Skip to content

Schema narrower than spec after #364: reproducibility and appraisal.method/re_execution rejected #366

Closed

Description

@chernistry

Summary

Once #364 merges, schema/trace-claim.json (and its packaged copy) is narrower than the spec: a conformant record carrying the section 3.1.4 members is rejected.

The 11 September ruling on #247 gives this condition a severity: "A schema that is narrower than the spec rejects conformant records. That is a defect with a severity, not a documentation nit, and it should be filed as one." This is that filing.

Measured (at #364 head)

  • examples/amd-sev-snp.json validates clean.
  • Add reproducibility (section 3.1.4 shape): Additional properties are not allowed ('reproducibility' was unexpected).
  • Add appraisal.method and appraisal.re_execution: ('method', 're_execution' were unexpected).
  • A record omitting the members is unaffected.

Fix

Schema, models.py and docs/schema.md gain the members in the shape section 3.1.4 fixes:

  • reproducibility {function, code_identity, optional code_resolver, input_closure[] {id, digest, resolver}, transcript_digest}
  • appraisal.method (closed set, one value re-execution)
  • appraisal.re_execution {outcome in reproduced | diverged | not-attempted, observed_digest (required when diverged), reason (required when not-attempted), optional verifier_code_identity}, present iff method is re-execution

Plus producer vectors carrying the claim and an appraisal that re-ran it. Sponsor-free under CONTRIBUTING (schema changes tracking a merged spec change). I take it, sequenced immediately after #364.

Blocked on #364. Refs #249.

Activity

  1. github-actions commented on Sep 16, 2026

    @github-actions
    Contributor

    🟡 Contributor Check: MEDIUM

    Check Result
    Profile MEDIUM
    Credential LOW
    Overall MEDIUM

    Automated check by AgenTrust Contributor Check.

  2. chernistry commented on Sep 18, 2026

    @chernistry
    CollaboratorAuthor

    #370 carries all of it: both schema copies, the models with the same three rules as validators, the four docs/schema.md additions, and examples/reproducibility-claim/ with 21 signed vectors (five accepted, sixteen rejected, two per rule) held to their verdicts, loci, signatures and recomputed digests.

    Two notes in the PR body: the three SECTION_OF_PATH entries #365's guard will need once both are in, verified on a local merge; and that the section binds re_execution to method but does not bind method: re-execution to the presence of reproducibility, so the schema does not either.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions