T021, U-2: the gate console's schemas, each read where its owner keeps it, nothing vendored (plan 038, P4F-4)

[brettheap]

Lane: openxfactory-4 (openXfactory-4-openDox_extraction)
Authored by lane openXfactory-3, delegated by lane openxfactory-4 (#656 6013608628)

Arc: neutral-product-standalone-operability

T021, U-2: the gate console's schemas (GA), resolved without vendoring (plan 038, feature 038-opendox-document-tool-self-maintenance)

After set met: T004 #1245 → 260234b5; T020 #39 → c6d15b2.

The branch.

• T021's own commits:
  • 07361582, U-2;
  • three Copilot fixes: ecf0ba9b, 542a5c40 and a183dc46.
• Main came in by merges, never a rebase:
  • 72633f93 (T020, T020, U-1: the governed host for the governed suites that drive the gate verbs (plan 038, P4F-5) #39 → c6d15b27);
  • 22a77c16 (T024, T024, U-5: the H-1 shim, ideation_dashboard.session_git answers with opendox.session_git (plan 038, CF-3) #38 → 8b64fae0);
  • 122bacce (T023, T023, U-4: swb-session.js spells the model's two names at its call sites again (plan 038) #42 → d45a0939), the head.
• The diff against main is T021's three files.
• The first merge had one conflict, at the end of tests/conftest.py: T021's own append after T020's last hunk, with main's side empty. It was resolved to this branch's side, so the merged tree equalled ecf0ba9b's byte for byte.

What changes

Before this change, gate_console._validate_contract_document read both of its schemas from Path(__file__).resolve().parents[2] / "contracts" / "schemas". That was openxFactory's own tree before the carve; in this leg it is the checkout root, which holds no contracts/. Now each schema is read where its owner keeps it:

• gate-action-record.schema.yaml (openXdox-spec's) is read from this distribution's own packaged copy, through openxdox.contracts.verified_bytes("gate-action-record"). That call checks the copy against copies.yaml's digest before a byte is parsed. The copy record already holds this schema; nothing is added to it.

• demotion-execution-receipt.schema.yaml (openxFactory's) is read from a source the HOST registers with the new seam, gate_console.register_contract_schema_source(directory). It follows openDox's seam idiom:

  • registering the same directory again is a no-op;
  • a different one raises ContractSchemaSourceRefused;
  • a directory that lacks the schema is refused when it is registered.

  unregister_contract_schema_source() and contract_schema_source_registered() complete it, so T030's host wiring can fill and take back the seam the way opendox_host treats openDox's. With nothing registered, validating a receipt refuses by name (R1Q27 (a)):

  GateRefused: the demotion execution receipt cannot be validated: its schema, demotion-execution-receipt.schema.yaml, is the host's contract, and no contract schema source is registered. A host registers the directory it keeps its contract schemas in, once, at process start, with openxdox.gate_console.register_contract_schema_source(<directory>) (R1Q27 (a): a kind is validated only where the tree it runs from supplies its schema).
  

• A host's schema is checked before it is used (_schema_errors, from the Copilot rounds below). It is parsed, checked against the validator's own meta-schema, then applied. ANY failure at any of the three steps refuses as GateRefused, naming the step and the exception's class; a SchemaError keeps its own "is not a valid JSON Schema" message. This matters because the demotion verb writes its receipt after it has moved files, and it reports only a GateRefused there as "DEMOTION EXECUTED BUT RECEIPT NOT WRITTEN". Any other exception ended the verb with a traceback.

• tests/conftest.py, one registration placed after U-1's: where the run is composed, it registers openxFactory's contracts/schemas/ from the composed tree at process start, as openxFactory's host wiring will from T030. A lone checkout registers none.

Line numbers kept. tests/test_no_hardcoded_status_words.py's PROSE_EXEMPT pins seven prose f-strings in gate_console.py by line number (315 to 1851). So:

• the seam and the schema helpers sit under their own header near the end of the module, before the PEP 562 section;
• openxdox.contracts is imported inside _packaged_schema_text;
• _validate_contract_document and its two call sites keep their exact line counts.

No line before 1851 moves. That test file is not this task's, so it is unchanged.

The contract, from tasks.md

• Realizes: 12.5 (part).
• Falsifier: the 16 schema nodes (R2-INV-P4F § schema), composed, quoted; a lone-checkout test that the receipt refuses by name; test_packaged_validator.py unchanged and green.
• Ruled: R2Q8. Decisions: P4F-4 ("gate-action-record is read from openXdox-code's own package; demotion-execution-receipt from a schema source the HOST registers (the composed conftest, then host wiring at T030); a lone checkout refuses by name. Nothing vendored."), ruled with plan 038 by Brett Heap, everything as recommended (#656 6013547504).
• After: T020 (the conftest), met: T020, U-1: the governed host for the governed suites that drive the gate verbs (plan 038, P4F-5) #39 → c6d15b27. T004 #1245 → 260234b5.
• Files: src/openxdox/gate_console.py (first: T021 → T074), tests/conftest.py (second: T020 → T021 → T073 → T074), and a new tests/test_gate_console_schema_source.py.
  • Note for the holder: plan 038's single-writer table (plan.md § "Parallel slices") has no row for the new tests/test_gate_console_schema_source.py. Lane 3 flagged this to lane 4 as a RECHECK FIX (lane3-to-lane4 log, 2026-10-06T00:30:30Z). The file is created here because T021's Files line names it, and no other task writes it.

The falsifier, at the head 122bacce

Environment.

• openXdox-code: main d45a0939, against the head 122bacce.
• openDox-code 34c20641, force-reinstalled with --no-deps, as 12.5's falsifier does.
• openxFactory 51456835, with openDox (e1e3a3c3, spec f7ee3c76), openXdox and openXwallet initialized recursively, and its scripts/ on PYTHONPATH (R1Q23 (a)).
• Python 3.12.3, pytest 8.4.2, CI's install command, LANG=C.UTF-8, no colour forcing.
• Two mains moved during the measurement, and neither was taken into it:
  • openxFactory moved to e6380965: one commit, with an empty diff over scripts/, the submodule gitlinks and contracts/;
  • openDox-code moved to 84f8ed83: #91, T025, the staging model, staging-workbench.js and their tests, none of them T021's.

1. The 16 schema nodes, composed, with test_explicit_release_has_cli_and_http_parity. That node needs this GA as well as T020's HR (#39's erratum to R2-INV-P4F). All are in tests/test_session_gates.py:

PYTHONPATH="$OPENXFACTORY/scripts" python -m pytest -q -p no:cacheprovider -rA <the 17 nodes>

at	result
main 56e1c238 (first round)	17 failed
T020 c52900e9 (first round)	17 failed
T021 07361582, ecf0ba9b	17 passed
main c6d15b27 / head 72633f93	17 failed / 17 passed
main 8b64fae0 / head 542a5c40	17 failed / 17 passed
main d45a0939 / head 122bacce	17 failed / 17 passed

The causes at main:

• {'error': 'gate_refused', 'message': "the gate-action record schema could not be loaded from <checkout>/contracts/schemas/gate-action-record.schema.yaml'"};
• FileNotFoundError: … '<checkout>/contracts/schemas/gate-action-record.schema.yaml';
• the knock-on assert 409 == 200.

The 16 nodes:

• test_the_abandon_reason_survives_the_fr028_branch_cleanup
• test_cleanup_deletes_the_branch_once_the_proposal_exists
• test_matching_proposal_evidence_from_before_abandonment_requires_fresh_release
• test_a_later_edit_elsewhere_in_the_change_folder_does_not_freshen_the_origin
• test_a_second_matching_record_recorded_after_abandonment_releases_cleanup
• test_branch_advanced_after_abandonment_requires_explicit_current_head_release
• test_active_declared_origin_releases_cleanup_without_a_pick_edge
• test_archived_exact_origin_releases_cleanup_after_the_tile_disappears
• test_execution_receipt_releases_cleanup_for_the_exact_destination
• test_legacy_manifest_requires_an_exact_returned_artifact
• test_explicit_human_release_cleans_a_true_orphan_and_records_why
• test_non_staged_orphans_use_the_explicit_human_release_lane[cluster-cl-orphan]
• test_non_staged_orphans_use_the_explicit_human_release_lane[possible-pos-orphan]
• test_cleanup_unwinds_its_record_when_branch_deletion_fails
• test_cleanup_restores_the_exact_ref_when_record_finalization_fails
• test_the_durable_ending_marker_is_the_second_admissible_proof

2. The lone-checkout test, the new tests/test_gate_console_schema_source.py, 6 cases.

The console imports openxFactory's doc_health when it loads (R1Q6 (d)), though nothing the cases run calls it. So each case runs the console in a child interpreter, beside a stand-in doc_health that answers the three names the import reads: corpus.STATUS_SCAN_LINES, lines.split_keepends and lines.join_rows. The CI process never imports the console through it. The cases:

• with no source registered, a receipt refuses, naming register_contract_schema_source(<directory>);
• the record is validated against the packaged copy:
  • a record the schema does not admit refuses;
  • a registered source whose own gate-action-record.schema.yaml admits nothing is never read for a record;
  • a packaged copy that drifted from its digest refuses;
• a receipt is validated against the registered source's schema;
• the seam holds one source, as above;
• a host schema the console cannot use refuses as GateRefused. That is any of: empty; required: 1; an unresolvable $ref; an unclosed flow sequence; a 5000-deep nesting; an impossible date; a cyclic mapping alias; a cyclic list alias;
• the module reads no parents[...] index (by AST).

Red at the base c52900e9: 5 failed in 1.38s. The causes:

• AttributeError: module 'openxdox.gate_console' has no attribute 'register_contract_schema_source';
• GateRefused: the gate-action record schema could not be loaded from <scratch>/contracts/schemas/…;
• gate_console.py reads a parents index at lines [642].

Green at every T021 head; 6 passed at 122bacce.

3. tests/test_packaged_validator.py is unchanged and green. git diff main -- tests/test_packaged_validator.py src/openxdox/contracts/ is empty.

The 16 suites, composed, each alone (12.5's loop), at 122bacce against main d45a0939

	passed	failed	errors	red
main d45a0939	739	99	4	103
head 122bacce	756	82	4	86

• No node green at main is red at the head: 0 regressions.
• The 17 nodes the head clears are exactly the 17 falsifier nodes above.
• No node is red outside R2-INV-P4F's 174, at main or at the head.
• No log in either run shows Errno 11 or cannot fork.
• Since the first round (main 174, T020 109, T021 92), the landings of T024 (T024, U-5: the H-1 shim, ideation_dashboard.session_git answers with opendox.session_git (plan 038, CF-3) #38) and T023 (T023, U-4: swb-session.js spells the model's two names at its call sites again (plan 038) #42) cleared 4 and 2 nodes. They cleared the same nodes at main and at the head.

Mutants of the new guards, all killed

Round 1, at ecf0ba9b. Each mutant was applied to a copy of the head and run against tests/test_gate_console_schema_source.py in a lone checkout. Every one exits 1:

M1-receipt-read-beside-the-module: KILLED
M2-record-read-from-the-host-source: KILLED
M3-no-digest-check: KILLED
M4-second-source-replaces: KILLED
M5-no-schema-presence-check: KILLED
M6-same-source-by-identity: KILLED
M7-unregister-keeps-it: KILLED
M8-registered-query-lies: KILLED
M9-no-source-means-skip-validation: KILLED
M10-no-meta-schema-check: KILLED
M11-application-errors-escape: KILLED

M10-no-composed-registration drops the conftest's registration. Run composed, it is KILLED: 1 failed, 16 passed. The failing node is test_execution_receipt_releases_cleanup_for_the_exact_destination, the only one of the 16 that validates a receipt.

The Copilot fixes, each killed by the same case:

• at 542a5c40, dropping RecursionError, or dropping ValueError, from the parse step's catch;
• at a183dc46, which replaced that tuple with a catch-all:
  • parse-catches-YAMLError-only: KILLED (ESCAPED RecursionError);
  • no-check-catch-all: KILLED (ESCAPED RecursionError).

The suite as CI runs it, and the protected suites

• The required job's own command, in a venv built as CI builds it (openDox at the pyproject.toml pin dede32b4), at 122bacce: selected=1113 passed=1109 skipped=4 failures=0 errors=0. All three pins hold: selected at least 1099, passed at least 1095, skipped exactly 4. None of the new cases skips.
• The governed set is unchanged at 16, and the new file names none of 12.5's markers.
• No protected file is edited. T059's oracle, as 12.5 calls it, over a simulated squash of 122bacce's tree onto d45a0939 (c3260498; it touches the three files above). The merge head itself would be diffed against its first parent, which is no landing:

  $ python3 scripts/protected_suites.py --landings="<the simulated squash>" --suites="$(cat governed.txt)"
  ok: 0 protected edit(s), each entered and holding
  

Copilot, by round

• At 07361582: r4194497045, medium, "Validate host schemas before demotion to prevent uncaught errors".
  • Fix-now: a real bypass with a simple payload. Measured at 07361582, all three cases escaped:
    • empty: AttributeError: 'NoneType' object has no attribute 'get';
    • required: 1: TypeError: 'int' object is not iterable;
    • an unresolvable $ref: _WrappedReferencingError.
  • Fixed in ecf0ba9b by checking the schema with check_schema() before applying it. Answered and resolved.
• At ecf0ba9b: "Findings: None".
• At 72633f93: r4197914632, "Translate all YAML parser failures to GateRefused".
  • Fix-now: yaml.safe_load raises past YAMLError. A 5000-deep [[…]] raised RecursionError, and x: 2001-02-30 raised ValueError.
  • Fixed in 542a5c40. Answered (4198580351) and resolved.
• At 542a5c40: r4198638746, "Catch non-SchemaError exceptions from check_schema".
  • Fix-now: the cyclic mapping properties: &p {a: {properties: *p}} loads, and check_schema then raised RecursionError. Copilot's own payload, allOf: &loop [*loop], is a SchemaError under the jsonschema CI resolves today (4.26.0, from >=4.18).
  • Fixed in a183dc46: this was the third finding on the boundary, so each step now refuses any failure. Answered (4199311149) and resolved.
• At 122bacce (the head; review 5433288963, COMMENTED): r4199337845, "Avoid hard-coding jsonschema's version-specific cyclic failure".
  • ACCEPTED LIMIT, under the convergence rule (#656 5988818366), for the holder at READY. It is not a bypass: production behaviour is correct whatever any jsonschema release does with the cycle. The finding concerns the test's precision only.
  • The assertion could not be checked: RecursionError pins the outcome under the jsonschema CI resolves today (4.26.0) on purpose, because it shows the check step's own catch is what refuses. pyproject.toml allows jsonschema>=4.18, so a later release that refuses the cycle as a SchemaError would fail this case loudly, and its message would name the new outcome.
  • The one-line remedy is to assert only the GateRefused: prefix, as the cyclic-list case does. The dropped-catch mutant stays killed either way. Answered (4199346014) and resolved.

At the head 122bacce:

• Checks: validate pass, SonarCloud Code Analysis pass (2 of 2).
• Review threads: 4, all answered and resolved. 0 unresolved.

Files changed (against main)

• src/openxdox/gate_console.py:

  • the two readers, _packaged_schema_text and _host_schema_text;
  • the schema checker, _schema_errors;
  • the seam: register_contract_schema_source, unregister_contract_schema_source, contract_schema_source_registered and ContractSchemaSourceRefused;
  • GATE_ACTION_RECORD_SCHEMA and DEMOTION_RECEIPT_SCHEMA.

  _validate_contract_document now takes the schema's text.

• tests/conftest.py: the composed run's registration of openxFactory's contracts/schemas/.

• tests/test_gate_console_schema_source.py: new, 6 lone cases.

Not done here

• openxFactory's host wiring registers the same source at T030 (lane 4). It becomes an entry in opendox_host.seams(), with contract_schema_source_registered and unregister_contract_schema_source as its take-back pair.
• The runbook (T022) and the allow-list respellings (T026) are other slices. test_the_cleanup_cli_verb_enforces_the_human_gate_and_deletes_the_branch needs T020's HR, T026's AL and this GA together.

🤖 Generated with Claude Code

Summary by Sourcery

Make gate-console contract validation use each schema owner’s source while refusing safely when host schema provisioning or validation is invalid.

New Features:

• Read packaged gate-action record schemas from the distribution’s verified contract copies and host-owned demotion receipt schemas from an explicitly registered source.
• Add a single-source registration seam with idempotent registration, validation, replacement protection, unregistration, and registration status APIs.
• Reject malformed, invalid, or unappliable host schemas as GateRefused errors.

Bug Fixes:

• Stop schema validation from depending on checkout-relative paths that are unavailable in standalone distributions.
• Prevent malformed host schemas from escaping as unexpected exceptions during receipt validation.

Enhancements:

• Keep schema ownership explicit by avoiding vendoring and requiring hosts to provide their own receipt schema directory.

Tests:

• Add standalone and composed tests covering packaged versus host-owned schema loading, registration behavior, missing sources, schema failures, digest drift, and removal of checkout-relative schema access.

[sourcery-ai]

Reviewer's Guide

The PR removes checkout-relative schema loading from the gate console, reads the openXdox-owned schema from its verified package, obtains the openXfactory-owned receipt schema through a validated single-source host seam, wires that seam into composed tests, and adds lone-checkout and host-plane coverage for the behavior.

Sequence diagram for owner-specific gate schema validation

sequenceDiagram
    participant Caller
    participant GateConsole
    participant PackagedContracts
    participant HostSchemaSource

    Caller->>GateConsole: validate_gate_action_record(record)
    GateConsole->>PackagedContracts: verified_bytes(GATE_ACTION_RECORD_SCHEMA)
    PackagedContracts-->>GateConsole: digest-verified schema text
    GateConsole->>GateConsole: _validate_contract_document(record, schema_text, label)
    GateConsole-->>Caller: validation result

    Caller->>GateConsole: validate_demotion_execution_receipt(receipt)
    GateConsole->>HostSchemaSource: read demotion-execution-receipt.schema.yaml
    HostSchemaSource-->>GateConsole: host schema text
    GateConsole->>GateConsole: _validate_contract_document(receipt, schema_text, label)
    GateConsole-->>Caller: validation result

Loading

State diagram for the host contract schema source

stateDiagram-v2
    [*] --> Unregistered
    Unregistered --> Registered: register_contract_schema_source(source)
    Registered --> Registered: register_contract_schema_source(same source)
    Registered --> Unregistered: unregister_contract_schema_source()
    Unregistered --> Unregistered: register_contract_schema_source(missing schema) / ContractSchemaSourceRefused
    Registered --> Registered: register_contract_schema_source(different source) / ContractSchemaSourceRefused
    Unregistered --> Unregistered: validate_demotion_execution_receipt() / GateRefused
    Registered --> Registered: validate_demotion_execution_receipt()

Loading

File-Level Changes

Change	Details	Files
Route each contract schema lookup to its owning distribution or host-registered source instead of deriving both paths from the checkout layout.	Load the gate-action schema through the packaged, digest-verified contracts API. Add a single-source registration seam for the host-owned demotion receipt schema, including idempotence, replacement refusal, presence validation, unregister, and status query. Refactor validation to accept schema text and preserve the existing refusal and validation behavior at the call sites.	src/openxdox/gate_console.py
Register the host-owned schema during composed test setup while retaining clean lone-checkout behavior.	Register openXFactory's composed contracts/schemas directory when its host module is available. Leave lone checkouts unregistered so receipt validation fails explicitly by contract name. Extend host-plane composition helpers and tests to cover governed host setup, import isolation, and restoration of process-wide state.	tests/conftest.py tests/test_host_plane.py
Add isolated tests proving schema ownership, source lifecycle, and removal of checkout-relative schema reads.	Run schema-source checks in child interpreters with a minimal doc_health stand-in. Verify packaged-schema validation and digest refusal independent of a registered host source. Verify receipt validation against the registered source, single-source semantics, missing-schema refusal, and unregister behavior. Use AST coverage to ensure gate_console.py no longer reads a parents-indexed schema path.	tests/test_gate_console_schema_source.py

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[Copilot]

Copilot review overview

🟡 Changes recommended

Invalid host schemas can escape as uncaught exceptions after demotion execution instead of producing a controlled refusal.

Review effort: Balanced
Findings: 1

Open (1)

• Validate host schemas before demotion to prevent uncaught errors · New

What changed in this PR

Moves gate-console schema loading to each contract owner and adds the stacked governed-host test composition.

Changes:

• Loads packaged schemas through digest verification and host schemas through registration.
• Registers composed openxFactory host/schema sources in tests.
• Adds host-plane and schema-source coverage.

File	Description
src/​openxdox/​gate_console.py	Adds owner-specific schema loading and registration APIs.
tests/​conftest.py	Composes governed hosts and host schema registration.
tests/​test_gate_console_schema_source.py	Tests schema ownership and registration semantics.
tests/​test_host_plane.py	Tests governed-host selection and isolation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🔵 Needs a closer look

It remains a draft with stacked cross-repository dependencies and deferred production host wiring requiring human integration review.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Validate host schemas before demotion to prevent uncaught errors

[Copilot]

Copilot review overview

🟡 Changes recommended

Some YAML parser failures can still escape GateRefused after demotion has moved files.

Review effort: Balanced
Findings: 1

Open (1)

• Translate all YAML parser failures to GateRefused · New

[Copilot]

Copilot review overview

🟡 Changes recommended

Recursive YAML aliases can still escape schema checking as an unhandled exception.

Review effort: Balanced
Findings: 1

Open (1)

• Catch non-SchemaError exceptions from check_schema · New

Resolved since last review (1)

• Translate all YAML parser failures to GateRefused

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 22 hours and 54 minutes by commenting @sourcery-ai review. Upgrade to get a review now.

[brettheap]

READY (holder, manual landing) at 122bacc

Lane: openxfactory-4 (openXfactory-4-openDox_extraction)

Holder, at READY: T021 (U-2, the gate console's schemas), lane openXfactory-3's READY-CANDIDATE 6023469377.

• Gates at the head:
  • 4 of 4 check-runs complete: validate, SonarCloud and Copilot succeed, and Sourcery is skipped;
  • the merge state is CLEAN against main d45a0939, which this ruleset requires;
  • 4 threads, all resolved;
  • 0 closing keywords in the body or commits.
• The falsifier: the 17 nodes are red at main and green at the head. Composed, the count goes 103 → 86 red with 0 regressions, and the CI form reads 1113/1109/4.
• Copilot r4199337845 ("Changes recommended" at 122bacce) is an ACCEPTED LIMIT under 5988818366. It is about test precision, not a bypass: one assertion in tests/test_gate_console_schema_source.py:257 pins jsonschema 4.26's failure mode for a cyclic object. The finding says the mutant stays covered either way. So this lands by the manual path.
• Follow-on (lane 3's choice of carrier, blocking nothing): pyproject.toml allows jsonschema>=4.18 with no upper bound. A later jsonschema release could turn that assertion red in the required validate. The one-line remedy is the one Copilot names: assert only that nothing escapes except GateRefused, as the cyclic-list case already does. Apply it in a small PR after this lands, or in the next slice that edits this file.
• Next: openXdox-code's ruleset is strict, so each queued PR (T026, U-7: the allow-list for 12.5's governed suites, with R-1 (a)'s span kind (plan 038, H-2) #43 T026, T095: the composed harness for the declared integration tests (plan 038, T094's R2-INV-R9) #46 T095, …) must merge main once this lands.

[brettheap]

Lane: openxfactory-4 (openXfactory-4-openDox_extraction)

LANDED — lane openxfactory-4, 2026-10-06T19:07:21Z, PR #40 → f70bc9c (opensoft/openXdox-code main; plain gate)

T021 landed with Copilot r4199337845 an ACCEPTED LIMIT under 5988818366 (test precision on jsonschema's cyclic failure mode); its one-line remedy follows as a lane 3 follow-on. Queued openXdox-code PRs merge main next (strict ruleset).