add spec ./specs/coauthoring-cross-rung-format.md (status: graduated)

2026-06-10 22:32:51 -07:00
parent 23c4b9dc11
commit 8a6409cea4
1 changed files with 491 additions and 0 deletions
@@ -0,0 +1,491 @@
 ---
 status: graduated
 ---
 # Solution Design: Cross-Rung Git-Native Persistence Format + Gitea Round-Trip (F5)
 | | |
 | --- | --- |
 | **Author(s)** | Ben Stull (with Claude) |
 | **Reviewers / approvers** | Ben Stull |
 | **Status** | `draft` |
 | **Version** | v0.1.0 |
 | **Source artifacts** | Epic `benstull/vscode-cowriting-plugin#1` · Feature `#14` (F5) · Parent specs: `coauthoring-inner-loop.md` (§9 OPEN→F5: "the inner-loop shape, not yet the cross-rung contract"), `coauthoring-attribution.md` (§9 OPEN→F5), `coauthoring-propose-accept.md` (§9 OPEN→F5) · Ladder lineage: `ben.stull/rfc-app#48` (the three rungs) and `ben.stull/rfc-app#46` (the Gitea-substrate rung: "continuity of substrate — no migration cliff") · F4 shipped: `#12` (PR #13, session 0012) |
 **Change log**
 | Date | Version | Change | By |
 | --- | --- | --- | --- |
 | 2026-06-10 | v0.1.0 | Initial draft — brainstorming session 0014 | Ben Stull + Claude |
 ---
 ## 1. Business Context
 ### 1.1 Executive Summary
 F5 graduates the `.threads/` sidecar from "the editor's private shape" into the
 **cross-rung contract**: a published, versioned, machine-validatable format any
 rung of the ladder (editor → Gitea substrate → rfc-app) can read and write
 without re-homing. It adds the three things a second writer needs — a
 **contract** (prose + JSON Schema, with compatibility rules including
 unknown-field preservation), a **cross-rung identity** extension on
 `Provenance` (git's own email model, plus `onBehalfOf` for agents), and a
 **deterministic merge** (`mergeArtifacts`) — and **proves the round-trip**: a
 record written in the editor is modified out-of-editor by a Gitea-rung stand-in
 and renders correctly on pull. Everything is additive; `schemaVersion` stays 1.
 ### 1.2 Background
 Epic #1's outcome statement promises the record is "portable up to the Gitea
 rung later **without re-homing**", and rfc-app#46 names the strategic prize:
 **continuity of substrate — no migration cliff** ("git is truth; the surfaces
 are clients"). Every prior design deferred the contract to exactly this
 session: F2 called its format "the inner-loop shape, not yet the cross-rung
 contract"; F3 and F4 each routed "may re-home `attributions[]` /
 `proposals[]`" here. Meanwhile the shipped format was *built* for this moment
 — plain pretty JSON, stable key order, trailing newline, state-not-history
 sections, shared `anchors` — all chosen in F2 for mergeability. Issue #14
 carried six design forks to this session; all six are resolved here (§6.7,
 §9). One shipped fact forces real work: `serializeArtifact` rebuilds a
 canonical object from **known fields only**, so today's writer would silently
 destroy another rung's data on rewrite — the forward-compatibility gap F5
 closes (INV-15).
 ### 1.3 Business Actors / Roles
 - **Coauthor (human / machine)** — as in F2–F4; unchanged in-editor.
 - **The second writer** — new: a teammate's editor on another clone, or a
  Gitea-rung surface appending to the same record per the contract.
 - **The downstream rungs** — the Gitea substrate (rfc-app#46) and rfc-app:
  consumers of the contract this Feature publishes.
 ### 1.4 Problem Statement
 Portability has never been exercised. There is no published contract, no
 compatibility/versioning rules for readers that aren't this codebase, no
 forge-resolvable identity (`Provenance.id` is a local `$USER`), no defined
 behavior when a second writer touches the record, and a writer that drops
 fields it doesn't recognize. Until F5, "git is truth; the surfaces are
 clients" is an assertion, not a property.
 ### 1.5 Pain Points
 - Clone the repo on a second machine and the record *probably* works — nothing
  guarantees it, and any other tool that rewrites the sidecar loses data.
 - No rung can validate a sidecar without reading this extension's TypeScript.
 - `kind:"human", id:"benstull"` means nothing to a forge; agents don't record
  who they acted for.
 - Two writers = undefined behavior; git will textually conflict pretty JSON
  and nothing documents the semantic resolution.
 ### 1.6 Targeted Business Outcomes
 A contract any rung can implement against; identity a forge can resolve; a
 merge story a human (or tool) can execute deterministically; and a
 demonstrated out-of-editor round-trip — converting the epic's portability
 promise into a tested property and unblocking the rfc-app#46 substrate
 brainstorming with a concrete input.
 ### 1.7 Scope (business)
 **In scope:** the cross-rung contract (prose, normative) + JSON Schema +
 rung-neutral validator; unknown-field preservation in the writer; the
 `Provenance` identity extension (`email`, `agent.onBehalfOf`); newer-major
 fail-safe (read-only) behavior; `mergeArtifacts` (deterministic union-by-id,
 documented + unit-tested); the Gitea-rung stand-in writer script + round-trip
 host E2E; byte-fidelity tests.
 **Out of scope (deferred, not forgotten):** the Gitea-side substrate
 primitives themselves (rfc-app#46's build — discussions UI, LLM participants,
 native proposal layers); any rfc-app work; a sync daemon/server (git push/pull
 IS the transport); a git merge *driver* installation (the pure function is the
 semantics; wiring it into `.gitattributes` is a later convenience); file
 rename/move tracking; `ratifiedBy` / multi-party provenance (team-rung
 concern); rejected-proposal history trails.
 ### 1.8 Assumptions · Constraints · Dependencies
 - **Parent:** Epic #1 (F5 is its final decomposition item; the three
  acceptance pillars shipped in F2 #4, F3 #6, F4 #12). **Blocked by:** #12
  (shipped). **Feeds:** the rfc-app#46 brainstorming and the rfc-app rung.
 - **Established format facts** (the contract ratifies what shipped):
  per-document `.threads/<path>.json`; shared `anchors` + `Fingerprint`
  (text/before/after/lineHint, INV-3); `Provenance` (`human|agent`);
  `threads[]` / `attributions[]` (state, not history) / pending-only
  `proposals[]` (INV-13); `SCHEMA_VERSION = 1`; stable key order + trailing
  newline (INV-2). The extension stops being the assumed sole writer.
 - All changes are **additive** — existing sidecars remain valid v1 documents
  unmodified; the serializer's optional-field-omission pattern (F4 precedent)
  carries the new fields.
 - No new auth/credential surface; no server.
 ### 1.9 Business Use Cases
 - **BUC-1** A coauthor clones the repo on another machine (or a teammate
  does) and the full record — threads, attribution, pending proposals —
  arrives intact and keeps working.
 - **BUC-2** A Gitea-rung surface (today: the stand-in; tomorrow: rfc-app#46's
  primitives) appends a thread reply per the contract; on pull, the reply
  appears in the editor's comment thread.
 - **BUC-3** Two writers diverge; the documented merge yields one record with
  no silent data loss, and anything genuinely conflicting is surfaced.
 ---
 ## 2. Solution Proposal
 Publish the **contract** in two halves: a normative prose document
 (`coauthoring-sidecar-contract.md`, a standing spec in the content repo) and a
 **JSON Schema** (`schemas/coauthoring-sidecar.schema.json`, code-resident in
 the plugin repo next to the reference implementation, wired into the unit
 suite and runnable by any rung via a small validator script). Extend
 `Provenance` additively with git's own identity model — `email` on humans,
 `agent.onBehalfOf {id, email?}` on agents — and make the writer
 **round-trip-safe**: unknown fields are preserved on rewrite (serialized after
 known keys, sorted), and a sidecar with a newer major `schemaVersion` is
 read-only (fail-safe). Ship the merge semantics as a pure, vscode-free
 `mergeArtifacts(ours, theirs)`: sections union by `id`, thread messages union
 by `id` ordered by `createdAt` (the forge-appends-a-reply case merges cleanly
 by construction), same-id divergence resolved by `updatedAt` where present
 else a deterministic tie-break — and every such resolution **surfaced** in the
 result, never silent. Prove the loop with a Gitea-rung **stand-in writer**
 (`scripts/crossrung-reply.mjs`: validate → append a reply → stable-serialize)
 driven by host E2E through the existing external-change machinery.
 ---
 ## 3. Product Personas
 - **PP-1 Inner-loop coauthor** — unchanged in-editor experience; gains
  second-machine/teammate safety.
 - **PP-3 Rung implementer** — new: the developer building the Gitea-substrate
  or rfc-app surface against the contract (today impersonated by the stand-in
  script and the validator).
 ## 4. Product Use Cases
 - **PUC-1 (fidelity)** A sidecar written by the editor survives
  serialize → git → reload byte-stable, and survives a *conforming foreign
  writer's* rewrite with all fields intact (including ones that writer doesn't
  know).
 - **PUC-2 (out-of-editor reply)** The stand-in appends a thread reply per the
  contract → the editor (on external change / pull) renders the new message in
  the right thread at the right anchor.
 - **PUC-3 (merge)** Two divergent copies merge via `mergeArtifacts`: disjoint
  changes union; the reply-append case is clean; same-id divergence resolves
  deterministically and is reported.
 - **PUC-4 (fail-safe)** The editor encounters a sidecar with a newer major
  `schemaVersion`: it surfaces a warning and does not write — never destroys
  what it can't fully read.
 - **PUC-5 (validation)** Any rung validates any sidecar against the schema
  (`scripts/validate-sidecar.mjs <file>` or any standard JSON Schema
  validator); the plugin's unit suite validates its own outputs.
 ## 5. UX Layout
 No new UI surface (Claude Code, not Claude Design — same §5 call as F3/F4).
 Out-of-editor replies render through the **existing** F2 thread machinery
 (external-change → re-render). The only new user-visible element is a warning
 notification + read-only behavior on a newer-major sidecar (PUC-4), reusing
 the established notification patterns. The contract, schema, validator, and
 merge function are developer-facing artifacts.
 ---
 ## 6. Technical Design
 ### 6.1 Invariants
 Parent invariants INV-1..INV-13 carry over unchanged. F5 adds:
 - **INV-14 (contract-canonical):** the contract document is the format's
  source of truth. Format changes land in the contract first, then in code —
  documentation-leads-automation (handbook §4.1) applied to the format. The
  JSON Schema and the TypeScript model conform to it; on disagreement the
  contract wins.
 - **INV-15 (round-trip preservation):** a conforming writer **preserves
  fields it does not recognize** when rewriting a sidecar. No rung's writer
  may destroy another rung's data. (Unknown keys serialize after known keys,
  sorted lexicographically, so output stays deterministic — INV-2.)
 - **INV-16 (versioning):** within a major `schemaVersion`, changes are
  **additive-only** (new optional fields); readers ignore unknown optionals.
  A reader encountering a **newer major** version goes **fail-safe
  read-only**: render what it understands, write nothing. Breaking changes
  bump the major and are recorded in the contract's changelog.
 - **INV-17 (merge honesty):** merging is deterministic union-by-id per the
  contract's documented rules; any same-id divergence is resolved by those
  rules **and surfaced to the caller** — never silently guessed (INV-1's
  spirit at the artifact level).
 ### 6.2 High-level architecture
 Four small units — two artifacts, two vscode-free modules — plus a serializer
 change and one fail-safe check; controllers and the editor UX are otherwise
 untouched:
 - **The contract** (`vscode-cowriting-plugin-content`:
  `specs/coauthoring-sidecar-contract.md`) — normative prose: every section
  and field, its semantics and invariants, the identity model, the
  compatibility rules (INV-15/16), and the merge rules (INV-17), with a
  changelog. Status-stamped and graduated like a spec; versioned with the
  schema.
 - **The schema + validator** (plugin repo:
  `schemas/coauthoring-sidecar.schema.json` + `scripts/validate-sidecar.mjs`,
  `ajv` as a devDependency) — machine-checkable conformance; wired into the
  vitest suite (every serialized fixture validates) and runnable standalone
  by any rung.
 - **`model.ts` extensions** — `Provenance` gains optional `email` (human and
  agent alike); the agent payload gains optional
  `onBehalfOf: { id: string; email?: string }` (the operator the machine
  acted for — rfc-app#46 §6.5's `On-behalf-of:` made data). The serializer
  gains **unknown-field preservation** (INV-15) for the artifact root and
  every record type. `currentAuthor()` starts populating `email` from the
  workspace git config when available.
 - **`mergeArtifacts`** (new vscode-free `src/mergeArtifacts.ts`) —
  `mergeArtifacts(ours, theirs): { merged, conflicts }`: anchors map union;
  threads/attributions/proposals union by `id`; thread `messages` union by
  `id` ordered by (`createdAt`, `id`); same-id record divergence → newer
  `updatedAt` wins where the type has one, else the lexicographically larger
  canonical serialization (deterministic), and the id is reported in
  `conflicts`. Refuses (throws) on differing majors (INV-16).
 - **Fail-safe check** — `CoauthorStore.load` surfaces the artifact's
  `schemaVersion`; controllers (via one shared helper) treat a newer major as
  read-only: render best-effort, skip every `store.update` path, warn once
  (PUC-4).
 - **Stand-in writer** (`scripts/crossrung-reply.mjs`) — the Gitea-rung
  impersonator: read sidecar → validate → append a `Message` to a named
  thread (new `id`, `createdAt`, author with `email`) → stable-serialize →
  validate again. Doubles as executable documentation of "how a foreign
  writer behaves."
 ```mermaid
 flowchart LR
  subgraph editor rung
    ext["extension writers\n(Thread/Attribution/Proposal controllers)"] --> ser["serializeArtifact\n+ unknown-field preservation (INV-15)"]
  end
  ser --> sc[".threads/&lt;doc&gt;.json\n(canonical carrier)"]
  sc <--> git["git push / pull\n(the transport)"]
  git <--> forge["Gitea rung\n(today: crossrung-reply.mjs stand-in)"]
  contract["contract doc (content repo)\n+ JSON Schema (plugin repo)"] -. governs (INV-14) .-> ser
  contract -. governs .-> forge
  sc --> merge["mergeArtifacts\n(union-by-id, surfaced conflicts, INV-17)"]
  sc --> guard{"schemaVersion major\n&gt; known?"}
  guard -- yes --> ro["read-only + warn (INV-16)"]
  guard -- no --> render["existing render/re-anchor paths\n(F2/F3/F4, unchanged)"]
 ```
 ### 6.3 Data model & ownership
 Additive only — `schemaVersion` stays **1**; every existing sidecar is already
 a valid v1 document:
 ```jsonc
 // Provenance — human (new optional identity)
 { "kind": "human", "id": "benstull", "email": "ben@wiggleverse.org" }
 // Provenance — agent (new optional on-behalf-of)
 { "kind": "agent", "id": "claude",
  "agent": { "sdk": "@cline/sdk", "model": "sonnet", "sessionId": "run_…",
             "onBehalfOf": { "id": "benstull", "email": "ben@wiggleverse.org" } } }
 ```
 - **Identity is git's model:** `email` is the cross-rung join key (forges
  already map email → account); `id` remains the display/short name. No
  signatures in v1 (provenance, not authentication — the git history is the
  integrity layer).
 - **Ownership changes:** the extension is no longer the assumed sole writer.
  Any conforming writer may append/modify per the contract; the
  self-write-suppression machinery is untouched (foreign writes *should*
  arrive as external changes and re-render — that is the F2 path).
 - **Unknown fields:** preserved on rewrite at every level (artifact root,
  anchor, thread, message, attribution, proposal), serialized after known
  keys, sorted (INV-15, INV-2).
 ### 6.4 Interfaces & contracts
 - **Contract doc** — normative; field tables per section + invariants +
  compatibility (INV-15/16) + merge rules (INV-17) + changelog. The F2/F3/F4
  spec §6.3s are its inputs; it supersedes them as the format reference
  (INV-14).
 - **Schema/validator** — `validate-sidecar.mjs <file>` exits 0/1 with
  per-error paths; vitest helper `expectValidSidecar(artifact)` used by the
  model/store/merge suites.
 - **`mergeArtifacts(ours: Artifact, theirs: Artifact): { merged: Artifact;
  conflicts: string[] }`** — pure, vscode-free, documented as *the* reference
  implementation of the contract's merge rules. Not yet wired into any UI;
  rungs and humans invoke it (a `.gitattributes` merge driver is a later
  convenience, §1.7).
 - **`CoauthorStore.load`** — unchanged signature; a shared
  `isNewerMajor(artifact)` helper gates every write path (controllers skip
  `update`, warn once per doc).
 - **`scripts/crossrung-reply.mjs <sidecar> <threadId> <body> [--author-id
  --author-email]`** — the stand-in; validates before and after its write.
 ### 6.5 Per–Product-Use-Case design
 - **PUC-1 (fidelity):** unit tests pin byte-stable serialize→parse→serialize;
  a "foreign writer" test parses a fixture containing unknown fields (root +
  per-record), rewrites via `serializeArtifact`, and asserts the unknowns
  survive in sorted-after-known position (INV-15).
 - **PUC-2 (out-of-editor reply):** host E2E — create a thread in the editor
  (F2 path) → save → run the stand-in against the sidecar (append reply) →
  trigger the external-change path (the F2/F3/F4
  `externalWriteAndReload`/watcher pattern) → assert the thread renders the
  new message at the re-resolved anchor. No LLM; no real network — the
  stand-in is a local process, exactly what a forge's write looks like to git.
 - **PUC-3 (merge):** unit tests of the documented cases: reply-append vs.
  disjoint editor edit (clean union, no conflicts); both sides append to the
  same thread (messages interleave by `createdAt`, no conflicts); same
  attribution id with divergent extents (newer `updatedAt` wins, id
  reported); divergent same-id proposals (deterministic tie-break, id
  reported); differing majors → throws.
 - **PUC-4 (fail-safe):** unit: a v2 fixture loads, `isNewerMajor` true; host
  E2E: open a doc whose sidecar says `schemaVersion: 2` → warning surfaced,
  edits/saves do NOT rewrite the sidecar (file bytes unchanged).
 - **PUC-5 (validation):** the schema validates all shipped fixtures + every
  serialized artifact in the unit suite; the validator script exits non-zero
  on a deliberately broken fixture.
 ### 6.6 Non-functional requirements & cross-cutting concerns
 All additions are O(artifact) pure functions; no runtime dependencies added to
 the extension bundle (`ajv` is dev/scripts-only). Unknown-field preservation
 slightly grows the serializer but keeps determinism (INV-2). Identity adds
 PII-class data (emails) to a repo-committed file — acceptable: it is exactly
 what git commits already record; the contract notes it so adopters know.
 Fail-safe read-only can mean reduced function on version skew — by design
 (INV-16); the warning names the version. No secrets, no server, no new auth.
 ### 6.7 Key decisions & alternatives considered
 | Decision | Chosen | Alternatives rejected |
 | --- | --- | --- |
 | Substrate carrier (fork a) | `.threads/` sidecar stays the canonical cross-rung carrier | git notes (no default push/fetch — breaks "travels with ordinary git"; forges don't render notes; bind to commits while the record is document-scoped); commit trailers (only fit commit-shaped data); a forge reads/renders/diffs JSON files natively — the F2 decision gets *stronger* cross-rung |
 | Contract form + home (fork b) | Prose contract = standing spec in the **content repo**; JSON Schema + validator = **plugin repo** (code-resident by the reference implementation, like the engineering repo's central-schema discipline applied at app scope) | schema in the content repo (test suite would read cross-repo; drifts from the model it validates); engineering `schemas/` now (org-central before a second rung exists — graduate it there when the Gitea rung lands, noted §9); prose-only (not machine-checkable); schema-only (semantics/invariants don't fit JSON Schema) |
 | Cross-rung identity (fork c) | Optional `email` on `Provenance` + optional `agent.onBehalfOf {id, email?}` — git's own identity model; forges map email→account | forge usernames (couples the record to one forge — the ladder spans surfaces); signed identities (authentication, not provenance; git history is the integrity layer; YAGNI v1); a global actor registry (a server by the back door) |
 | Merge semantics (fork d) | Pure 2-way `mergeArtifacts`: union-by-id; messages ordered by createdAt; updatedAt-else-deterministic tie-break; conflicts surfaced (INV-17) | 3-way with base (git gives no cheap base for sidecars in conflict resolution; union-by-id with fresh uuids makes 2-way sufficient at this scale); whole-file last-writer (silently loses the other side); mandated git merge driver (installation burden; the pure function IS the semantics — driver is later sugar) |
 | Round-trip proof shape (fork e) | Local stand-in writer script (validate → append reply → stable-serialize) + the existing external-change E2E path; byte-stability covers transport | real Gitea API round-trip in CI (infra for nothing — git moves bytes verbatim; the forge's *write* behavior is exactly the stand-in); building any Gitea-side primitive now (rfc-app#46's tracker, not this Feature) |
 | Versioning (fork f) | Everything additive → `schemaVersion` stays 1; INV-16 rules (ignore unknown optionals; preserve unknown fields; newer-major → read-only) | bump to 2 (nothing breaks — a bump would force every reader to handle two majors for no gain); no formal rules (the status quo — exactly the gap F5 closes) |
 | Writer forward-compat | **Preserve unknown fields** on rewrite (INV-15), sorted after known keys | drop unknowns (today's behavior — a conforming v1.1 writer would destroy a v1.2 rung's data); refuse to write on unknowns (turns every additive change into a flag day) |
 ### 6.8 Testing strategy
 - **Unit (vitest, vscode-free):** schema validation of every serialized
  artifact (PUC-5); byte-stability + unknown-field preservation round-trips
  (PUC-1); identity serialization (email/onBehalfOf present/absent — F4's
  optional-omission pattern); `mergeArtifacts` documented cases incl. the
  conflict reports and the differing-major throw (PUC-3); `isNewerMajor` +
  v2-fixture load (PUC-4).
 - **Host E2E (`@vscode/test-electron`, F2–F4 pattern, no LLM):** the
  round-trip — editor-created thread → save → stand-in appends a reply →
  external-change → new message renders in the thread at the re-resolved
  anchor (PUC-2); newer-major sidecar → warning + no rewrite on save (PUC-4).
 - **Scripted checks:** `validate-sidecar.mjs` against good + broken fixtures;
  the stand-in's own before/after validation. No manual smoke needed — F5 has
  no LLM leg.
 ### 6.9 Failure modes, rollback & flags
 A non-conforming foreign write → schema validation pinpoints it; the editor's
 existing resolve-or-orphan ladder already handles semantic damage (anchors
 that no longer resolve orphan, never guess). Version skew → INV-16 read-only,
 recoverable by upgrading the older rung. Merge conflicts → surfaced ids +
 documented rules; worst case the file is plain JSON a human resolves (the F2
 stance, now with rules). Email absence (no git config) → fields omitted,
 everything still valid (additive). No feature flag: additive schema + a
 contract doc; old extensions keep working against new sidecars (they drop
 unknown fields — which is precisely why INV-15 ships *now*, before any second
 writer exists).
 ---
 ## 7. Delivery Plan
 ### 7.1 Approach / strategy
 One planning-and-executing session (F5 = #14), plan written just-in-time from
 this spec, per the F2–F4 precedent.
 ### 7.2 Slicing plan
 - **SLICE-1** The contract: `coauthoring-sidecar-contract.md` (content repo,
  normative, with changelog) + `schemas/coauthoring-sidecar.schema.json` +
  `scripts/validate-sidecar.mjs` (+ ajv devDependency), schema wired into the
  unit suite (every serialized fixture validates).
 - **SLICE-2** Writer conformance: unknown-field preservation in
  `serializeArtifact` (INV-15) + `Provenance` identity extension
  (`email`, `agent.onBehalfOf`) + `currentAuthor()` email population +
  newer-major fail-safe (`isNewerMajor` gating all `store.update` paths,
  PUC-4 warning) — with compat tests (existing sidecars load/serialize
  unchanged).
 - **SLICE-3** `mergeArtifacts` + unit tests of every documented merge case
  (INV-17).
 - **SLICE-4** The stand-in (`scripts/crossrung-reply.mjs`) + host E2E
  round-trip (PUC-2) + newer-major E2E (PUC-4).
 - **SLICE-5** Docs: README cross-rung section; plugin-repo pointers to the
  contract; full gate.
 E2E are first-class plan tasks (handbook §9 / §4; this app's required tier is
 host E2E — a VS Code extension, no browser surface, no deploy stage — the
 F2–F4 precedent).
 ### 7.3 Rollout / launch plan
 Still non-shippable (no marketplace publish). "Done" = issue #14 acceptance
 met: contract + schema published, unit + host E2E green (round-trip, merge,
 fail-safe, preservation all exercised). No manual smoke — no LLM leg.
 ### 7.4 Risks & mitigations
 | Risk | Mitigation |
 | --- | --- |
 | Contract drifts from code | INV-14 (contract first) + the schema runs in the unit suite — drift fails CI |
 | Unknown-field preservation breaks byte-stability | deterministic placement rule (after known keys, sorted) + round-trip tests |
 | Merge rules too naive for real concurrency | scale honesty: union-by-id + fresh uuids makes overlap rare at inner-loop scale; conflicts are surfaced, file stays human-resolvable; revisit with the team rung |
 | Email-as-identity is wrong for some forge | it is git's own join key and the lowest common denominator; forge-specific ids can be added additively later (INV-16) |
 | Premature contract (Gitea rung may want changes) | everything additive + a changelog + the rfc-app#46 brainstorming consumes this as INPUT — cheaper to amend a contract than to reverse-engineer an implementation |
 | Read-only fail-safe surprises a user on version skew | warning names the version and the action; recoverable by upgrading; tested in E2E |
 ---
 ## 8. Traceability matrix
 | Requirement (issue #14 acceptance) | Use case | Design | Slice |
 | --- | --- | --- | --- |
 | Contract document with compatibility rules | PUC-5 | §6.2, INV-14/15/16 | SLICE-1 |
 | Identity crosses rungs (Provenance) | PUC-2 | §6.3, fork (c) | SLICE-2 |
 | Round-trip proven, no re-homing | PUC-1/2 | stand-in + INV-15, §6.5 | SLICE-2/4 |
 | Concurrent-writer story defined and exercised | PUC-3 | `mergeArtifacts`, INV-17 | SLICE-3 |
 | Validation runnable outside the extension | PUC-5 | schema + validator | SLICE-1 |
 | Unit + host E2E coverage | — | §6.8 | SLICE-1–4 |
 ## 9. Open Questions & Decisions log
 - **RESOLVED (this session — the six forks routed by #14):** (a) carrier =
  the sidecar, ratified cross-rung; (b) contract = prose (content repo
  standing spec) + JSON Schema (plugin repo, code-resident); (c) identity =
  `email` + `agent.onBehalfOf`, git's model; (d) merge = pure 2-way
  union-by-id with surfaced conflicts (INV-17); (e) proof = local stand-in
  writer + external-change E2E + byte-stability; (f) versioning = additive,
  `schemaVersion` stays 1, INV-16 rules (incl. writer unknown-field
  preservation, INV-15).
 - **OPEN → Gitea rung (rfc-app#46):** graduate the schema to the engineering
  central `schemas/` when a second rung actually implements the contract;
  whether the substrate wants a `.gitattributes` merge driver shipped;
  forge-specific identity fields beyond email.
 - **OPEN → later:** `ratifiedBy` / multi-party provenance (team rung); file
  rename/move tracking (path is still the key); rejected-proposal history
  trails; signed provenance if integrity-beyond-git is ever required.
 ## 10. Glossary & References
 - **Cross-rung contract** — the published format definition all ladder
  surfaces implement against. **Foreign/conforming writer** — any non-editor
  process writing a sidecar per the contract. **Stand-in** — the local script
  impersonating the Gitea rung's write behavior. **Fail-safe read-only** —
  INV-16's posture on newer-major sidecars: render, never write.
 - Epic #1 · Feature #14 (F5) · F2 #4 · F3 #6 · F4 #12 (PR #13) · parent specs
  `coauthoring-inner-loop.md` / `coauthoring-attribution.md` /
  `coauthoring-propose-accept.md` · rfc-app#48 (ladder) · rfc-app#46
  (substrate rung) · `wiggleverse/engineering#19` (adjacent metadata
  discussion).