feat(catalog-envelope): feature 010 Phase C — the envelope consumer (T025–T037) by mbeacom · Pull Request #85 · mbeacom/adrkit

mbeacom · 2026-08-05T12:56:46Z

What and why

Implements T025–T037 of specs/010-catalog-backstage/tasks.md — the @adrkit/catalog-envelope consumer package: the five ordered envelope validation steps, digest verification, staleness, repository identity and isolation, and gated CatalogSnapshot derivation. Phase A created this package's placement and dependency boundary; this fills in the behaviour.

Barrier-free. Phase C sits before Barrier B under every reading of ADR-0020 clause 6 — every expected value comes from snapshot-envelope.md, a frozen contract, and none from the oracle.

File	Role
`src/envelope-shape.ts`	The consumer's own independent envelope shape (T025)
`src/validate/index.ts`	The five ordered validation steps (T028)
`src/digest/index.ts`	Independent digest recomputation (T031)
`src/identity/staleness.ts`	Staleness as exact revision inequality (T032)
`src/identity/repository.ts`	Identity mismatch and repository isolation, kept distinct (T033)
`src/snapshot/index.ts`	Ordered admission + gated derivation (T034)

Plus 10 synthetic fixtures with a committed construction record, and 8 test files (134 tests).

The ordering is the contract, and it is enforced structurally rather than by convention. Each stage is reachable only through a token minted by the stage before it, branded with a module-private Symbol that cannot be forged from an object literal. deriveCatalogSnapshot accepts unknown and throws on anything unadmitted — deliberately, because a returned rejection can be ignored and the caller can go on to read derivedPaths anyway, which FR-046 does not permit. The refusal therefore also holds for a caller arriving through a cast, through JavaScript, or through a future edit that widened a type upstream.

The duplication of the envelope shape across the two packages is deliberate (package-boundary.md §5): a shared type module would be an import edge, and if both sides derived their view from one declaration, a generator that changed the shape would change it on both sides at once and this package's validation would be comparing the generator against itself.

Two ADR-0016 observations found real bugs in checks that were already passing

This is the point of the observed-failing rule, and it is the first time on this feature it has caught a defect in a check rather than confirming one works. Both would otherwise have shipped as green coverage:

T037's source scan was blind to relative specifiers. It tested for the literal packages/adapters/, so ../../adapters/catalog-backstage/src/index.ts slipped past. On the first run of case B the build-graph assertion failed as intended while its companion scan passed — blind to exactly the specifier form that also evades check:deps. Now resolves specifiers against the importing file's directory before matching.
Staleness was unscoped by repository. snapshot-envelope.md §4 keys the expected-current revision to a repository ID, and FR-046 fixes the order digest → staleness → identity, so staleness runs before an identity mismatch has been named. Unscoped, a foreign-repository envelope was refused as stale rather than misidentified — right verdict category, wrong reason, and exactly the §5/§6 conflation the contract warns against, wearing a staleness label. checkStaleness now takes the expectation's repository id and returns not-applicable-different-repository, leaving the verdict to the identity check that follows.

An honest non-detection, recorded as such

consumer-adapter-import case A (package-name import) goes red at module resolution — Cannot find module '@adrkit/catalog-backstage' — not because the graph assertion detected anything. The consumer declares no dependency, so Bun's isolated linker never links it. That route is closed by check:deps, a different mechanism, and the evidence README says so rather than crediting the case with a catch it never made.

Case B is the load-bearing one: check:deps exits 0 printing core-has-no-adapter-deps: ok while the build-graph test fails, naming packages/adapters/catalog-backstage/src/index.ts. Both captures sit side by side — that pairing is the evidence a build-graph assertion covers something a manifest inspection structurally cannot, which is why T037 asks for one.

The evidence tree

7 directories, 14 constructed failures — violation introduced, run, verbatim output captured, restored, pass observed; all re-run against the final tree so they reproduce. Retained under specs/010-catalog-backstage/evidence/negative-cases/.

Directory	What was constructed	Observed
`consumer-steps/`	Each of the five validation steps deleted in turn	5 runs, all exit 1; restored 42 pass / 0 fail
`consumer-digest/`	The declared digest trusted instead of recomputed	38 pass / 6 fail
`consumer-staleness/`	Staleness rewritten as a lexicographic ordering	38 pass / 6 fail
`consumer-repository-identity/`	§5 and §6 conflated in each direction	40/4 and 41/3
`consumer-adapter-import/`	A real consumer → adapter edge, both specifier forms	see above
`consumer-core-surface-pin/`	A core type widened; the published schema touched	12/1 and 11/2
`consumer-correctness-claim/`	A correctness claim; a rung claim; an overclaiming emitted string	6/1, 6/1, 5/2

Deleting a step is a deliberately harder observation than driving the five malformed fixtures through: the fixtures show five distinct rejections, but a validator that rejected everything at step 2 would produce a rejection for every fixture too. The failure sets are also disjoint in the informative way — deleting the globDialect.engine comparison fails 2 tests while the other seven step-3 variants still pass, which is the evidence that step 3 is not one check wearing three names.

Three spec defects found — reported, not fixed

These are findings for central reconciliation. No spec.md, plan.md, data-model.md, research.md, task text, docs/adr/ record or specs/009-* file was edited by this PR — the only specs/ changes are the T025–T037 checkboxes and new evidence directories.

provenance had no frozen value domain (blocked Phase E). data-model.md §10 types it a bare string; FR-043 gives only a semantic requirement and names no values; consumer step 2 requires "a recognized provenance". Spike 009's three values (community-plugins-real / rhdh-plugins-real / synthetic) name corpus passes — a different axis from FR-043's authored-by distinction — so they could not be adopted. Implemented as non-empty string with the gap flagged loudly in envelope-shape.ts, rather than inventing a closed vocabulary that would make the consumer reject conformant generator output on the strength of a domain no contract froze.

Resolved by maintainer decision, 2026-08-05, after this branch was authored: two values, upstream-authored | maintainer-overlay, describing the provenance of the adrkit.io/owned-paths annotation — not of the descriptor, since under ADR-0020 clause 5 the descriptors are upstream-authored in both cases. Since zero third-party descriptors carry the annotation today, every corpus is currently maintainer-overlay and upstream-authored only becomes reachable if real adoption occurs, making the field a live adoption signal rather than dead metadata. Not implemented here, per maintainer instruction — Phase E is the phase that emits it.
T027 under-counts the fixtures by one. snapshot-envelope.md §7 row 1b additionally requires the acceptance contrast case — an otherwise-valid envelope whose entities are all annotation-absent with identityOnly: false, which must be accepted. That is the specific bug step 5's wording exists to prevent. Added as a tenth fixture, all-annotation-absent.json; a fixture set containing only rejections cannot prove a validator does not over-reject.
Phase A's locality guard structurally conflicts with T026 and T037. envelope-shape-locality.test.ts forbids naming schema/adr.schema.json, adr.schema, or @adrkit/catalog-backstage anywhere under the consumer — but T026 must name the schema in order to hash it, and T037 is a self-referential adapter-import guard. EXCLUDED_FROM_SCAN is the cleaner fix, but it lives in the adapter tree this session was forbidden to touch while a concurrent Phase D session runs. Worked around, both documented in-file as reported-not-settled: the pin table moved to test/protected-surfaces.json (data, outside the .ts scan's range — the guard forbids writing the schema, and a read-only integrity pin writes nothing), and T037 now derives adapter names from packages/adapters/*/package.json rather than hard-coding one — which is also the stronger rule, since FR-003/FR-044 forbid reaching any adapter, and which the maintainer has confirmed will be kept regardless of how the conflict is resolved.

Two design decisions for review

EnvelopeValidationResult gains detail: string and examined: { entityRecordsInspected, sourcesVerified, stepsReached } beyond data-model.md §11's three fields. Additive: outcome, reason and failedStep remain the frozen closed unions callers branch on. examined is ADR-0016's complementary half — without it, a validator that inspected zero entity records renders identically to one that inspected all of them and found them sound. It is also what lets the tests assert "rejected at its own step, not earlier", and what caught the step-4 deletion when sourcesVerified went empty.
The digest necessarily reads derivedPaths — it hashes every field except digest itself. An initial SC-014 assertion treated that as a violation; it is not. The digest check is one of the checks FR-046 requires to pass, and hashing a field is not trusting its value. The tests now assert the real property (derivedPaths is reachable in exactly three files under src/, with one marked type-inspection read in the validator) rather than a count that was only accidentally true.

Checklist

Commits are DCO signed off (git commit -s). No CLA is required.

— Left unchecked honestly: the commit carries no Signed-off-by. Three of the last four commits on main also carry none and there is no DCO workflow, so the convention did not appear enforced; adding a sign-off trailer under the maintainer's identity on their behalf seemed worse than flagging it. Say the word and I will amend and force-push.
If this changes a recorded decision in docs/adr/, an ADR is added or supersedes the affected record.

— N/A: no ADR is changed. This implements decisions already recorded in ADR-0020, ADR-0012, ADR-0007 and ADR-0016.
If the schema changed, I edited the Zod source, re-ran bun run schema:emit, and committed schema/adr.schema.json.

— N/A, and asserted rather than assumed: test/no-core-schema-change.test.ts pins the SHA-256 of schema/adr.schema.json, packages/core/src/schema/adr.schema.ts and all five files under packages/core/src/affects/, plus the exact affects/ file list. FR-004/FR-005 forbid changing any of them.
If packages/ci/src or @adrkit/core changed, I regenerated packages/ci/dist.

— N/A: neither changed. bun run build leaves packages/ci/dist byte-identical and the tree clean.
New or changed behavior is covered by tests, and each test was observed failing before it passed.

— 14 constructed failures across 7 evidence directories; see above. Two found defects in checks that were already green.
bun run typecheck && bun run build && bun test && bun run lint pass from a clean clone with no credentials configured.

— All four green, plus bun run check:deps (core-has-no-adapter-deps: ok) and bun run adr lint (20 records, 0 errors, 0 warnings). bun test: 1038 pass / 0 fail across 111 files; consumer suite 134 tests across 9 files.

Notes for reviewers

Scope. Only packages/catalog-envelope/** and specs/010-catalog-backstage/evidence/negative-cases/consumer-*/, plus the T025–T037 checkboxes. No manifest, no tsconfig.json, no scripts/check-deps.ts, nothing under packages/adapters/**, and nothing in the barrier-owned frozen-expectations/, accept-corpus-freeze/ or barrier-b-checkpoint.json trees — concurrent sessions own those.

Where I'd look hardest:

The §5 / §6 distinction in src/identity/repository.ts. Both failure modes are quiet: collapsing §5 into §6 turns a genuine mismatch into a silent filter that returns an empty result and reads as "no matches"; collapsing §6 into nothing lets one repository's entities answer another's query. They are separate exported functions with separate result types rather than one function with a flag, and the two mutations fail disjoint test sets — that disjointness is the actual evidence the distinction is implemented.
not-configured as an outcome distinct from ok in both identity modules. Reporting ok for "no expectation was supplied" would render an unchecked envelope identically to a checked one, which is ADR-0016's central failure shape.
The repository-scoping fix to staleness is the one behavioural decision here I'd most want a second opinion on, since it adds an outcome the contract does not name explicitly — though it is what §4's "for a given repository ID" wording requires once FR-046 fixes the evaluation order.

Standing. ADR-0014 rung 1 only. Every fixture is synthetic and hand-authored; no external adopter is involved and no third-party content appears in any of them. Every observation is maintainer-owned, which is not external, third-party, or community validation. Nothing claims reference-verified (rung 2) or externally validated (rung 3), and a test enforces that no document in the package asserts either without negation. No release is scheduled or prepared — ADR-0020 clause 9 defers that decision to a later record.

Discharges FR-004, FR-005 (consumer half), FR-041, FR-044 (behavioural half), FR-045 through FR-049, FR-058 (consumer framing half), SC-012 (framing half), SC-014.

…T025–T037) Implements `@adrkit/catalog-envelope`: the five ordered consumer validation steps, independent digest recomputation, staleness as exact revision inequality, repository identity and isolation, and `CatalogSnapshot`-shaped derivation gated behind all of it. The ordering is the contract, not an implementation detail. Each stage is reachable only through a module-private brand minted by the stage before it, so "no derived value is read before validation" holds in the type system and at runtime rather than by convention. `deriveCatalogSnapshot` accepts `unknown` and throws on anything unadmitted — a returned rejection can be ignored, and FR-046 does not permit that. Every check was observed failing before it was relied on (ADR-0016), with the failing input and verbatim output retained under `specs/010-catalog-backstage/evidence/negative-cases/`: - consumer-steps/ each of the five steps deleted in turn - consumer-digest/ the declared digest trusted instead of recomputed - consumer-staleness/ staleness written as a lexicographic ordering - consumer-repository-identity/ §5 and §6 conflated in each direction - consumer-adapter-import/ a real consumer -> adapter edge, both forms - consumer-core-surface-pin/ a core type widened; the published schema touched - consumer-correctness-claim/ a correctness claim; a rung claim Two of those observations found real defects in checks that were already passing: the adapter-import source scan was blind to relative specifiers, and staleness was unscoped by repository, so a foreign-repository envelope was refused as stale rather than as misidentified — the right verdict category for the wrong reason, and exactly the §5/§6 conflation the contract warns against. Fixtures are synthetic and hand-authored throughout. ADR-0014 rung 1 only: nothing here is reference-verified or externally validated, and no release is scheduled or prepared. Discharges FR-004, FR-005 (consumer half), FR-041, FR-044 (behavioural half), FR-045 through FR-049, FR-058 (consumer framing half), SC-012 (framing half), SC-014. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Implements Phase C’s @adrkit/catalog-envelope consumer, including ordered validation, integrity checks, repository handling, and gated snapshot derivation.

Changes:

Adds envelope validation, digest, staleness, identity, and derivation APIs.
Adds synthetic fixtures and comprehensive Bun tests.
Records observed-failing evidence for consumer safeguards.

Reviewed changes

Copilot reviewed 83 out of 83 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
`specs/010-catalog-backstage/tasks.md`	Marks T025–T037 complete.
`packages/catalog-envelope/README.md`	Documents the consumer pipeline.
`packages/catalog-envelope/src/index.ts`	Exports the consumer API.
`packages/catalog-envelope/src/envelope-shape.ts`	Defines the envelope wire shape.
`packages/catalog-envelope/src/validate/index.ts`	Implements ordered validation.
`packages/catalog-envelope/src/digest/index.ts`	Implements digest verification.
`packages/catalog-envelope/src/identity/staleness.ts`	Implements revision checks.
`packages/catalog-envelope/src/identity/repository.ts`	Implements repository checks and queries.
`packages/catalog-envelope/src/snapshot/index.ts`	Implements admission and derivation.
`packages/catalog-envelope/test/helpers.ts`	Provides shared fixture helpers.
`packages/catalog-envelope/test/protected-surfaces.json`	Pins protected core surfaces.
`packages/catalog-envelope/test/validate-steps.test.ts`	Tests validation ordering.
`packages/catalog-envelope/test/digest.test.ts`	Tests digest behavior.
`packages/catalog-envelope/test/identity.test.ts`	Tests staleness and identity.
`packages/catalog-envelope/test/derive.test.ts`	Tests gated derivation.
`packages/catalog-envelope/test/no-early-read.test.ts`	Guards early path reads.
`packages/catalog-envelope/test/sc-014.test.ts`	Consolidates SC-014 coverage.
`packages/catalog-envelope/test/no-adapter-import.test.ts`	Guards adapter independence.
`packages/catalog-envelope/test/no-core-schema-change.test.ts`	Guards core/schema surfaces.
`packages/catalog-envelope/test/no-correctness-claim.test.ts`	Guards integrity framing.
`packages/catalog-envelope/test/fixtures/README.md`	Documents fixture construction.
`packages/catalog-envelope/test/fixtures/author.ts`	Reproduces fixtures deterministically.
`packages/catalog-envelope/test/fixtures/valid.json`	Provides the valid control.
`packages/catalog-envelope/test/fixtures/all-annotation-absent.json`	Provides the acceptance contrast.
`packages/catalog-envelope/test/fixtures/malformed-invalid-json.json`	Exercises validation step 1.
`packages/catalog-envelope/test/fixtures/malformed-missing-or-wrong-field.json`	Exercises validation step 2.
`packages/catalog-envelope/test/fixtures/malformed-unrecognized.json`	Exercises validation step 3.
`packages/catalog-envelope/test/fixtures/malformed-missing-source-digest.json`	Exercises validation step 4.
`packages/catalog-envelope/test/fixtures/malformed-identity-only.json`	Exercises validation step 5.
`packages/catalog-envelope/test/fixtures/tampered.json`	Exercises digest rejection.
`packages/catalog-envelope/test/fixtures/stale.json`	Exercises staleness rejection.
`packages/catalog-envelope/test/fixtures/wrong-repository.json`	Exercises repository handling.
`packages/catalog-envelope/test/fixtures/sources/catalog-info.yaml`	Supplies repository-A source bytes.
`packages/catalog-envelope/test/fixtures/sources/second-catalog-info.yaml`	Supplies repository-B source bytes.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-steps/README.md`	Documents step mutations.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-steps/step-1-json-parse-deleted.patch`	Removes step 1.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-steps/step-1-json-parse-deleted.observed.txt`	Captures step-1 failure.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-steps/step-2-entity-shape-deleted.patch`	Removes step 2.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-steps/step-2-entity-shape-deleted.observed.txt`	Captures step-2 failure.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-steps/step-3-dialect-exact-value-deleted.patch`	Removes a step-3 comparison.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-steps/step-3-dialect-exact-value-deleted.observed.txt`	Captures step-3 failure.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-steps/step-4-source-digest-deleted.patch`	Removes step 4.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-steps/step-4-source-digest-deleted.observed.txt`	Captures step-4 failure.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-steps/step-5-identity-only-deleted.patch`	Removes step 5.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-steps/step-5-identity-only-deleted.observed.txt`	Captures step-5 failure.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-steps/restored.observed.txt`	Captures restored validation.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-digest/README.md`	Documents digest evidence.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-digest/declared-digest-trusted.patch`	Introduces a trusted-digest defect.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-digest/declared-digest-trusted.observed.txt`	Captures digest failures.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-digest/restored.observed.txt`	Captures restored digest checks.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-staleness/README.md`	Documents staleness evidence.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-staleness/ordering-comparison-instead-of-inequality.patch`	Introduces ordered revision comparison.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-staleness/ordering-comparison-instead-of-inequality.observed.txt`	Captures staleness failures.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-staleness/restored.observed.txt`	Captures restored staleness checks.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-repository-identity/README.md`	Documents identity evidence.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-repository-identity/mismatch-accepted.patch`	Disables mismatch rejection.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-repository-identity/mismatch-accepted.observed.txt`	Captures mismatch failures.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-repository-identity/isolation-leaks.patch`	Introduces cross-repository leakage.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-repository-identity/isolation-leaks.observed.txt`	Captures isolation failures.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-repository-identity/restored.observed.txt`	Captures restored identity checks.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-correctness-claim/README.md`	Documents framing evidence.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-correctness-claim/case-a-readme-claims-correctness.patch`	Adds a README overclaim.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-correctness-claim/case-a-readme-claims-correctness.observed.txt`	Captures README guard failure.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-correctness-claim/case-b-rung-claim.patch`	Adds an unsupported rung claim.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-correctness-claim/case-b-rung-claim.observed.txt`	Captures rung guard failure.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-correctness-claim/case-c-emitted-string-claims-correctness.patch`	Adds an emitted overclaim.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-correctness-claim/case-c-emitted-string-claims-correctness.observed.txt`	Captures emitted-string failures.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-correctness-claim/restored.observed.txt`	Captures restored framing checks.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-core-surface-pin/README.md`	Documents protected-surface evidence.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-core-surface-pin/case-a-catalog-type-widened.patch`	Widens a protected core type.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-core-surface-pin/case-a-catalog-type-widened.observed.txt`	Captures type-pin failure.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-core-surface-pin/case-b-published-schema-touched.patch`	Mutates the published schema.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-core-surface-pin/case-b-published-schema-touched.observed.txt`	Captures schema-pin failures.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-core-surface-pin/restored.observed.txt`	Captures restored surface checks.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-adapter-import/README.md`	Documents adapter-boundary evidence.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-adapter-import/case-a-package-name-import.patch`	Adds a package-name adapter import.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-adapter-import/case-a-package-name-import.observed.txt`	Captures resolution failure.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-adapter-import/case-a-package-name-import.check-deps.observed.txt`	Captures dependency-check behavior.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-adapter-import/case-b-relative-path-import.patch`	Adds a relative adapter import.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-adapter-import/case-b-relative-path-import.observed.txt`	Captures graph-guard failures.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-adapter-import/case-b-relative-path-import.check-deps.observed.txt`	Records the manifest-check gap.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-adapter-import/restored.observed.txt`	Captures restored graph checks.
`specs/010-catalog-backstage/evidence/negative-cases/consumer-adapter-import/restored.check-deps.observed.txt`	Captures restored dependency checks.

+export function checkStaleness(
+  validated: StructurallyValidEnvelope,
+  expectedRevision?: string,
+  expectedRepositoryId?: string,
+): StalenessCheckResult {


+export function queryEntitiesForRepository(
+  loadedEnvelopes: readonly StructurallyValidEnvelope[],
+  scopedRepositoryId: string,


+export function isRecognizedProvenance(value: unknown): value is string {
+  return typeof value === 'string' && value.length > 0;


+    let bytes: Uint8Array;
+    try {
+      bytes = readFileSync(join(options.sourceBaseDir, path));
+    } catch (error) {


+  return {
+    outcome: 'admitted',
+    admitted: {
+      [ADMITTED]: true,
+      envelope: envelopeOf(validated),


+/** True only for a token {@link admitEnvelope} minted. */
+export function isAdmittedEnvelope(value: unknown): value is AdmittedEnvelope {
+  return (
+    typeof value === 'object' && value !== null && (value as Record<symbol, unknown>)[ADMITTED] === true
+  );


+  const identity = record['identity'];
+  if (!isPlainObject(identity)) return `entities[${index}].identity is not an object`;
+  if (typeof identity['canonicalId'] !== 'string') {
+    return `entities[${index}].identity.canonicalId is not a string`;
+  }
+  if (!isStringArray(identity['allRefs'])) return `entities[${index}].identity.allRefs is not a string array`;


+      at3(),
+    );
+  }
+  for (const flag of ['dot', 'nocase', 'nonegate'] as const) {


Copilot AI balanced review requested due to automatic review settings August 5, 2026 12:56

Copilot started reviewing on behalf of mbeacom August 5, 2026 12:57 View session

Copilot AI reviewed Aug 5, 2026

View reviewed changes

mbeacom merged commit 7551ae6 into main Aug 5, 2026
10 checks passed

mbeacom deleted the mbeacom-phase-c-envelope-consumer branch August 5, 2026 13:02

Navigation Menu

feat(catalog-envelope): feature 010 Phase C — the envelope consumer (T025–T037) - #85

feat(catalog-envelope): feature 010 Phase C — the envelope consumer (T025–T037)#85
mbeacom merged 1 commit into
mainfrom
mbeacom-phase-c-envelope-consumer

mbeacom commented Aug 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		export function isRecognizedProvenance(value: unknown): value is string {
		return typeof value === 'string' && value.length > 0;

Conversation

mbeacom commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What and why

Two ADR-0016 observations found real bugs in checks that were already passing

An honest non-detection, recorded as such

The evidence tree

Three spec defects found — reported, not fixed

Two design decisions for review

Checklist

Notes for reviewers

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mbeacom commented Aug 5, 2026 •

edited

Loading