Source-neutral binding and flow reference

github.com/OpenUdon/uws/binding owns metadata contracts and advisory checks. Source parsing stays in source tooling; metadata is not approval or execution permission. The package imports no APItools/provider/credential client.

Shape table contract

uws.shape-table.v1 binds each Source ID/kind and exact lowercase SHA-256 to operation metadata. Source URLs are provenance, never fetch permission. Native selectors retain ID/reference distinctions, stable operation keys and known aliases. Runtime-function kinds remain reserved metadata. Browser-profile shapes use the additive optional OperationShape.Browser contract below; UWS does not implement their leaf execution or source production.

OperationShape describes an explicit protocol, supported input/output schemas, security and completeness. Non-HTTP operations carry no fabricated HTTP method, path or server. Partial HTTP descriptions may omit unknown details; Complete cannot assert their absence is resolved. Schema.Known distinguishes a complete JSON Schema projection from absent/partial evidence. Security alternatives are OR; requirements within one alternative are AND. An empty alternative is known anonymous access; unknown security is distinct and cannot become anonymous.

ShapeTable.Validate/Marshal/ParseTable check closed structure, bounded data, source identity consistency, selector/input/output uniqueness and schema JSON. Serialization sorts copied source/operation slices while preserving declaration and security alternative order. No caller metadata is mutated. Limits are 8 MiB per table, 512 sources, 10000 operations and 256 KiB per schema. Strict JSON container nesting is limited to 100 before model/schema decoding.

NewResolver owns a private decoded snapshot and returns independent results. It resolves exact source/selector identities, reports missing or ambiguous matches and propagates cancellation. It cannot verify a producer's claims against real source bytes: OpenUdon/P09 and consuming workers independently reproduce/verify those claims before deriving authority. Successful resolution therefore does not establish trust or enable an operation.

Binding validation and deterministic flow findings are delivered by C09.2/.3. Ordinary document validation and frozen published contracts remain unchanged.

Browser shape metadata

Browser sources use kind browser-profile, protocol browser, and an id selector whose value and key are the exact native action or flow key. Reference selectors and aliases are refused. HTTP method, path and server fields are absent. Browser.ProfileVersion selects Browser 1.5–1.10, authentication 1.0/1.1, or registration 1.0–1.2; CallKind selects action, authentication or registration respectively.

SelectedSHA256 names the complete selected native action/flow subtree. The separate Source.SHA256 binds exact full source bytes. Source tooling produces and independently reproduces both identities; table validation proves only metadata structure. Origins contains sorted unique canonical HTTP(S) origins, with default ports omitted. Effects and optional ConfirmationPolicy retain native JSON. Credential slots are symbolic name/kind/required declarations; registration input slots additionally preserve their complete schema and optional native condition. Private credentials, input values, sessions and driver configuration are excluded.

Action inputs and outputs use location body. The producer maps the complete parameters schema, named parameters and full output contracts, retaining presence/count/extraction annotations. Raw JSON preserves numeric lexemes, schema extensions and false/zero/empty values. Required boolean fields must be present; null and unknown metadata refuse. Absent optional metadata stays absent; a present empty registration-slot array stays present. Complete and Schema.Known describe evidence completeness independently of runtime support. Partial shapes retain indeterminate diagnostic outcomes.

Adding Browser leaves every non-browser shape serialization unchanged and does not modify any published profile/schema or the table version. Profile fragments are validated only against the immutable embedded native schemas; external schema resources are never fetched. Shapes and diagnostics supply no approval, authentication readiness, containment or execution permission.

ValidateBinding applies the existing literal/template-schema and response reference checks to browser body contracts. Supplying a browser input outside body returns binding.browser_input_location. Required native credential declarations match SecurityBinding.Scheme; CredentialSlot is a symbolic host binding only. Missing required declarations return binding.browser_credential_missing, indeterminate when the shape is partial. No check reads credential values or verifies a live session. Existing unknown schema, security, resolver and output codes retain their indeterminate outcomes.

Browser action binding applies native integer ranges without changing schema bytes: signed 64-bit in Browser 1.8, and ±9007199254740991 in Browser 1.9/1.10. Exact literals and known defaults outside those ranges receive binding.browser_integer_range. Dynamic integer references need independent constant/enum/range proof; unproved ranges and unknown parameter types remain indeterminate. Checks preserve exact json.Number lexemes before comparison. These advisory rules do not claim source reproduction or runtime support.

AnalyzeFlow observes core references in source-bound browser request.body, including typed map/slice payloads, to account for prior step-output use. It retains declared UWS effect observations; native effects never create authority or replace an unknown operation effect. Native profile placeholders/extensions and authentication/registration declarations remain opaque and value-free.

The fixture-only browser shape corpus pins eleven native action/authentication/registration sources, exact M51 public fixtures and the lossless canonical golden. Public consumer tests validate native sources, exact selector/source identities, complete metadata preservation, partial evidence and ambiguous/malformed cases without browser or runtime calls.

Advisory binding validation

ValidateBinding accepts a resolver plus a consumer-prepared projection of bound inputs, symbolic credential slots/scopes, response references and independently reviewed expression types. Compatible means the metadata constraints checked are proved; it is never credential readiness or execution permission. Incompatible identifies a concrete mismatch; missing/partial/unsupported type, source or schema evidence remains indeterminate. Reports contain stable code, path and outcome metadata, never input values or resolver/schema error text.

Required input presence and literal schemas are checked with the existing JSON-Schema implementation and an external-resource loader that always refuses. No file/network ref is fetched. Exact schema equality, finite enum/const values or simple proven type containment can establish expression compatibility; unproved constraint containment stays indeterminate. Nested body/array templates are projected as closed schemas using reviewed expression types and literal const leaves; structural containment is proved only for the supported constraint subset. Partial number/integer overlap is indeterminate, not disjoint. Nested proofs retain compiled child nodes in the original dialect/resource. Unsupported effective constraints, source references, pattern-based closure and overlapping pattern/path constraints remain indeterminate. False leaves are incompatible; nullable or pattern-driven fields are not proof of absence. Path proofs also retain parent cardinality and prerequisite item/property constraints. Unsupported parent const/enum/name/dependency constraints remain indeterminate. Native literal witnesses can prove a schema admits a value; failed sample checks never prove absence, while false or exhausted finite const/enum schemas can. Empty arrays in mixed templates use exact const proof. Typed JSON-compatible containers are normalized with UseNumber before template discovery, so they have the same binding meaning as ordinary JSON objects/arrays; invalid/duplicate-key values are refused without excerpts. Response field pointers use canonical indexes; unavailable schemas and partial missing fields don't become compatible by omission. Security alternatives preserve OR/AND structure and require reviewed symbolic slots plus required scopes, without loading keys.

Deterministic advisory flow

AnalyzeFlow reports possible structural reachability from the main/sole entry workflow and declared trigger routes, including dependencies, workflow calls and explicit goto targets. Conditions are not evaluated. Merge children are not treated as executed. Missing/ambiguous references and cycles remain visible. Generic dependencies retain group barriers and step→workflow→operation precedence. Core step-output references use their explicit workflow or known step/operation invocation owner; cross-declaration dependencies retain their known caller frame. Terminal goto instead selects the globally indexed exact step/workflow and starts in the root invocation frame. No foreign-workflow name fallback is used. Workflow dependencies at root share that root frame; dependencies within a workflow call create their child invocation frame, matching native execution. Workflow controls read the incoming record snapshot; child runnables and final workflow outputs use refreshed records in the body's frame. Core step-output references mark the step's own output used. Operation outputs remain separate records; matching names or step/operation IDs do not alias them. Known core references mark their exact output owner used; output_unreferenced means no recognized core reference, not proof that an opaque profile cannot consume the value. Findings are sorted by path/code, capped at 128 with an explicit Truncated flag, and contain no document values or content excerpts.

Sequence/branch observations show pending steps before subsequent declared writes and unknown effects without inferring effects from HTTP methods. Await without a timeout, unbounded retries and loops/forEach without a statically known item array are work-bound warnings, not claims of an infinite runtime loop. The analysis does not dispatch effects, alter validation, grant authority or decide consumer policy. Caller context cancellation is propagated.