Repository navigation
Extend schema loader validation to use schema reference defined in #431 #459
Description
Current loader implementation (#446) does basic, python-based yaml validation when loading the policy schemas.
Now that the schema shape is defined with a jsonschema compliant file in #431, we can use the jsonschema library to validate each document against it directly as the per-file structural pass, then keep our Python validator only for the cross-file/semantic checks the compiler owns. That guarantees we never drift from the published spec.
Metadata
Metadata
Assignees
Labels
Type
Projects
- Status
Activity
rodmgwgu commentedon Sep 23, 2026
Implementation sketch
Blocked on #431 (ships the JSON Schema contract). Once merged, the plan is to make JSON Schema own the per-file structural pass while the Python validator keeps only the cross-file/semantic checks.
Where it runs: in
SchemaValidator.validate_document, preserving the current "collect every issue, gate at the end" model rather than raising on first error in the loader. This keeps the existing_gate/SchemaValidationErroraggregation UX (one report listing all structural and semantic problems).Steps:
jsonschematorequirements/base.in(needs a version withDraft202012Validator, the contract's draft); confirm the JSON file ships as package data.raw: dictfield toSchemaDocument, populated by the loader — since JSON Schema validates the raw dict, not the coerced dataclass.Draft202012Validator; map eachiter_errors(document.raw)result to aValidationIssue(ERROR, …), foldingerror.json_pathinto the message so operators see the offending field.validate_document(identifier patterns, required fields, empty-scope,schema_versionconst, permission-id shape,additionalProperties) with the JSON Schema pass. Keep only what the contract can't express — the Paragon icon-name membership check (schema enforcesminLength:1, not the vendored name set).validate_setandvalidate_compileduntouched — those are the cross-file/compile-time semantic checks the compiler owns.Notes:
SchemaLoadError) on un-parseable YAML / non-mapping top level, before structural validation can run.identifierpattern already excludes^) — verify and drop.anyOfandrole_extension.anyOfyield opaque jsonschema messages; add light message cleanup for those two..yamlfixture validates against the vendored contract.