T061, the consumer's validator located through the installed distribution (7.3) (plan 034)

.github/workflows/validate.yml

@@ -94,8 +94,8 @@ jobs:
       # would drift. The declaration is the list, and the run prints it.
       # Requirement 9 is met for this leg only once the declaration is empty.
       # Its `doc_health`, rail and contracts entries wait for the doc_health
-      # direction arc (plan 034 T008), and its consumer-schemas entry waits
-      # for 7.3 (T061, in phase 2). So the extraction stays open until then,
+      # direction arc (plan 034 T008). Its consumer-schemas entry left when 7.3
+      # landed (T061, in phase 2). So the extraction stays open until T008,
       # and T097 ticks 9.2 with that note.
       #
       # ONE TEST IS LEFT OUT BESIDE THEM, WITH ITS STATED REASON, UNTIL T008:
@@ -294,6 +294,28 @@ jobs:
       # with `main` `c41063d6` test by test). The floors sit ON the reading,
       # as #25 set them and T044 kept them, so the margin is zero again.
       #
+      # RAISED BY plan 034 T061 (openXdox-code#36), the same way: run
+      # 36759713758 (2026-09-30) measured `708cdd28`, the head before this
+      # change, at openDox-code `814516b7`: selected 1076, passed 1072,
+      # skipped 4, failures 0, errors 0. The +83 on both floors, file by file
+      # against #35's head `4feb8009`:
+      #   * +47, `tests/test_packaged_validator.py` (new);
+      #   * +18, `tests/test_snapshot.py`, which leaves the declaration now that
+      #     7.3 reads the consumer's schemas from the installed distribution;
+      #   * +11, `tests/test_protected_suite_check.py` (the added-test rule's
+      #     four cases, the chain's six, and 12.5's call refusing a chain);
+      #   * +5, `tests/test_validator_schema_home.py`; +2,
+      #     `tests/test_dependency_direction.py`; +1,
+      #     `tests/test_projection_contributions.py` (two cases replaced by
+      #     three);
+      #   * -1, `tests/test_declared_exclusion.py`, which loses
+      #     `tests/test_snapshot.py`'s case.
+      # Every selected test passes, and the four skips are the same four.
+      # AT THE PIN MAIN NOW CARRIES. #35 landed (`839492d9`) and moved the pin
+      # to openDox-code `047bb4fa`, T062's commit. Run 36784210624 measured
+      # `8d891652`, this branch with that `main` merged in, and read the same
+      # triple: 1076, 1072 and 4. So the floors stand.
+      #
       # THE SKIPS ARE NAMED, which is why the exact pin is safe to take. All
       # FOUR are `tests/test_aggregation_register_instance.py`'s, which the
       # sixteen-file list never ran: each skips because the "aggregation
@@ -323,8 +345,8 @@ jobs:
           # on a ruling, which lowers them with its reason (above). Set to
           # the measured values, which this suite has actually met on CI
           # rather than an aspiration.
-          MIN_SELECTED: "993"
-          MIN_PASSED: "989"
+          MIN_SELECTED: "1076"
+          MIN_PASSED: "1072"
           # EXACT - the load-bearing number.
           EXPECT_SKIPPED: "4"
         run: |

.sonarcloud.properties

@@ -0,0 +1,11 @@
+# SonarCloud automatic analysis settings for openXdox-code (plan 034 T061).
+#
+# THE PACKAGED VALIDATOR IS ANALYSED ONCE, AT scripts/. Since T061 the package
+# ships src/openxdox/contracts/validate-ideation-dashboard-contracts.py as
+# package data, so that an install runs its own validator (#1144 7.3). It is a
+# byte copy of scripts/validate-ideation-dashboard-contracts.py, which a source
+# checkout runs and which is analysed here as every other file is.
+# tests/test_packaged_validator.py holds the two byte-equal, so no line can
+# differ unseen. Analysing the copy as well would count each of the validator's
+# lines, and each finding, twice.
+sonar.exclusions=src/openxdox/contracts/validate-ideation-dashboard-contracts.py

pyproject.toml

@@ -94,18 +94,40 @@ requires-python = ">=3.12"
 # reasoning; this slice is the owed fix — the allowlist entry comes back out
 # in the same act. `referencing` and `rfc3339-validator` (named alongside
 # jsonschema in this leg's own `DEPENDENCY_REMEDY` string, `src/openxdox/
-# snapshot.py:105`) are NOT added here: neither is imported anywhere under
+# snapshot.py:105`) were NOT added then: neither was imported anywhere under
 # `src/` — they are jsonschema's own optional format-checking companions, and
-# adding an undeclared dependency is not what any reach in this tree calls for.
+# adding an undeclared dependency was not what any reach in the tree called for.
+# Plan 034 T061 adds both, for the reason the paragraph below gives.
 #
 # LOWER BOUND: `>=4.18`, this leg's own already-stated floor
 # (`DEPENDENCY_REMEDY` at `src/openxdox/snapshot.py:105`, unchanged by this
 # PR) — and not an arbitrary choice: `Draft202012Validator`, the name
 # `gate_console.py:563` imports, was added in jsonschema 4.18.0.
+#
+# `referencing` and `rfc3339-validator`, plan 034 T061 (#1144 7.3; R1Q27 (a):
+# the consumer's validator validates its own three kinds "from its installed
+# distribution, wherever it runs"). The premise above changed: the validator
+# now ships INSIDE the package, as `openxdox/contracts/validate-ideation-
+# dashboard-contracts.py`, so an install runs it. It imports `referencing` at
+# module level (`Registry`, `Resource`, `referencing.jsonschema.DRAFT202012`),
+# and it refuses to run without `rfc3339-validator`: jsonschema registers its
+# `date-time` checker only when that package is importable, and the validator
+# will not validate with `date-time` unenforced. Left out, a plain install
+# would carry a validator it cannot run, and every snapshot it generated would
+# read validator-unavailable. `tests/test_dependency_direction.py` holds the
+# packaged validator's imports to this list, and #1144's F7.1, whose fresh
+# environment installs only this list and the `test` extra, goes red when
+# `rfc3339-validator` leaves it (measured on this change).
+# LOWER BOUNDS: `referencing>=0.28.4` is the floor `jsonschema>=4.18` itself
+# requires, so declaring it adds nothing an install of jsonschema would not
+# already bring. `rfc3339-validator>=0.1.4` is the floor the `test` extra
+# stated for it until now (openxFactory's validator-input lock pins 0.1.4).
 dependencies = [
     "opendox @ git+https://github.com/opensoft/openDox-code@047bb4fa394f3e1bf42466062a67ef18e99f8d6a",
     "PyYAML>=6.0",
     "jsonschema>=4.18",
+    "referencing>=0.28.4",
+    "rfc3339-validator>=0.1.4",
 ]
 
 [project.optional-dependencies]
@@ -123,15 +145,16 @@ dependencies = [
 # over the whole suite at `e28930bf`, 23 red results asked for exactly this
 # package (21 in `tests/test_doxbench_blank_reason.py`, 2 in
 # `tests/test_snapshot.py`), and installing it cleared the 21.
-# It is a TEST dependency and stays out of `dependencies` for the reason the
-# jsonschema paragraph above gives: nothing under `src/` imports it, and the
-# validator script lands at the repository root, outside the package.
+# It was a TEST dependency while the validator script sat at the repository
+# root, outside the package. Since plan 034 T061 the package ships the
+# validator, so it is a runtime dependency (the paragraph above `dependencies`
+# gives the reason), and this extra no longer names it: `.[test]` installs it
+# all the same.
 # LOWER BOUND: `>=0.1.4`, derived the way PyYAML's was — what openxFactory
 # itself runs. Its validator-input lock pins `rfc3339-validator==0.1.4`
 # (`requirements/hermes-runtime-contracts.in`, which records the same reason).
 test = [
     "pytest>=8,<9",
-    "rfc3339-validator>=0.1.4",
 ]
 
 [build-system]
@@ -166,6 +189,20 @@ where = ["src"]
 # in an INSTALLED package rather than only in a source checkout.
 [tool.setuptools.package-data]
 openxdox = ["web/views/*.js", "web/views/*.css"]
+# THE CONSUMER VALIDATOR AND ITS OWN THREE SCHEMAS, SHIPPED AS PACKAGE DATA (plan
+# 034 T061; #1144 7.3, RULED R1Q14 (a): "openXdox's validator and its three
+# schemas (7.1's openXdox-spec three) are located through the INSTALLED openXdox
+# distribution, and no parent walk remains"). A wheel ships no `scripts/`, so an
+# install finds its validator here (`openxdox.snapshot.find_validator`), and that
+# validator finds its three schemas beside it, each held to the record's digest.
+# Without this line a wheel ships the package's two `.py` files and neither the
+# record nor a copy (measured: a wheel built from this tree with the line
+# removed), so the installed validator refuses each of its own three kinds by
+# name. The three patterns name the record, the copies and the validator and
+# nothing else; `build_py` would ship the validator as a `.py` file anyway, and
+# it is named here so this one line lists what an install needs to validate.
+# `tests/test_packaged_validator.py` holds this line to the files it ships.
+"openxdox.contracts" = ["copies.yaml", "schemas/*.schema.yaml", "validate-ideation-dashboard-contracts.py"]
 
 [tool.pytest.ini_options]
 # The ROOTDIR ANCHOR. With no pytest ini table anywhere, pytest infers a