mostlyright-data 0.14.0__tar.gz → 0.14.1__tar.gz

{mostlyright_data-0.14.0 → mostlyright_data-0.14.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mostlyright-data
-Version: 0.14.0
+Version: 0.14.1
 Summary: Mostly Right CLI for reproducible, reviewed Parquet datasets
 Project-URL: Homepage, https://mostlyright.md/
 Project-URL: Documentation, https://mostlyright.md/docs/guides/cli/

{mostlyright_data-0.14.0 → mostlyright_data-0.14.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mostlyright-data"
-version = "0.14.0"
+version = "0.14.1"
 description = "Mostly Right CLI for reproducible, reviewed Parquet datasets"
 readme = "README.md"
 requires-python = ">=3.13,<3.14"

{mostlyright_data-0.14.0 → mostlyright_data-0.14.1}/skills/mr-data-build/SKILL.md

@@ -525,6 +525,24 @@ which Studio fixes. Do it once per dataset, silently, and do not repeat it for a
 subject changed. A dataset presented without a cover is a defect, the same as a one-line
 description.
 
+### Say what each source is
+
+Every entry in `sources` takes an optional `description`, and every one you write gets one. It is
+a single sentence saying what that source **is** — `Daily climatological reports, the official
+highs and lows.` — and the dataset page draws it beside the endpoint, under the publisher it came
+from. That line is the only place a reader ever learns what a URL full of query parameters
+actually returned, so it is written for somebody who has never seen the recipe.
+
+Write it about the DATA, never about the run: `Hourly airport surface observations` and not `the
+2024 half of the window`, `fetched as CSV` or `unioned in step one`. Do not restate the address in
+words, and do not repeat the publisher's product code where it says nothing a reader can use. Up
+to 240 characters, which is one sentence rather than two. Where one window is split across several
+sources on the same endpoint, all of them describe the same thing and get the same sentence — the
+years are already in their names.
+
+Leaving it out is a defect in the same way a one-line dataset description is: the source is then
+drawn with its endpoint alone, and a reader is left to guess from a query string.
+
 ### Say what each column shows
 
 Decide, per column, what a reader should see, and write it on the column as `presentation`. This is

{mostlyright_data-0.14.0 → mostlyright_data-0.14.1}/src/mostlyright/data_harness/hosted_stream_subscription_worker.py

@@ -17,6 +17,7 @@ its own.
 from __future__ import annotations
 
 import asyncio
+import logging
 import os
 import shutil
 import stat
@@ -281,15 +282,7 @@ def _materialized_claim_connector(
     root = Path(tempfile.mkdtemp(prefix="stream-subscription-feed-", dir=work_root))
     try:
         os.chmod(root, 0o700)
-        registry_root = root / "registry"
-        registry_root.mkdir(mode=0o700)
-        materialize_connector_registry(
-            transport=objects,
-            bucket=_claim_text(claim.stream_venue_bucket, "stream venue bucket"),
-            registry_prefix=_claim_text(claim.connector_registry_prefix, "registry prefix"),
-            registry_digest=_claim_text(claim.connector_registry_digest, "registry digest"),
-            root=registry_root,
-        )
+        registry_root = _materialized_registry_root(claim, objects, root)
         registry = load_stream_connector_registry(registry_root)
         entry = registry.resolve(
             _claim_text(claim.connector_id, "connector id"),
@@ -314,6 +307,33 @@ def _materialized_claim_connector(
         shutil.rmtree(root, ignore_errors=True)
 
 
+def _materialized_registry_root(
+    claim: ClaimedSubscription, objects: GCSObjectTransport, root: Path
+) -> Path:
+    """Materialize the pinned registry under ``root`` and file its series documents.
+
+    ONE MATERIALIZATION SHAPE FOR BOTH LOADERS.  A published registry is one flat name-to-digest
+    table; the connector loader reads the documents directly beneath the root and the series
+    loader reads the ``series`` directory under it.  A subscription that follows a series is
+    pinned to a registry that carries both kinds by construction, so a root left unsorted is not
+    a connector registry at all and the feed is refused before it opens.
+    """
+
+    registry_root = root / "registry"
+    registry_root.mkdir(mode=0o700)
+    series_root = registry_root / SERIES_DIRECTORY_NAME
+    series_root.mkdir(mode=0o700)
+    materialize_connector_registry(
+        transport=objects,
+        bucket=_claim_text(claim.stream_venue_bucket, "stream venue bucket"),
+        registry_prefix=_claim_text(claim.connector_registry_prefix, "registry prefix"),
+        registry_digest=_claim_text(claim.connector_registry_digest, "registry digest"),
+        root=registry_root,
+    )
+    _sort_series_documents(registry_root, series_root)
+    return registry_root
+
+
 def _claim_text(value: str | None, label: str) -> str:
     if not isinstance(value, str) or not value:
         raise StreamSubscriptionError("STREAM_SUBSCRIPTION_CONNECTOR_INVALID", label)
@@ -385,18 +405,7 @@ def _materialized_claim_series(
     root = Path(tempfile.mkdtemp(prefix="stream-subscription-series-", dir=work_root))
     try:
         os.chmod(root, 0o700)
-        registry_root = root / "registry"
-        registry_root.mkdir(mode=0o700)
-        series_root = registry_root / SERIES_DIRECTORY_NAME
-        series_root.mkdir(mode=0o700)
-        materialize_connector_registry(
-            transport=objects,
-            bucket=_claim_text(claim.stream_venue_bucket, "stream venue bucket"),
-            registry_prefix=_claim_text(claim.connector_registry_prefix, "registry prefix"),
-            registry_digest=_claim_text(claim.connector_registry_digest, "registry digest"),
-            root=registry_root,
-        )
-        _sort_series_documents(registry_root, series_root)
+        registry_root = _materialized_registry_root(claim, objects, root)
         documents = load_stream_series_documents(registry_root)
         held = documents.get(series.series_id)
         if held is None:
@@ -625,6 +634,7 @@ async def run_subscription_worker(
 def stream_subscription_worker_main(argv: Sequence[str] | None = None) -> int:
     """Cloud Run Worker Pool executable; it intentionally accepts no mutable CLI authority."""
 
+    _configure_worker_logging()
     arguments = tuple(sys.argv[1:] if argv is None else argv)
     if arguments:
         raise HostedStreamSubscriptionWorkerError(
@@ -636,6 +646,25 @@ def stream_subscription_worker_main(argv: Sequence[str] | None = None) -> int:
     return 0
 
 
+def _configure_worker_logging() -> None:
+    """Configure the root logger for the pool executable, on a stream its host collects.
+
+    A library module configures nothing; an executable must.  Unconfigured, this process fell
+    through to the last-resort handler, which emits a bare message with no level and no logger
+    name, so the pool's own refusals arrived unattributable.
+
+    Plain text on either stream is collected at DEFAULT severity, so the level is carried in the
+    line rather than in the record -- which is why the format names it.  Stdout is chosen over the
+    sibling executables' stderr for the same reason it is chosen anywhere: a stream that carries
+    ordinary progress as well as refusals is not the error stream.  An already-configured root is
+    left alone, which is what lets a smoke or a test harness own it instead.
+    """
+
+    logging.basicConfig(
+        level=logging.INFO, stream=sys.stdout, format="%(levelname)s %(name)s %(message)s"
+    )
+
+
 def _studio_origin(value: str | None) -> str:
     if not isinstance(value, str) or not 1 <= len(value) <= 2048 or value.endswith("/"):
         raise HostedStreamSubscriptionWorkerError(

{mostlyright_data-0.14.0 → mostlyright_data-0.14.1}/src/mostlyright/data_harness/stream_subscription_worker.py

@@ -132,6 +132,22 @@ class _SubscriptionCancelled(RuntimeError):
         self.desired_state = desired_state
 
 
+#: The largest ``volume_policy.max_bytes`` any worker in this pool can serve.
+#:
+#: A hot subscription gets two bounded buffers: one immutable segment may be sealing while its
+#: successor is being read.  Each is capped at half the per-claim budget so the queue does not
+#: turn a 16 MiB promise into 32 MiB during a slow upload/CAS.
+#:
+#: It is exported because it is a PROTOCOL CONSTANT, not a private detail: the control plane
+#: writes the policy a subscription starts with, so it needs the number to validate against at
+#: start rather than discovering it one lease at a time.
+MAX_VOLUME_POLICY_BYTES = MAX_BUFFERED_BYTES // 2
+
+#: The largest ``volume_policy.max_duration_seconds`` any worker in this pool can serve, equal to
+#: the longest a subscription may sit without data before its lease ends on its own.
+MAX_VOLUME_POLICY_DURATION_SECONDS = DEFAULT_NO_DATA_TIMEOUT_SECONDS
+
+
 @dataclass(frozen=True)
 class VolumePolicy:
     """One subscription's bounded rotation policy, set by Studio rather than a worker flag."""
@@ -140,17 +156,21 @@ class VolumePolicy:
     max_duration_seconds: int
 
     def __post_init__(self) -> None:
-        if (
-            isinstance(self.max_bytes, bool)
-            or isinstance(self.max_duration_seconds, bool)
-            # A hot subscription gets two bounded buffers: one immutable segment may be sealing
-            # while its successor is being read.  Cap each at half the per-claim budget so the
-            # queue does not turn a 16 MiB promise into 32 MiB during a slow upload/CAS.
-            or not 1 <= self.max_bytes <= MAX_BUFFERED_BYTES // 2
-            or not 1 <= self.max_duration_seconds <= DEFAULT_NO_DATA_TIMEOUT_SECONDS
+        # The refusal names the bound and the offered value, because the party that has to change
+        # the policy is the one that wrote it and it cannot act on "outside worker bounds".
+        if isinstance(self.max_bytes, bool) or not 1 <= self.max_bytes <= MAX_VOLUME_POLICY_BYTES:
+            raise StreamSubscriptionError(
+                "STREAM_SUBSCRIPTION_POLICY_INVALID",
+                f"volume policy max_bytes {self.max_bytes} is outside the worker bound "
+                f"1..{MAX_VOLUME_POLICY_BYTES}",
+            )
+        if isinstance(self.max_duration_seconds, bool) or not (
+            1 <= self.max_duration_seconds <= MAX_VOLUME_POLICY_DURATION_SECONDS
         ):
             raise StreamSubscriptionError(
-                "STREAM_SUBSCRIPTION_POLICY_INVALID", "volume policy is outside worker bounds"
+                "STREAM_SUBSCRIPTION_POLICY_INVALID",
+                f"volume policy max_duration_seconds {self.max_duration_seconds} is outside the "
+                f"worker bound 1..{MAX_VOLUME_POLICY_DURATION_SECONDS}",
             )
 
 
@@ -862,9 +882,12 @@ class RecoveryArtifact:
             )
 
     def to_dict(self) -> dict[str, object]:
+        # An object generation is a decimal STRING on the wire, the spelling the control plane's
+        # recovery-artifact schema contracts for.  It stays an int in the dataclass because that
+        # is what compares and orders; only the serialized form is text.
         return {
             "object_name": self.object_name,
-            "generation": self.generation,
+            "generation": str(self.generation),
             "sha256": self.sha256,
             "byte_length": self.byte_length,
             "media_type": self.media_type,
@@ -2083,6 +2106,8 @@ __all__ = [
     "MAX_DISCOVERY_EVIDENCE_BYTES",
     "MAX_ROSTER_MEMBERS",
     "MAX_SEGMENT_GAPS",
+    "MAX_VOLUME_POLICY_BYTES",
+    "MAX_VOLUME_POLICY_DURATION_SECONDS",
     "ROSTER_TICK_SECONDS",
     "ROTATION_SCHEMA_VERSION",
     "SEGMENT_ROTATION_SCHEMA_VERSION",

{mostlyright_data-0.14.0 → mostlyright_data-0.14.1}/src/mostlyright/data_harness/studio_subscription_control.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+import logging
+import re
 from collections.abc import Callable, Mapping, Sequence
 from dataclasses import dataclass, replace
 from typing import Any
@@ -37,7 +39,15 @@ from mostlyright.data_harness.stream_subscription_worker import (
 )
 from mostlyright.data_harness.stream_venue_staging import MAX_EVIDENCE_BYTES
 
+LOGGER = logging.getLogger(__name__)
+
 CLAIM_PATH = "/_internal/stream-subscriptions:claim"
+
+#: The largest object generation either spelling may carry, from the control plane's own
+#: nineteen-digit delivery grammar.  A generation is a storage coordinate, not arithmetic, so a
+#: number outside the grammar is a claim about an object no bucket issued.
+MAX_OBJECT_GENERATION = 10**19 - 1
+_OBJECT_GENERATION_TEXT = re.compile(r"[1-9][0-9]{0,18}")
 CREDENTIAL_RESOLUTION_SCHEMA_VERSION = "mostlyright-stream-subscription-credential-resolution.v1"
 _STAGING_ROLES = ("source_data", "acquisition_receipt", "source_observation")
 _STAGING_MEDIA_TYPES = {
@@ -72,6 +82,18 @@ class StudioSubscriptionControl:
             # The number was already parsed and checked here before it was carried; the only
             # change is that it now reaches the caller instead of being validated and dropped.
             return IdlePoll(poll_after_seconds=_integer(value, "poll_after_seconds", 1))
+        try:
+            return self._claimed(value)
+        except StreamSubscriptionError as error:
+            # A LEASE THIS WORKER CANNOT SERVE IS STILL A LEASE. Studio persists the lease before
+            # it answers, so a refusal that only raised would leave that lease to expire and be
+            # handed back on the next claim, forever, with nothing on the record saying why.
+            self._dispose_of_refused_claim(value, error)
+            raise
+
+    def _claimed(self, value: Mapping[str, Any]) -> ClaimedSubscription:
+        """The full claim, or a refusal naming the first member this worker cannot serve."""
+
         policy = _mapping(value, "volume_policy")
         claim_series = _series_claim(value.get("series"))
         claim = ClaimedSubscription(
@@ -120,6 +142,62 @@ class StudioSubscriptionControl:
             claim = replace(claim, resume_checkpoint=_resume_checkpoint(resume, claim))
         return claim
 
+    def _dispose_of_refused_claim(
+        self, value: Mapping[str, Any], error: StreamSubscriptionError
+    ) -> None:
+        """Dispose of a persisted lease this worker refused, on a best effort, and never raise.
+
+        TWO DISPOSITIONS, BECAUSE TWO DIFFERENT THINGS BOUND THEM.
+
+        A claim carrying no pending checkpoint is COMPLETED as failed. That charges the control
+        plane's failure budget, which spaces the retries and terminalizes the subscription once
+        the budget runs out, and it is the bound on a subscription this fleet cannot serve.
+
+        A claim carrying a ``resume_checkpoint`` is LEFT ALONE, and its lease runs out instead.
+        The control plane exempts a lease with a pending checkpoint from that budget -- a resume
+        is meant to survive a worker dying mid-segment -- and re-leases it as soon as it is free.
+        Completing one would therefore trade a lease expiry for an immediate reclaim, which is a
+        tighter loop than the one this method exists to end. Expiry is the slower of the two, so
+        expiry is what bounds this case.
+
+        The discriminator is the pending checkpoint rather than which member refused, because the
+        exemption is the control plane's and it is keyed on the same fact.
+        """
+
+        resuming = "resume_checkpoint" in value
+        LOGGER.warning(
+            "stream_subscription_claim_refused subscription_id=%s failure_code=%s disposition=%s",
+            _safe_subscription_id(value),
+            error.code,
+            "lease_expiry" if resuming else "completed_failed",
+        )
+        if resuming:
+            return
+        try:
+            url = _callback_url(value.get("complete_url"), origin=self.origin, label="complete")
+            body: dict[str, Any] = {
+                "schema_version": COMPLETE_SCHEMA_VERSION,
+                "lease_generation": _integer(value, "lease_generation", 1),
+                "terminal_reason": "failed",
+            }
+            self._post(url, body)
+        except SubscriptionFenceStale:
+            # The lease is already terminal, which is the outcome this was reaching for. A replay
+            # of a lost 5xx whose first attempt landed arrives here, so it is reported as done
+            # rather than as a completion that failed.
+            return
+        except Exception as unreported:
+            # Broad on purpose: whatever went wrong here, the refusal the caller is waiting on is
+            # the one that must reach it, so a second failure is logged and dropped rather than
+            # raised over the first.
+            LOGGER.warning(
+                "stream_subscription_claim_refusal_unreported subscription_id=%s failure_code=%s",
+                _safe_subscription_id(value),
+                unreported.code
+                if isinstance(unreported, StreamSubscriptionError)
+                else type(unreported).__name__,
+            )
+
     def resolve_credential(
         self, claim: ClaimedSubscription, *, credential_shape: str
     ) -> StreamCredential:
@@ -213,7 +291,8 @@ class StudioSubscriptionControl:
             "next_cursor": next_cursor,
             "segment_stream_id": capture.segment_stream_id,
             "manifest_object_name": capture.manifest_object_name,
-            "manifest_generation": capture.manifest_generation,
+            # Every object generation on the wire is text; the number stays an int in the capture.
+            "manifest_generation": str(capture.manifest_generation),
             "manifest_sha256": capture.manifest_sha256,
             "byte_length": capture.byte_length,
             "capture_digest": capture.capture_digest,
@@ -412,6 +491,42 @@ class StudioSubscriptionControl:
         raise AssertionError("unreachable")
 
 
+def _object_generation(value: Mapping[str, Any], name: str) -> int:
+    """One object generation, read from either spelling of the same bounded number.
+
+    EVERY OBJECT GENERATION ON THE WIRE IS TEXT, and an integer is admitted because a control
+    plane that echoes a stored coordinate back is not the place to relitigate a spelling.
+
+    The grammar is matched BEFORE the text is converted, and it is the control plane's own
+    nineteen-digit one.  An unbounded digit string is a refusal here: converting one crosses the
+    interpreter's own conversion limit and raises an untyped error out of a parser whose whole
+    contract is that it refuses in one vocabulary.
+    """
+
+    item = value.get(name)
+    if isinstance(item, str):
+        if not _OBJECT_GENERATION_TEXT.fullmatch(item):
+            raise StreamSubscriptionError("STREAM_SUBSCRIPTION_CLAIM_INVALID", name)
+        return int(item)
+    generation = _integer(value, name, 1)
+    if generation > MAX_OBJECT_GENERATION:
+        raise StreamSubscriptionError("STREAM_SUBSCRIPTION_CLAIM_INVALID", name)
+    return generation
+
+
+def _safe_subscription_id(value: Mapping[str, Any]) -> str:
+    """The claimed subscription id when it is a canonical UUID, and ``unknown`` otherwise.
+
+    A refusal log line must never repeat an unvalidated control-plane string, because the string
+    that failed to parse is exactly the one nothing has checked the shape of.
+    """
+
+    try:
+        return _uuid_text(value.get("stream_subscription_id"), "stream_subscription_id")
+    except StreamSubscriptionError:
+        return "unknown"
+
+
 def _code(raw: bytes) -> str | None:
     try:
         value = parse_json(raw)
@@ -541,7 +656,7 @@ def _resume_checkpoint(value: object, claim: ClaimedSubscription) -> ResumeCheck
     )
     capture = SealedCapture(
         manifest_object_name=_text(checkpoint, "manifest_object_name"),
-        manifest_generation=_integer(checkpoint, "manifest_generation", 1),
+        manifest_generation=_object_generation(checkpoint, "manifest_generation"),
         manifest_sha256=_digest(checkpoint.get("manifest_sha256"), "manifest sha256"),
         byte_length=_integer(checkpoint, "byte_length", 0),
         capture_digest=capture_digest,
@@ -622,7 +737,7 @@ def _recovery_inventory(
                 )
             artifacts[role] = RecoveryArtifact(
                 object_name=expected,
-                generation=_integer(artifact, "generation", 1),
+                generation=_object_generation(artifact, "generation"),
                 sha256=_digest(artifact.get("sha256"), f"{role} sha256"),
                 byte_length=_integer(artifact, "byte_length", 0),
                 media_type=_text(artifact, "media_type"),

{mostlyright_data-0.14.0 → mostlyright_data-0.14.1}/src/mostlyright/data_harness/v4_recipe.py

@@ -108,16 +108,17 @@ MAX_DESCRIPTION_CHARS = 2_000
 #: that does not share :data:`MAX_DESCRIPTION_CHARS`.
 #:
 #: ⚠ A SECOND CONSTANT RATHER THAN A WIDER FIRST ONE, AND THE DIFFERENCE IS WHICH WAY IT FAILS.
-#: Six members of this document are called ``description`` or ``claim_note``; five of them are
-#: bounded at 2000 by Studio's schema and exactly one -- the DATASET's -- at 4000. While this
-#: parser read 2000 for all six, a dataset description between 2001 and 4000 characters was
-#: ACCEPTED at registration and refused at the worker, half an hour later, on a document Studio had
-#: already agreed to: the one failure shape `docs/V4-ONE-GATE-CONTRACT.md` exists to remove.
-#: Widening the shared constant instead would have fixed that and broken the other five in the
-#: opposite direction -- the worker admitting a table description registration refuses -- so the
-#: bound that differs gets a constant that says so. ``tests/test_v4_recipe.py`` holds both against
-#: the pinned schema, and ``tests/test_thin_v4_datasets.py`` holds this one against the ceiling
-#: ``mr-data dataset set`` refuses at, so the client, the contract and the worker are one number.
+#: Seven members of this document are called ``description`` or ``claim_note`` and Studio bounds
+#: them at three different numbers: five at 2000, the DATASET's at 4000, and the SOURCE's at 240
+#: under :data:`MAX_SOURCE_DESCRIPTION_CHARS`. While this parser read 2000 for all of them, a
+#: dataset description between 2001 and 4000 characters was ACCEPTED at registration and refused
+#: at the worker, half an hour later, on a document Studio had already agreed to: the one failure
+#: shape `docs/V4-ONE-GATE-CONTRACT.md` exists to remove. Widening the shared constant instead
+#: would have fixed that and broken the others in the opposite direction -- the worker admitting a
+#: table description registration refuses -- so every bound that differs gets a constant that says
+#: so. ``tests/test_v4_recipe.py`` holds all three against the pinned schema, and
+#: ``tests/test_thin_v4_datasets.py`` holds this one against the ceiling ``mr-data dataset set``
+#: refuses at, so the client, the contract and the worker are one number.
 MAX_DATASET_DESCRIPTION_CHARS = 4_000
 MAX_QUESTION_CHARS = 4_000
 MAX_DISPLAY_LOCATOR_CHARS = 2_048
@@ -132,6 +133,12 @@ MAX_SQL_CHARS = 65_536
 MAX_NULL_PPM = 1_000_000
 MAX_STORY_CHARS = 240
 
+#: What a SOURCE's sentence may run to: a third ceiling rather than a wider share of one of the
+#: other two, for the reason :data:`MAX_DATASET_DESCRIPTION_CHARS` records at length.  It equals
+#: :data:`MAX_STORY_CHARS` today because both are a sentence drawn on one line of the dataset
+#: page, not because the two members are one contract, so neither may be spelled as the other.
+MAX_SOURCE_DESCRIPTION_CHARS = 240
+
 #: How many bins a column may ask its chart to be drawn in.  The ceiling is the same twelve the
 #: released distribution bounds its items at, so a document can never ask for a chart with more
 #: marks than the profile that carries it is allowed to hold.
@@ -342,7 +349,7 @@ _SOURCE = (
             "source_class",
         }
     ),
-    frozenset({"binding", "credential"}),
+    frozenset({"binding", "credential", "description"}),
 )
 _LOCATOR = (
     frozenset({"display_locator", "kind"}),
@@ -668,6 +675,12 @@ class V4Source:
     """
 
     name: str
+    #: One sentence saying what this source is, for a reader of the dataset page rather than for
+    #: this parser: the page draws it under the endpoint the locator names.  Nothing this module
+    #: computes reads it, and no run behaves differently for its presence -- which is exactly why
+    #: it is parsed here rather than left to travel unchecked: an absent bound is how a member
+    #: that only a page reads arrives at the page as four kilobytes of somebody's notes.
+    description: str | None
     source_class: str
     data_classification: str
     locator: V4SourceLocator
@@ -1193,8 +1206,19 @@ def _parse_source(value: Any, label: str) -> V4Source:
     members = _members(value, label, _SOURCE)
     credential = _optional(members, "credential", label)
     binding = _optional(members, "binding", label)
+    description = _optional(members, "description", label)
     return V4Source(
         name=_identifier(members["name"], f"{label}.name"),
+        description=(
+            None
+            if description is None
+            else _text(
+                description,
+                f"{label}.description",
+                minimum=1,
+                maximum=MAX_SOURCE_DESCRIPTION_CHARS,
+            )
+        ),
         source_class=_one_of(members["source_class"], f"{label}.source_class", SOURCE_CLASSES),
         data_classification=_one_of(
             members["data_classification"], f"{label}.data_classification", DATA_CLASSIFICATIONS