetail }\n          - field.timestamp: { name: startedAt }\n          - field.string:   { name: llmRequest,  dbColumnType: jsonb }   # generic jsonb (no objectRef)\n          - field.string:   { name: llmResponse, dbColumnType: jsonb }\n    - object.entity:\n        name: LlmCall\n        extends: metaobjects::ai::LlmCallBase\n        description: The concrete trace row. Its `source.rdb` lives in db.yaml, so opting into the core layer alone declares the shape without proposing a table.\n        children:\n          - identity.primary: { name: id, fields: ["spanId"] }\n',
     'ai/requirements': "# library/ai/requirements.yaml — what the LLM-call trace envelope PROMISES.\n#\n# A RETROFIT, not new design: llm-call.yaml landed 2026-06-03 and `requirement.functional`\n# first appears 2026-08-11, so the library could not have carried requirements when it was\n# written. That is why this file is worth reading as a worked example — it shows what\n# declaring the design of something that already exists actually turns up.\n#\n# The entry that earns its keep is `typedIo`, honestly `partial` + `accepted`: the library\n# declares the ENVELOPE and the adopter declares the typed VO columns. Recording that seam\n# in the ledger is where an agent meets it, before adding a fourth trace column.\n#\n# HIERARCHY IS NESTING, and the L4/L5 split is grain. An L4 names the OBJECT it is about;\n# the fields that carry it hang off it as an L5 child. Writing the fields at L4 is\n# ERR_REQUIREMENT_L4_NOT_OBJECT, and writing the concerns as SIBLINGS of the L2 leaves the\n# L2 claiming nothing — both of which this file did until the standalone verify gate\n# existed (`cli/test/shipped-library-verify.test.ts`).\nmetadata:\n  package: metaobjects::ai\n  children:\n    - requirement.functional:\n        name: llmTracing\n        level: 2\n        status: live\n        statement: Every call to a language model leaves a row that says what was asked, what came back, what it cost and how long it took.\n        counterexample: A spend figure nobody can attribute to a call.\n        description: The segment this library covers. Its three children below are the concerns it decomposes into.\n        children:\n          - requirement.functional:\n              name: envelope\n              level: 4\n              status: live\n              statement: A trace row identifies its call and its place in a trace — trace, span, parent span, session, call type, system.\n              counterexample: A log line that cannot be joined to the request that produced it.\n              implementedBy: [LlmCallBase]\n              children:\n                - requirement.functional:\n                    name: traceAddressing\n                    level: 5\n                    status: live\n                    statement: The four addressing columns are declared on the base — trace, span, parent span and session.\n                    counterexample: A row whose place in a trace is inferred from insertion order.\n                    description: >-\n                      The member grain exists here so the claim RESOLVES against the fields\n                      themselves: renaming or dropping one of them dangles this reference and\n                      fails the build, which naming the object alone would not.\n                    implementedBy: [LlmCallBase.traceId, LlmCallBase.spanId, LlmCallBase.parentSpanId, LlmCallBase.sessionId]\n\n          - requirement.functional:\n              name: accounting\n              level: 4\n              status: live\n              statement: A trace row carries the tokens in, the tokens out, and the cost in integer minor units.\n              counterexample: A cost stored as a float.\n              description: >-\n                `field.currency` — integer minor units on the wire, always. Float arithmetic for\n                money is forbidden by the cross-port wire contract, and a spend total is exactly\n                the sum that exposes it.\n              implementedBy: [LlmCallBase]\n              children:\n                - requirement.functional:\n                    name: tokenAndCostColumns\n                    level: 5\n                    status: live\n                    statement: Tokens in, tokens out and cost are three declared columns, the cost a field.currency.\n                    counterexample: A cost column declared as a double.\n                    implementedBy: [LlmCallBase.inputTokens, LlmCallBase.outputTokens, LlmCallBase.costMinor]\n\n          - requirement.functional:\n              name: typedIo\n              level: 4\n              status: partial\n              disposition: accepted\n              statement: The request and response bodies are stored as structured jsonb, not as opaque text.\n              counterexample: A prompt stored as a string nobody can query a field out of.\n              notes: >-\n                The library declares the two columns as generic jsonb with no `@objectRef`,\n                because it cannot know the adopter's request/response shape. Typing them is the\n                ADOPTER's move: declare an `object.value` and overlay the field with\n                `@objectRef` + `@storage: jsonb`. This is the seam ADR-0024 drew, recorded here\n                rather than in prose so it is in the ledger an agent reads before adding a\n                fourth trace column of its own.\n              implementedBy: [LlmCallBase]\n              children:\n                - requirement.functional:\n                    name: jsonbBodies\n                    level: 5\n                    status: live\n                    statement: The request and response bodies are declared as jsonb columns on the base.\n                    counterexample: A prompt stored in a text column.\n                    description: >-\n                      `live` where its parent is `partial`, and the split is the point: the\n                      COLUMNS are shipped and this claim is fully realised; what is outstanding\n                      is the TYPING of them, which is the parent's gap and the adopter's move.\n                    implementedBy: [LlmCallBase.llmRequest, LlmCallBase.llmResponse]\n\n    - requirement.architectural:\n        name: traceRowsCarryTiming\n        status: live\n        statement: Every trace row records when the call started and how long it took.\n        counterexample: A latency figure derived from log timestamps after the fact.\n        description: >-\n          Architectural, so it propagates down `extends` to every adopter entity deriving\n          from LlmCallBase — which is the point: an adopter's own trace table is claimed\n          by this requirement for free, and dropping the columns breaks the build.\n        implementedBy: [LlmCallBase]\n\n    - requirement.architectural:\n        name: traceRowsCarryOutcome\n        status: live\n        statement: Every trace row records how the call ended — a status, a finish reason, and the error detail when there was one.\n        counterexample: A failed call indistinguishable from one that never happened.\n        implementedBy: [LlmCallBase]\n",
     'iam/db': '# library/iam/db.yaml — the DB PERSISTENCE layer for metaobjects::iam.\n#\n# Opted into as `"iam/db"`, which IMPLIES `"iam"`: this file is nothing but\n# `overlay: true` redeclarations, and an overlay whose target was never declared is\n# ERR_OVERLAY_NO_TARGET.\n#\n# It carries exactly two kinds of child — `source.rdb` and `index.lookup` — and nothing\n# else. The field set, the identities and the relationships all live in model.yaml,\n# because they are the DESIGN; what lives here is where the rows go and which lookups are\n# worth an index. Add a field here and the core layer stops being the whole model, which\n# is the thing the split exists to guarantee.\n#\n# Physical names are `iam_`-prefixed. Two reasons, both real: `user` and `group` are\n# reserved words in Postgres, and an adopter very likely has tables of their own by those\n# names. A library that collides on a table name is a library nobody can adopt.\nmetadata:\n  package: metaobjects::iam\n  children:\n    - object.entity:\n        name: User\n        overlay: true\n        children:\n          - source.rdb: { table: iam_user, role: primary }\n\n    - object.entity:\n        name: GroupType\n        overlay: true\n        children:\n          - source.rdb: { table: iam_group_type, role: primary }\n\n    - object.entity:\n        name: Group\n        overlay: true\n        children:\n          - source.rdb: { table: iam_group, role: primary }\n          # Nesting is walked parent-ward constantly; the FK alone gives no index.\n          - index.lookup: { name: ixParent, fields: [parentId] }\n\n    - object.entity:\n        name: Role\n        overlay: true\n        children:\n          - source.rdb: { table: iam_role, role: primary }\n\n    - object.entity:\n        name: Permission\n        overlay: true\n        children:\n          - source.rdb: { table: iam_permission, role: primary }\n\n    - object.entity:\n        name: GroupMember\n        overlay: true\n        children:\n          - source.rdb: { table: iam_group_member, role: primary }\n          # The composite PK covers (userId, groupId), so "who is in this group?" —\n          # the other direction — has no index without this one. Same reasoning for\n          # every ixSecond below.\n          - index.lookup: { name: ixGroup, fields: [groupId] }\n\n    - object.entity:\n        name: RolePermission\n        overlay: true\n        children:\n          - source.rdb: { table: iam_role_permission, role: primary }\n          - index.lookup: { name: ixPermission, fields: [permissionId] }\n\n    - object.entity:\n        name: UserRole\n        overlay: true\n        children:\n          - source.rdb: { table: iam_user_role, role: primary }\n          - index.lookup: { name: ixRole, fields: [roleId] }\n\n    - object.entity:\n        name: GroupMemberRole\n        overlay: true\n        children:\n          - source.rdb: { table: iam_group_member_role, role: primary }\n          # "who holds this role in this group?" — the scoped-grant read.\n          - index.lookup: { name: ixGroupRole, fields: [groupId, roleId] }\n',
-    'iam/model': '# library/iam/model.yaml — the CORE layer: identity and access management.\n#\n# Adopters opt in via `libraries: ["iam"]` in .metaobjects/config.json.\n#\n# This layer declares NO `source.rdb`, and that is the whole point of the split. A\n# sourceless object is inert by a contract that already ships: migrate skips an object\n# with no writable source, and codegen emits no route, queries, hooks, grid or form for\n# one (both citing #248 — persistability derives from source presence, never from the\n# object subtype). It still gets a type-only interface, so `extends` and reference work.\n#\n# So `libraries: ["iam"]` adds ZERO tables and ZERO generated code. What an adopter gains\n# is the design being present and resolvable: an agent working in the repo knows the\n# capability exists and can draw on it, and nothing else happens until the adopter adds\n# `"iam/db"`.\n#\n# Authoring discipline (FR-043 §3.1), so the departures are visible:\n#   - `field.uuid` + `generation: uuid` on principals; composite ASSIGNED keys on\n#     junctions. Never `increment` — a library cannot know the adopter\'s id strategy.\n#   - Physical names carry the `iam_` prefix (in db.yaml): `user` and `group` are\n#     reserved words in Postgres, and an adopter has tables of their own.\n#   - No adopter-facing profile data. That arrives by `overlay: true`.\n#   - No credentials. See requirements.yaml → `noCredentialsOnUser`.\nmetadata:\n  package: metaobjects::iam\n  children:\n    - object.entity:\n        name: IamBase\n        abstract: true\n        description: Shared shape of every iam principal and definition — a stable uuid plus change timestamps. Junctions do not extend it; they are addressed by their participants.\n        children:\n          - field.uuid:      { name: id, required: true }\n          - field.timestamp: { name: createdAt, autoSet: onCreate }\n          - field.timestamp: { name: updatedAt, autoSet: onUpdate }\n\n    - object.entity:\n        name: User\n        extends: IamBase\n        description: A person or service account that can be granted access. Carries no authentication secret of any kind — see the noCredentialsOnUser requirement.\n        children:\n          - field.string:    { name: username, required: true, maxLength: 64, filterable: true }\n          - field.string:    { name: email, required: true, maxLength: 254, stringFormat: email, filterable: true }\n          - field.string:    { name: displayName, maxLength: 120 }\n          # NOT `filterable: true`, deliberately. The loader warns when a filterable\n          # field is in no identity — filtering on it sequential-scans — and a library\n          # must not ship a warning to every adopter. `username` and `email` carry it\n          # because they have identity.secondary; `status` does not. An adopter who\n          # wants to filter on status overlays `filterable` AND an index together,\n          # which is exactly what the layer split is for.\n          - field.enum:      { name: status, required: true, values: [invited, active, suspended, closed], default: active }\n          - field.timestamp: { name: emailVerifiedAt }\n          - field.timestamp: { name: lastSeenAt }\n          - identity.primary:   { name: pk, fields: [id], generation: uuid }\n          - identity.secondary: { name: uqUsername, fields: [username] }\n          - identity.secondary: { name: uqEmail, fields: [email] }\n          - relationship.association: { name: groups, objectRef: Group, cardinality: many, through: GroupMember }\n          - relationship.association: { name: roles,  objectRef: Role,  cardinality: many, through: UserRole }\n\n    - object.entity:\n        name: GroupType\n        extends: IamBase\n        description: What KIND of group this is — a team, a tenant, a project. An entity rather than an enum, because "which roles may be held in this kind of group" is data an adopter extends, and an enum\'s values cannot be extended by overlay.\n        children:\n          - field.string: { name: key, required: true, maxLength: 64 }\n          - field.string: { name: name, required: true, maxLength: 120 }\n          - field.string: { name: description, maxLength: 500 }\n          - identity.primary:   { name: pk, fields: [id], generation: uuid }\n          - identity.secondary: { name: uqKey, fields: [key] }\n\n    - object.entity:\n        name: Group\n        extends: IamBase\n        description: A nestable collection of users, of a declared GroupType. Nesting is by parentId; acyclicity is an invariant the schema cannot express — see the acyclicGroupNesting requirement.\n        children:\n          - field.uuid:   { name: groupTypeId, required: true }\n          - field.uuid:   { name: parentId }\n          - field.string: { name: key, required: true, maxLength: 64 }\n          # Not filterable for the same reason as User.status above.\n          - field.string: { name: name, required: true, maxLength: 120 }\n          - field.string: { name: description, maxLength: 500 }\n          - identity.primary:   { name: pk, fields: [id], generation: uuid }\n          - identity.secondary: { name: uqKey, fields: [key] }\n          - identity.reference: { name: fkGroupType, fields: [groupTypeId], references: GroupType, onDelete: restrict }\n          - identity.reference: { name: fkParent,    fields: [parentId],    references: Group,     onDelete: restrict }\n\n    - object.entity:\n        name: Role\n        extends: IamBase\n        description: A reusable bundle of permissions. Code never compares a role NAME to a literal — it asks whether a user holds a permission, and the mapping is data.\n        children:\n          - field.string: { name: key, required: true, maxLength: 64 }\n          - field.string: { name: name, required: true, maxLength: 120 }\n          - field.string: { name: description, maxLength: 500 }\n          - field.uuid:   { name: groupTypeId, description: "When set, this role may be held only within groups of this type; absent means grantable anywhere." }\n          - identity.primary:   { name: pk, fields: [id], generation: uuid }\n          - identity.secondary: { name: uqKey, fields: [key] }\n          - identity.reference: { name: fkGroupType, fields: [groupTypeId], references: GroupType, onDelete: restrict }\n          - relationship.association: { name: permissions, objectRef: Permission, cardinality: many, through: RolePermission }\n\n    - object.entity:\n        name: Permission\n        extends: IamBase\n        description: "The assignable unit — a stable <resource>:<action> key the application checks against. An entity, not an enum, on ADR-0037\'s own reasoning: it has its own identity, its own lifecycle, and a junction with real foreign keys."\n        children:\n          - field.string: { name: key, required: true, maxLength: 128, description: "Stable <resource>:<action> key the application checks against." }\n          - field.string: { name: description, maxLength: 500 }\n          - identity.primary:   { name: pk, fields: [id], generation: uuid }\n          - identity.secondary: { name: uqKey, fields: [key] }\n\n    # ---- grant surface: every grant is a row, addressed by its participants ----\n    #\n    # Junctions do NOT extend IamBase: they have no identity of their own, and adding a\n    # surrogate uuid to a row whose identity IS its participants invites a duplicate.\n\n    - object.entity:\n        name: GroupMember\n        description: A user\'s membership of a group.\n        children:\n          - field.uuid:      { name: userId,  required: true }\n          - field.uuid:      { name: groupId, required: true }\n          - field.timestamp: { name: joinedAt, autoSet: onCreate }\n          - identity.primary:   { name: pk, fields: [userId, groupId], generation: assigned }\n          - identity.reference: { name: fkUser,  fields: [userId],  references: User,  onDelete: cascade }\n          - identity.reference: { name: fkGroup, fields: [groupId], references: Group, onDelete: cascade }\n\n    - object.entity:\n        name: RolePermission\n        description: A permission granted by a role.\n        children:\n          - field.uuid: { name: roleId,       required: true }\n          - field.uuid: { name: permissionId, required: true }\n          - identity.primary:   { name: pk, fields: [roleId, permissionId], generation: assigned }\n          - identity.reference: { name: fkRole,       fields: [roleId],       references: Role,       onDelete: cascade }\n          - identity.reference: { name: fkPermission, fields: [permissionId], references: Permission, onDelete: restrict }\n\n    - object.entity:\n        name: UserRole\n        description: A system-wide grant of a role to a user.\n        children:\n          - field.uuid:      { name: userId, required: true }\n          - field.uuid:      { name: roleId, required: true }\n          - field.timestamp: { name: grantedAt, autoSet: onCreate }\n          - identity.primary:   { name: pk, fields: [userId, roleId], generation: assigned }\n          - identity.reference: { name: fkUser, fields: [userId], references: User, onDelete: cascade }\n          - identity.reference: { name: fkRole, fields: [roleId], references: Role, onDelete: restrict }\n\n    - object.entity:\n        name: GroupMemberRole\n        description: A grant of a role to a user WITHIN one group. Three foreign keys, so it is not an M:N @through junction (which must declare exactly two identity.reference children); it is read by explicit finders.\n        children:\n          - field.uuid:      { name: userId,  required: true }\n          - field.uuid:      { name: groupId, required: true }\n          - field.uuid:      { name: roleId,  required: true }\n          - field.timestamp: { name: grantedAt, autoSet: onCreate }\n          - identity.primary:   { name: pk, fields: [userId, groupId, roleId], generation: assigned }\n          - identity.reference: { name: fkUser,  fields: [userId],  references: User,  onDelete: cascade }\n          - identity.reference: { name: fkGroup, fields: [groupId], references: Group, onDelete: cascade }\n          - identity.reference: { name: fkRole,  fields: [roleId],  references: Role,  onDelete: restrict }\n',
+    'iam/model': '# library/iam/model.yaml — the CORE layer: identity and access management.\n#\n# Adopters opt in via `libraries: ["iam"]` in .metaobjects/config.json.\n#\n# This layer declares NO `source.rdb`, and that is the whole point of the split. A\n# sourceless object is inert by a contract that already ships: migrate skips an object\n# with no writable source, and codegen emits no route, queries, hooks, grid or form for\n# one (both citing #248 — persistability derives from source presence, never from the\n# object subtype). It still gets a type-only interface, so `extends` and reference work.\n#\n# So `libraries: ["iam"]` adds ZERO tables and ZERO generated code. What an adopter gains\n# is the design being present and resolvable: an agent working in the repo knows the\n# capability exists and can draw on it, and nothing else happens until the adopter adds\n# `"iam/db"`.\n#\n# Authoring discipline (FR-043 §3.1), so the departures are visible:\n#   - `field.uuid` + `generation: uuid` on principals; composite ASSIGNED keys on\n#     junctions. Never `increment` — a library cannot know the adopter\'s id strategy.\n#   - Physical names carry the `iam_` prefix (in db.yaml): `user` and `group` are\n#     reserved words in Postgres, and an adopter has tables of their own.\n#   - No adopter-facing profile data. That arrives by `overlay: true`.\n#   - No credentials. See requirements.yaml → `noCredentialsOnUser`.\nmetadata:\n  package: metaobjects::iam\n  children:\n    - object.entity:\n        name: IamBase\n        abstract: true\n        description: Shared shape of every iam principal and definition — a stable uuid plus change timestamps. Junctions do not extend it; they are addressed by their participants.\n        children:\n          - field.uuid:      { name: id, required: true }\n          - field.timestamp: { name: createdAt, autoSet: onCreate }\n          - field.timestamp: { name: updatedAt, autoSet: onUpdate }\n\n    - object.entity:\n        name: User\n        extends: IamBase\n        description: A person or service account that can be granted access. Carries no authentication secret of any kind — see the noCredentialsOnUser requirement.\n        children:\n          - field.string:    { name: username, required: true, maxLength: 64, filterable: true }\n          - field.string:    { name: email, required: true, maxLength: 254, stringFormat: email, filterable: true }\n          - field.string:    { name: displayName, maxLength: 120 }\n          # NOT `filterable: true`, deliberately. The loader warns when a filterable\n          # field is in no identity — filtering on it sequential-scans — and a library\n          # must not ship a warning to every adopter. `username` and `email` carry it\n          # because they have identity.secondary; `status` does not. An adopter who\n          # wants to filter on status overlays `filterable` AND an index together,\n          # which is exactly what the layer split is for.\n          - field.enum:      { name: status, required: true, values: [invited, active, suspended, closed], default: active }\n          - field.timestamp: { name: emailVerifiedAt }\n          - field.timestamp: { name: lastSeenAt }\n          - identity.primary:   { name: pk, fields: [id], generation: uuid }\n          - identity.secondary: { name: uqUsername, fields: [username] }\n          - identity.secondary: { name: uqEmail, fields: [email] }\n          - relationship.association: { name: groups, objectRef: Group, cardinality: many, through: GroupMember }\n          - relationship.association: { name: roles,  objectRef: Role,  cardinality: many, through: UserRole }\n\n    - object.entity:\n        name: GroupType\n        extends: IamBase\n        description: What KIND of group this is — a team, a tenant, a project. An entity rather than an enum, because "which roles may be held in this kind of group" is data an adopter extends, and an enum\'s values cannot be extended by overlay.\n        children:\n          - field.string: { name: key, required: true, maxLength: 64 }\n          - field.string: { name: name, required: true, maxLength: 120 }\n          - field.string: { name: description, maxLength: 500 }\n          - identity.primary:   { name: pk, fields: [id], generation: uuid }\n          - identity.secondary: { name: uqGroupTypeKey, fields: [key] }\n\n    - object.entity:\n        name: Group\n        extends: IamBase\n        description: A nestable collection of users, of a declared GroupType. Nesting is by parentId; acyclicity is an invariant the schema cannot express — see the acyclicGroupNesting requirement.\n        children:\n          - field.uuid:   { name: groupTypeId, required: true }\n          - field.uuid:   { name: parentId }\n          - field.string: { name: key, required: true, maxLength: 64 }\n          # Not filterable for the same reason as User.status above.\n          - field.string: { name: name, required: true, maxLength: 120 }\n          - field.string: { name: description, maxLength: 500 }\n          - identity.primary:   { name: pk, fields: [id], generation: uuid }\n          - identity.secondary: { name: uqGroupKey, fields: [key] }\n          - identity.reference: { name: fkGroupType, fields: [groupTypeId], references: GroupType, onDelete: restrict }\n          - identity.reference: { name: fkParent,    fields: [parentId],    references: Group,     onDelete: restrict }\n\n    - object.entity:\n        name: Role\n        extends: IamBase\n        description: A reusable bundle of permissions. Code never compares a role NAME to a literal — it asks whether a user holds a permission, and the mapping is data.\n        children:\n          - field.string: { name: key, required: true, maxLength: 64 }\n          - field.string: { name: name, required: true, maxLength: 120 }\n          - field.string: { name: description, maxLength: 500 }\n          - field.uuid:   { name: groupTypeId, description: "When set, this role may be held only within groups of this type; absent means grantable anywhere." }\n          - identity.primary:   { name: pk, fields: [id], generation: uuid }\n          - identity.secondary: { name: uqRoleKey, fields: [key] }\n          - identity.reference: { name: fkGroupType, fields: [groupTypeId], references: GroupType, onDelete: restrict }\n          - relationship.association: { name: permissions, objectRef: Permission, cardinality: many, through: RolePermission }\n\n    - object.entity:\n        name: Permission\n        extends: IamBase\n        description: "The assignable unit — a stable <resource>:<action> key the application checks against. An entity, not an enum, on ADR-0037\'s own reasoning: it has its own identity, its own lifecycle, and a junction with real foreign keys."\n        children:\n          - field.string: { name: key, required: true, maxLength: 128, description: "Stable <resource>:<action> key the application checks against." }\n          - field.string: { name: description, maxLength: 500 }\n          - identity.primary:   { name: pk, fields: [id], generation: uuid }\n          - identity.secondary: { name: uqPermissionKey, fields: [key] }\n\n    # ---- grant surface: every grant is a row, addressed by its participants ----\n    #\n    # Junctions do NOT extend IamBase: they have no identity of their own, and adding a\n    # surrogate uuid to a row whose identity IS its participants invites a duplicate.\n\n    - object.entity:\n        name: GroupMember\n        description: A user\'s membership of a group.\n        children:\n          - field.uuid:      { name: userId,  required: true }\n          - field.uuid:      { name: groupId, required: true }\n          - field.timestamp: { name: joinedAt, autoSet: onCreate }\n          - identity.primary:   { name: pk, fields: [userId, groupId], generation: assigned }\n          - identity.reference: { name: fkUser,  fields: [userId],  references: User,  onDelete: cascade }\n          - identity.reference: { name: fkGroup, fields: [groupId], references: Group, onDelete: cascade }\n\n    - object.entity:\n        name: RolePermission\n        description: A permission granted by a role.\n        children:\n          - field.uuid: { name: roleId,       required: true }\n          - field.uuid: { name: permissionId, required: true }\n          - identity.primary:   { name: pk, fields: [roleId, permissionId], generation: assigned }\n          - identity.reference: { name: fkRole,       fields: [roleId],       references: Role,       onDelete: cascade }\n          - identity.reference: { name: fkPermission, fields: [permissionId], references: Permission, onDelete: restrict }\n\n    - object.entity:\n        name: UserRole\n        description: A system-wide grant of a role to a user.\n        children:\n          - field.uuid:      { name: userId, required: true }\n          - field.uuid:      { name: roleId, required: true }\n          - field.timestamp: { name: grantedAt, autoSet: onCreate }\n          - identity.primary:   { name: pk, fields: [userId, roleId], generation: assigned }\n          - identity.reference: { name: fkUser, fields: [userId], references: User, onDelete: cascade }\n          - identity.reference: { name: fkRole, fields: [roleId], references: Role, onDelete: restrict }\n\n    - object.entity:\n        name: GroupMemberRole\n        description: A grant of a role to a user WITHIN one group. Three foreign keys, so it is not an M:N @through junction (which must declare exactly two identity.reference children); it is read by explicit finders.\n        children:\n          - field.uuid:      { name: userId,  required: true }\n          - field.uuid:      { name: groupId, required: true }\n          - field.uuid:      { name: roleId,  required: true }\n          - field.timestamp: { name: grantedAt, autoSet: onCreate }\n          - identity.primary:   { name: pk, fields: [userId, groupId, roleId], generation: assigned }\n          - identity.reference: { name: fkUser,  fields: [userId],  references: User,  onDelete: cascade }\n          - identity.reference: { name: fkGroup, fields: [groupId], references: Group, onDelete: cascade }\n          - identity.reference: { name: fkRole,  fields: [roleId],  references: Role,  onDelete: restrict }\n',
     'iam/requirements': '# library/iam/requirements.yaml — what this library\'s design PROMISES.\n#\n# This is what makes iam a library rather than a schema snippet. Without requirements an\n# adopter gets nine tables; with them they get nine tables plus a build that is held to\n# "no authorization decision is hard-wired to a name", which no snippet can do.\n#\n# Two reading rules, both load-bearing:\n#\n#   `live` here means "the model AS SHIPPED realises this" — never "your application\n#   does". A ledger binds to model nodes; runtime guarantees are the runtime\'s tests, and\n#   this library does not invent a way to point a requirement at code (@verifiedBy was\n#   retired for exactly that). Behaviour the model cannot carry ships as `partial` +\n#   `disposition: accepted` with a notes sentence naming what the adopter must do.\n#\n#   The functional tree roots at L2, not L1. L1 is the adopter\'s SOLUTION, and a library\n#   is by definition a segment of someone else\'s. Architectural claims ship flat.\n#\n# HIERARCHY IS NESTING, and the L4/L5 split is grain. The concerns are CHILDREN of the L2\n# rather than its siblings, and an L4 names the OBJECT it is about while the field that\n# carries it hangs off it as an L5 child. Written flat, the L2 claims nothing in its whole\n# subtree; written at L4, a field reference is ERR_REQUIREMENT_L4_NOT_OBJECT. Both shipped\n# here until the standalone verify gate existed (`cli/test/shipped-library-verify.test.ts`).\nmetadata:\n  package: metaobjects::iam\n  children:\n    # ---- functional: the L2 segment and the concerns nested under it --------\n    - requirement.functional:\n        name: accessControl\n        level: 2\n        status: live\n        statement: Who may do what is answered from stored grants, never from a name compared to a literal in code.\n        counterexample: A branch that reads `if (user.role === "admin")`.\n        description: The segment this library covers. The concerns beneath it are what it decomposes into.\n        children:\n          - requirement.functional:\n              name: identity\n              level: 4\n              status: live\n              statement: A person or service account is represented once, addressed by a uuid, and reachable by username or email.\n              counterexample: Two rows for the same person because the email changed.\n              implementedBy: [User]\n\n          - requirement.functional:\n              name: grouping\n              level: 4\n              status: live\n              statement: Users are collected into typed, nestable groups, and the kind of group is data rather than a hard-coded set.\n              counterexample: A `teamOrTenant` boolean.\n              implementedBy: [Group, GroupType, GroupMember]\n\n          - requirement.functional:\n              name: acyclicGroupNesting\n              level: 4\n              status: partial\n              disposition: accepted\n              statement: A group is never its own ancestor.\n              counterexample: Two groups each naming the other as parent.\n              notes: >-\n                The schema cannot express this — a self-referencing FK admits a cycle, and the\n                only relational forms that would catch it (a recursive CHECK, a closure table\n                maintained by trigger) are DB-specific and would not survive three dialects.\n                The adopter enforces it where the write happens. Recorded rather than omitted\n                so an agent reading the ledger before adding a parent-setting endpoint sees the\n                obligation.\n              implementedBy: [Group]\n\n          - requirement.functional:\n              name: grants\n              level: 4\n              status: live\n              statement: A role is granted to a user either system-wide or scoped to one group, and both are ordinary rows.\n              counterexample: A nullable `groupId` on one grant table, where NULL means "everywhere".\n              description: >-\n                Two junctions, not one with a nullable scope. A NULL in a unique key is DISTINCT\n                from every other NULL in SQL, so a nullable-scope design lets the same global\n                grant be inserted twice; the fix needs a partial index whose expression carries\n                a physical column name. Two composite-keyed tables need no escape hatch and\n                survive three dialects and five ports unchanged.\n              implementedBy: [UserRole, GroupMemberRole]\n\n          - requirement.functional:\n              name: roleScopedToGroupType\n              level: 4\n              status: partial\n              disposition: accepted\n              statement: A role bound to a group type is granted only within groups of that type.\n              counterexample: A "tenant admin" role granted inside a project group.\n              notes: >-\n                Expressing this relationally needs the grant row to carry the group\'s type and\n                a composite FK back to (group, type) — three foreign keys deep, unverified\n                across five ports\' DDL and ORM paths. The adopter checks it at the point of\n                grant. The declared half is the L5 child below; the enforcement is not.\n              implementedBy: [Role, GroupMemberRole]\n              children:\n                - requirement.functional:\n                    name: roleDeclaresItsGroupType\n                    level: 5\n                    status: live\n                    statement: A role declares the group type it is bound to, as a nullable reference.\n                    counterexample: A role whose intended scope is recoverable only from its name.\n                    description: >-\n                      `live` where its parent is `partial`, and the split is grain as much as\n                      verdict: the DECLARATION is shipped and resolves against the field itself,\n                      so dropping the column fails the build — while the ENFORCEMENT, which no\n                      schema here can carry, stays the parent\'s accepted gap.\n                    implementedBy: [Role.groupTypeId]\n\n          - requirement.functional:\n              name: decision\n              level: 4\n              status: live\n              statement: An authorization decision is the question "does this user hold this permission key", answered from rows.\n              counterexample: A hard-coded list of usernames that bypass a check.\n              implementedBy: [Permission, RolePermission]\n\n    # ---- architectural: prohibitions in force --------------------------------\n\n    - requirement.architectural:\n        name: grantsAreRows\n        status: live\n        statement: A grant exists only as a stored row; nothing is granted by naming, position or convention.\n        counterexample: A superuser recognised by username.\n        implementedBy: [UserRole, GroupMemberRole, RolePermission, GroupMember]\n\n    - requirement.architectural:\n        name: noCredentialsOnUser\n        status: live\n        statement: A user row carries no authentication secret — no password, no hash, no knowledge-based question or answer.\n        counterexample: A password or secret-answer column on the user table.\n        description: >-\n          Authentication is a separate capability with an entity per factor; this library\n          is identity and authorization only.\n        notes: >-\n          This is the one thing every reader of a user table proposes adding, and a real\n          legacy model of this shape stored a length-bounded plaintext password and a\n          knowledge-based secret pair on the user row. Stating it as a prohibition IN\n          FORCE — claimable, and rendered on agent/requirements.md — is what stops an\n          agent extending "the user model" from re-deriving it on sight. It is\n          `architectural`, not `retired`: retired is chartered for a capability built\n          here and removed, and this library never built one.\n        implementedBy: [User]\n\n    - requirement.architectural:\n        name: principalDeletionRevokesGrants\n        status: live\n        statement: Deleting a user or group removes its grants; deleting a role or permission still in use is refused.\n        counterexample: A grant row pointing at a user who no longer exists.\n        description: The referential rule in one sentence — cascade from a principal, restrict from a definition.\n        implementedBy: [GroupMember, UserRole, GroupMemberRole, RolePermission]\n\n    - requirement.architectural:\n        name: stableIdentifiers\n        status: live\n        statement: Every principal and definition is addressed by a uuid that never changes; every grant by its participants.\n        counterexample: A group referenced by its display name.\n        implementedBy: [IamBase]\n',
 }
 

{metaobjects-1.0.4 → metaobjects-1.0.5rc1}/src/metaobjects/meta/core/requirement/requirement_constants.py

@@ -9,8 +9,10 @@ the loader like everything else — never hand-parsed from a side file.
 # ---------------------------------------------------------------------------
 # Subtypes — the axis is the CHECK POLARITY, a genuine behaviour difference and
 # therefore a subtype under ADR-0037 §2:
-#   functional    -> EXISTENCE:    fails when nothing implements it
-#   architectural -> UNIVERSALITY: fails when something violates it
+#   functional    -> EXISTENCE:    `meta verify` warns when nothing implements it,
+#                                    and fails when a node it names is gone
+#   architectural -> UNIVERSALITY: `meta verify` fails a live policy applied to nothing
+#                                    (it does not check that each claimed node complies)
 # ---------------------------------------------------------------------------
 REQUIREMENT_SUBTYPE_FUNCTIONAL = "functional"
 REQUIREMENT_SUBTYPE_ARCHITECTURAL = "architectural"

{metaobjects-1.0.4 → metaobjects-1.0.5rc1}/src/metaobjects/spec_metamodel/requirement.json

@@ -4,7 +4,7 @@
     {
       "type": "requirement",
       "subType": "functional",
-      "description": "What the product does for a user, stated as one violable claim. Its check is EXISTENCE: it fails when nothing implements it. Hierarchy is nesting — an L1 solution contains its L2 segments, which contain L3 services, and so on down to the levels that reference the model.",
+      "description": "What the product does for a user, stated as one violable claim. Its check is EXISTENCE, run by `meta verify`: a live or partial claim with no implementing node anywhere in its subtree is a warning, and a named node that no longer exists is an error. Hierarchy is nesting — an L1 solution contains its L2 segments, which contain L3 services, and so on down to the levels that reference the model.",
       "whenToUse": "Something exists because someone asked for it. L1-L3 are levels of ABSTRACTION AND OWNERSHIP in the problem domain — whose need is this, and at what altitude — and are never a directory, package, deployable or module. Binding to technical constructs happens only at L4 (an object) and L5 (a member), which is the allocation step. Test every node: if a refactor that changes no behaviour would force it to move, its level is wrong.",
       "children": [
         {
@@ -96,7 +96,7 @@
     {
       "type": "requirement",
       "subType": "architectural",
-      "description": "How the system is built, applied uniformly across the model. Its check is UNIVERSALITY: it fails when something VIOLATES it, which is the opposite polarity to a functional requirement. Flat by default and object-independent; it may optionally sit in a levelled tree when a quality taxonomy is being used to organise non-functional requirements.",
+      "description": "How the system is built, applied uniformly across the model. Its check is UNIVERSALITY, the opposite polarity to a functional requirement. What `meta verify` enforces is that a live or partial policy is applied at all — one claiming nothing is an error — not that each node it claims complies. Flat by default and object-independent; it may optionally sit in a levelled tree when a quality taxonomy is being used to organise non-functional requirements.",
       "whenToUse": "Something exists because every entity here looks like this — a uuid primary key, an @autoSet createdAt, a change-attribution column, tenant scoping. The discriminator is mechanical: did this exist because someone asked for something, or because it is the architecture? For a non-functional tree, an established quality taxonomy makes a good fixed upper structure (e.g. an ISO/IEC 25010 characteristic at L1, its sub-characteristic or a control-catalogue category at L2), with the model-binding claims at L4 and L5 as usual.",
       "children": [
         {

metaobjects-1.0.5rc1/tests/codegen/test_codegen_compile_conformance.py

@@ -0,0 +1,156 @@
+"""CODEGEN-COMPILE CONFORMANCE (Python lane).
+
+Generate from the SHARED cross-port corpus — ``fixtures/persistence-conformance/
+canonical/meta.fitness.json`` — and prove every emitted module actually loads.
+
+WHY THIS EXISTS. Four defects shipped in 1.0.4 that every existing gate was blind to,
+because each one produced output that PARSES and GENERATES cleanly and only fails when
+somebody builds it:
+
+  - a view over an int-backed enum imported a codec drizzle does not export (TS);
+  - a renamed projection field selected a column that does not exist (TS);
+  - a DbContext named FK config through ``nameof`` on a member that is not there (C#);
+  - an extract mapper did not compile for most scalar subtypes (Java).
+
+``metaobjects gen`` exits 0 in all four cases. The metamodel, render, persistence,
+api-contract and registry corpora all stay green — they gate BEHAVIOR, and none of them
+asks whether the emitted code builds. The adopter's build is the first thing that does,
+which makes the adopter the gate. This closes that.
+
+WHY TWO CHECKS, NOT ONE. Python has no static compiler, so the peer ports' single
+"zero diagnostics" assertion has to be reconstructed from two halves, and neither half
+alone is the gate:
+
+  1. IMPORT the generated package. ``compile()`` alone only parses — it cannot tell a
+     name that does not exist from one that does. Importing runs each module's top level
+     for real, which is what resolves the package-relative imports the generators emit
+     BETWEEN modules; that cross-module agreement is the defect class the TS lane's
+     ``ts.createProgram`` catches and a per-file check structurally cannot.
+  2. ``ruff check`` for undefined names. Importing only executes the module's top level,
+     so an undefined name inside a function body that nothing calls stays invisible.
+     F821 reads those branches statically. ruff is in the ``[dependency-groups] dev``
+     group ``uv run`` installs, so it is present wherever this test runs; mypy is NOT
+     (it is declared only under ``[project.optional-dependencies] dev``), which is why
+     this does not reach for it.
+
+WHAT IT EXCLUDES: the ``routes`` generator, whose output imports FastAPI. Every peer
+port draws the same line for the same reason (TS omits routesFile, C# omits
+RoutesGenerator, Java omits SpringControllerGenerator) — the framework tier is proven by
+the api-contract integration lane, which boots the generated router over real HTTP. It
+also keeps this file runnable without ``--extra integration``.
+
+The prompt-tier generators (payload / output-parser / output-prompt / render-helper /
+extractor / trace-helper) are absent because they key off ``template.*`` nodes and this
+corpus declares none — including them would emit nothing and read as coverage that is
+not there.
+
+The peer lanes are the same test in each port. If one port drops out, that port keeps
+precisely the bug class this exists to catch — so a skip here is never "just this lane".
+"""
+from __future__ import annotations
+
+import importlib
+import subprocess
+import sys
+from pathlib import Path
+
+from metaobjects import load_uris
+from metaobjects.codegen.config import GenConfig
+from metaobjects.codegen.generators.entity_model import entity_model
+from metaobjects.codegen.generators.filter_allowlist_generator import (
+    filter_allowlist_generator,
+)
+from metaobjects.codegen.generators.names_generator import names_generator
+from metaobjects.codegen.runner import run_gen
+
+# tests/codegen/ -> tests -> python -> server -> repo root
+CORPUS = (
+    Path(__file__).parents[4]
+    / "fixtures"
+    / "persistence-conformance"
+    / "canonical"
+    / "meta.fitness.json"
+)
+
+
+def _load_corpus():
+    result = load_uris([CORPUS.as_uri()])
+    assert not result.errors, "The shared corpus must load cleanly before anything " \
+        "can be generated from it:\n" + "\n".join(
+            f"  {getattr(e, 'code', 'ERROR')}: {e.message}" for e in result.errors
+        )
+    return result.root
+
+
+def _generate(out_dir: Path) -> list[Path]:
+    """Run the model-tier generators through run_gen — the real orchestrator.
+
+    Going through ``run_gen`` rather than calling ``generate()`` on each generator is
+    deliberate: it is what composes each generator's own ``filter`` into ``ctx.matches``
+    (``runner._matcher``) and what emits the ``__init__.py`` files that make the output
+    an importable package. A harness that skipped it would measure itself.
+    """
+    config = GenConfig(out_dir=str(out_dir), emit_package_init=True)
+    result = run_gen(
+        config,
+        _load_corpus(),
+        generators=[entity_model(), names_generator(), filter_allowlist_generator()],
+    )
+    written = sorted(out_dir.rglob("*.py"))
+    assert written, f"the corpus generated no Python modules at all: {result.warnings}"
+    return written
+
+
+def test_every_generated_module_imports(tmp_path: Path) -> None:
+    """Import each emitted module for real — the cross-module resolution check."""
+    out_dir = tmp_path / "generated"
+    written = _generate(out_dir)
+
+    sys.path.insert(0, str(tmp_path))
+    try:
+        failures: list[str] = []
+        for path in written:
+            dotted = ".".join(path.relative_to(tmp_path).with_suffix("").parts)
+            # A package's __init__ is imported under the package's own name.
+            if dotted.endswith(".__init__"):
+                dotted = dotted[: -len(".__init__")]
+            try:
+                importlib.import_module(dotted)
+            except Exception as exc:  # noqa: BLE001 — every failure mode is a finding
+                failures.append(f"{path.relative_to(out_dir)}: {type(exc).__name__}: {exc}")
+        assert not failures, (
+            f"`metaobjects gen` over the shared fitness corpus emitted {len(written)} "
+            f"module(s), {len(failures)} of which do not import:\n" + "\n".join(failures)
+        )
+    finally:
+        sys.path.remove(str(tmp_path))
+        for name in [m for m in sys.modules if m.split(".")[0] == "generated"]:
+            del sys.modules[name]
+
+
+def test_no_generated_module_references_an_undefined_name(tmp_path: Path) -> None:
+    """ruff F821 over the emitted tree — the branches importing never executes.
+
+    Scoped to the name-resolution rules on purpose. A generated file is allowed to be
+    untidy (an unused import is not an adopter's broken build); it is not allowed to
+    name something that does not exist.
+    """
+    out_dir = tmp_path / "generated"
+    _generate(out_dir)
+
+    proc = subprocess.run(
+        [
+            sys.executable, "-m", "ruff", "check",
+            "--no-cache",
+            "--isolated",  # never inherit the repo's own ruff config
+            "--select", "F821,F822,F811,E9",
+            "--output-format", "concise",
+            str(out_dir),
+        ],
+        capture_output=True,
+        text=True,
+    )
+    assert proc.returncode == 0, (
+        "`metaobjects gen` over the shared fitness corpus emitted code that names "
+        "something undefined:\n" + proc.stdout + proc.stderr
+    )