feat(maplibre): validate source metadata projections

[bartytime4life]

Goal

Implement a deterministic, synthetic, no-network MapLibre source-metadata projection validator for local epoch, license, SHA-256 digest, and optional proof/manifest reference syntax without creating source, evidence, rights, policy, review, release, deployment, or publication authority.

Current state

• DRAFT / OPEN / NOT MERGED.
• The requested branch head f52f2898f40aa35a2e8bd3a9ae9a6399978e541e was inspected exactly, including its 17-path source-metadata diff and hosted checks.
• One causally related CI integration defect was found and corrected in commit ed2584df8f0930e14e673087981c4c7c087ef4ca (fix(ci): classify governed MapLibre metadata fixtures).
• The current branch head is ed2584df8f0930e14e673087981c4c7c087ef4ca.
• Compared with PR base snapshot fd04e0aa578e1da5cf6b9b36f3b002ddc01dad63, the branch is 3 commits ahead / 0 behind with 18 changed paths, 1,279 additions, and 10 deletions.
• At the corrected head, 39 pull-request workflow runs completed: 36 succeeded and 3 failed. The remaining failures are separately classified below as repository/workflow baseline issues not introduced by this PR.

Exact diff and bounded correction

The original requested-head diff added 17 paths:

• .github/workflows/maplibre-source-metadata.yml;
• tools/validators/maplibre/validate_source_metadata.py;
• tests/maplibre/test_source_metadata.py;
• 13 files under tests/fixtures/maplibre/source-metadata/**;
• data/receipts/generated/genrec-maplibre-source-metadata-20260804.json.

The only corrective path added after the requested-head inspection is:

• .github/workflows/maplibre-perf-governance.yml — 72 additions / 10 deletions.

No release workflow, rollback workflow, RollbackCard schema or validator, Roads/Rail/Trade workflow or validator, repository setting, deployment path, publication path, source registry, evidence root, or policy root was changed.

The generated receipt remains scoped to the original 16 source-metadata implementation artifacts. It is AI-authoring process provenance only and grants no approval or lifecycle authority.

Requested-head hosted results

Requested branch head: f52f2898f40aa35a2e8bd3a9ae9a6399978e541e
GitHub merge ref inspected: d8f3bfab9753f0999185180ced68bbb2481e1568

Check	Exact result	Classification
maplibre-source-metadata — run 30930761637, run number 2	PASS. Focused standard-library tests, exact fixture outcomes/reason codes, Python compilation, JSON parsing, and the bounded summary all passed.	PR-related and healthy. This lane validates the newly introduced local projection profile.
MapLibre Perf Governance — run 30930763992, run number 82	FAIL. Its readiness inventory treated every non-README file anywhere under tests/fixtures/maplibre/** as an executable performance fixture. The new source-metadata JSON fixtures triggered that blanket check. Its exact validator inventory also did not admit the separately governed validate_source_metadata.py lane.	PR-caused integration gap. The focused validator was green; the broad performance-readiness workflow had no classification for a non-performance MapLibre fixture/validator lane.
release-dry-run — run 30930763951, run number 9589	FAIL. rollback-card-presence stopped on RollbackCard schema metadata changed; reconcile the readiness boundary.	Unrelated baseline drift. The PR did not touch release or rollback paths. The inspected base already contained the newer closed RollbackCard candidate profile and expanded x-kfm boundary metadata, while the job still asserted an older inventory.
rollback-drill — run 30930761492, run number 8094	FAIL. simulate-rollback stopped on release RollbackCard metadata changed; reconcile the accepted profile.	Unrelated baseline drift. Same pre-existing RollbackCard readiness expectation; no causal path from this PR.
domain-roads-rail-trade — run 30930764078, run number 8094	FAIL. The readiness helper reported no_python_files for the remaining scaffold validator-root set and emitted a broader-domain WORKFLOW_HOLD.	Unrelated baseline hold. The PR changes no Roads/Rail/Trade path, and the failure arises from empty Python-validator roots outside MapLibre.

Reconciliation: focused source-metadata versus performance governance

The passing focused workflow and the original failing performance-governance workflow were testing different boundaries:

1. maplibre-source-metadata deliberately executes the new no-network validator and exact positive/negative fixtures.
2. MapLibre Perf Governance is a readiness sentinel for the still-held browser/performance/render/trust lane. Before this correction, it interpreted any MapLibre fixture payload and any new MapLibre validator as evidence that the held performance lane had matured.
3. The source-metadata fixtures are local projection fixtures, not browser styles, render baselines, frame metrics, performance artifacts, proof packs, or release material.

The bounded correction therefore does not weaken the performance hold. It:

• recognizes only the exact tests/fixtures/maplibre/source-metadata/ subtree;
• requires the dedicated source-metadata workflow, test module, and validator to exist together;
• requires that lane's payloads to remain JSON-only and non-empty;
• conditionally admits only validate_source_metadata.py as the separately governed validator;
• continues to fail on every other unclassified payload under tests/fixtures/maplibre/**;
• preserves all existing checks for runtime fixtures, package dependencies, schema maturity, placeholder performance validators, browser/network posture, unsigned attestation, trust-shaped builders, and tracked performance artifacts.

Corrected-head hosted results

Corrected branch head: ed2584df8f0930e14e673087981c4c7c087ef4ca
GitHub merge ref inspected: d91d1a3fa7648d96cf381c4301c801b6b4211397, generated with base commit 86af15bfc3a816bbd411d714ea7377f2738ba6ce.

Check	Corrected-head result	Related-versus-baseline disposition
maplibre-source-metadata — run 30951302221, run number 3	PASS. Every focused step succeeded.	PR-related / resolved.
MapLibre Perf Governance — run 30951302443, run number 83	PASS. The job parsed the new validator/test, passed its three existing performance negative-path tests, classified 12 source-metadata JSON payloads under the dedicated no-network lane, found no unclassified MapLibre performance fixture payloads, and retained its explicit runtime WORKFLOW_HOLD.	PR-related / fixed by the one-file bounded correction. Green means the reviewed hold is intact; it does not mean browser or performance readiness.
release-dry-run — run 30951305585, run number 9601	FAIL. Candidate assembly and promotion-gate jobs passed. rollback-card-presence advanced past the current schema metadata checks, then failed because tools/validators/release/validate_rollback_card.py imports jsonschema but that job does not install/provide it: ModuleNotFoundError: No module named 'jsonschema'.	Unrelated baseline workflow dependency gap. No release/rollback dependency or workflow path is changed here.
rollback-drill — run 30951302364, run number 8106	FAIL. Reproduced the same stale accepted-profile assertion: release RollbackCard metadata changed; reconcile the accepted profile.	Unrelated baseline drift, reproduced after the correction.
domain-roads-rail-trade — run 30951302283, run number 8106	FAIL. Reproduced CI_READINESS_REASON: no_python_files for the remaining scaffold validator roots; the domain publish-dry-run and proof-hold jobs themselves succeeded.	Unrelated baseline readiness hold, reproduced after the correction.

All other corrected-head pull-request workflows completed successfully, including validator-suite, schema-validation, contracts-validate, contract-drift, promotion-gate, e2e-smoke, codeql, dependency-scan, and the other domain workflows.

Validator behavior

tools/validators/maplibre/validate_source_metadata.py remains:

• standard-library-only and no-network;
• bounded by regular-file, symlink, file-size, duplicate-key, non-finite-number, nesting, node, source-count, and finding limits;
• deterministic and redacted so reports do not echo source URLs, license values, or digest values;
• limited to local MapLibre style/source metadata and optional local manifest-digest string comparison;
• finite in outcome and exit behavior: ALLOW/0, ABSTAIN/2, DENY/3, and ERROR/4.

The focused tests preserve exact valid, abstain, deny, malformed-input, duplicate-key, determinism/redaction, no-network, and CLI-exit behavior.

Trust boundary

A green maplibre-source-metadata result proves only that selected local JSON satisfies this bounded projection grammar and, when a local digest manifest is supplied, that two declared digest strings agree. It does not prove:

• that remote bytes match either digest;
• that a source is authoritative, admitted, current, licensed for use, or safe;
• that a proof or manifest reference resolves or is authentic;
• EvidenceRef-to-EvidenceBundle closure;
• sensitivity, policy, review, promotion, release, deployment, or publication approval.

A green MapLibre Perf Governance result proves only that the separately governed source-metadata lane is classified without weakening the existing performance/runtime hold. It does not execute a browser, server, external source, render comparison, performance measurement, screenshot, attestation, proof, release object, correction, rollback, deployment, publication, or artifact upload.

ALLOW remains a validator result, not a PolicyDecision, PromotionDecision, ReleaseManifest, release authorization, or publication approval. The three unrelated failures are documented rather than waived, masked, or converted into success.

Rollback

Before an authorized merge, close this draft and abandon agent/maplibre-source-metadata-validation-20260804.

After an authorized merge, prefer reverting the PR merge commit as one unit. For a path-bounded rollback, revert ed2584df8f0930e14e673087981c4c7c087ef4ca first to remove the performance-readiness integration change, then revert the two preceding source-metadata commits in reverse order. No source activation, canonical evidence, lifecycle data, release state, deployment, publication, or public artifact requires restoration.

Reviewer disposition

DRAFT — PR-CAUSED CI DEFECT CORRECTED; KEEP ON HOLD FOR HUMAN REVIEW AND SEPARATE BASELINE DISPOSITION.

No PR-caused hosted failure remains at ed2584df8f0930e14e673087981c4c7c087ef4ca. The remaining release-dry-run, rollback-drill, and domain-roads-rail-trade failures are unrelated repository/workflow baseline issues and should be repaired or dispositioned in their owning lanes, not weakened or bundled into this source-metadata slice.

Do not mark ready, approve, merge, release, deploy, publish, activate a source, approve workflow authority, or change repository settings from this pull request.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.