[skip-docs]: ingen brukervendt flate ennaa -- CLI-flagget kommer i steg 6/7 med
README-blokka, og CLAUDE.md-raden i steg 8. Modulen er ikke naabar utenfra i denne
commiten.
Steg 1 og 2 av planen, committet sammen fordi begge armene bor i samme testfil og
ble skrevet mot samme ekte produsent-payload.
`prepass.py` konsumerer et OKF-konsumkontrakt-SS-8-payload som INPUT-fil (SS 2.4:
transporten er ikke del av kontrakten). po produserer ingen payload og vendrer ingen
produsent -- en subprosess mot produsentens checkout ville bundet pakka til en sti paa
en maskin og doedd i `git archive HEAD`, og en kopi ville vaert kø-(p)-driften.
`check_payload_shape` -- seks nekter, hver ved navn: ukjent revisjon (`==`, aldri
prefiks), nevnere som ikke lukker (SS 5.2, med DEKLARERT og OBSERVERT som to tall),
`len(excerpts)` og `len(withheld)` mot sine tellere (SS 8.1s to halvdeler), `spent >
limit` (SS 7.3) og en kjent-positiv som ikke ble reprodusert (SS 7.4). De to siste er
DEFENSIVE og uvitnet: produsenten nekter dem selv foer den emitterer.
`verify_against_bundle` -- fem sjekker mot den MONTERTE basen: erklaert id (aldri
mountet, S7a-3), joinen gjennom `safe_resolve` med `PathSecurityError` re-reist som
nekt, filas `sha256`, og -- baerende -- at `text` er RE-UTLEDBAR fra det monterte
dokumentet. Den siste lukker injeksjonsflaten: et payload kan ikke levere bytes basen
ikke holder. De to gatene som bodde i det tilbaketrukne `read_file` er reist paa nytt
her paa DOKUMENTET (verdict-laget og SS 4.1a), aldri delegert til produsentens egne
regler.
MAALT foer bygging, ikke antatt:
- Pre-passet nekter ALLE tre av repoets leverte baser ("declares no bundle_id") --
S7a-3s egen maaling sett fra produsentsiden. `shared/` er pull-only, saa fixturen er
bygget paa en KOPI med erklaert id, som ogsaa gir S7a-3s slakk-tilfelle gratis.
- `concept_id + ".md"`, `sha256` = HELE fila, og tekst-utledningen (frontmatter delt
paa `splitlines()`, NFC, per-linje rstrip) holder for alle fire utdrag i et EKTE
produsent-payload. En naiv `split("\n")` er UENIG med produsenten -- derfor er
regelen transkribert fra kilden og gatet av fixturen, aldri gjettet.
Fixturen `tests/fixtures/prepass/` er produsentens output ORDRETT (okf `54a0bc2`), saa
ingen arm er groenn mot en form ingen pre-pass emitterer.
TO TEST-FIXTURER VAR FEIL, funnet ved aa kjoere roedt: excerpt/withheld-armene brakk
ogsaa nevnerne, saa lukke-sjekken fyrte foerst; og dimensjons-armen kjoerte mot et
umerket dokument, der `in_dimension` aldri dropper uskopet kunnskap. Begge armene ville
staatt groenne mot en implementasjon uten sjekken de er skrevet for.
1413 passed / 5 skipped (fra 1387/5, +26, 0 fjernet). ruff + mypy rene.
Co-Authored-By: Claude <claude-opus-5>
MAJOR-4 (misjonsreview v2 section 7), owner B = the consumer. Neither existing
projection into ir.CostBaseline can serve an ingested tender corpus:
cost-baseline.json is hand-written per project and baseline_from_project belongs
to the road domain, so a K2-shaped bundle could be navigated and never anchored.
okf.derive_cost_baseline reads the numbers already in the bundle.
The premise was MEASURED before anything was built on it, and the order's two
pointers named two different forms. examples/*/expected-bundle/ carry pipe
tables, but every one of them is csv- or sql-sourced via render.render_table --
the xlsx path never reaches render_table at all. Measured with pandoc 3.10.2
under the producer's own writer and arguments: extract._extract_office converts,
and inbox.py hands that text to render_inbox_concept untouched, so an
xlsx-sourced concept file carries a pandoc SIMPLE table whose dash rule defines
the column spans. A pipe-only reader would have been inert on exactly the corpus
this exists for. Both forms are read, by two scanners over one role mapping and
one number grammar.
No judgement anywhere: the header vocabulary and the number grammar are closed,
and every ambiguity refuses -- no candidate table, more than one, two columns
claiming one role, two rows sharing a cost code, a row that prices nothing. A
partly-priced schedule refuses in full, because a half-derived baseline anchors
some codes while cost_baseline_anchored reports True.
Wired behind --derive-cost-baseline and never silently: one resolution in
run.py's bundle arm serves both the full run and the dry run, and the refusal
propagates rather than degrading to the file loader.
The two fixtures are pandoc's output verbatim, not hand-typed. The unpriced one
is K2's actual pre-award shape, and the columns survive as blanks -- so the
table IS a candidate and the refusal is the sharp one.
Load-bearing MEASURED: 18 mutations all red against the WHOLE suite, green
control 1230 passed / 5 skipped (from 1208/5, superset, 0 removed), golden
demo-transcript.stdout byte-unchanged (ea8c534773acdbe41ae68f2c55724d69aaf8be4f).
M17 is the one that matters for arm (b): dropping the positivity guard makes the
mutant raise pydantic ValidationError, which IS a ValueError but is NOT the named
class -- so pytest.raises(ValueError) would have stayed green against exactly the
mutation the arm exists to catch. Verified directly, not argued.
Honesty limits stated in the invariant row: NS 3451 section rows are not
classified (K2 itself was not available to measure), the stamp records that a run
was anchored and never which projection anchored it, the hosted surface is
deliberately untouched, and no live K2 file was read.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
