Skip to content

Per-country vocabulary fences for the source-record schema union #726

Description

@MaxGhenis

From the sol half of the #698 merge review (q2): the sources schema's
kind-discriminated union is deliberately shared across US/UK/BE, so adding
any country's operation kind makes it admissible (structurally) in every
country's documents. Closed-world shapes and the byte-identity/compatibility
gates pin actual payloads, so this is admission-widening rather than a
behavior defect — but a per-country vocabulary fence (each country package
declares which kinds its stages may use; the loader refuses others) would
make cross-country vocabulary leakage fail closed at load time instead of
relying on downstream gates.

Non-blocking finding from the #698 review; candidate F1/F2 hardening.

🤖 Generated with Claude Code

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions