# One-time projection-fidelity transition (remove after re-baseline). # # The v1.5.0 baseline openapi.yaml asset was generated by the earlier, lossy CUE # projection. This PR makes the projection faithful: it now emits the enum # constraints CUE always enforced and rewrites hidden strict-variant definitions # (#_AssessmentLogStrict, etc.) to their visible base schemas. oasdiff reports the # gap between the old asset and the faithful projection as breaking, but the # underlying schema contract is unchanged (0 ERR at the pre-converter-fix commit). # # These exceptions cover ONLY that transition. Once this PR merges and the next v1 # release publishes a faithful openapi.yaml, the baseline matches the projection # and a follow-up PR MUST delete this file. # Hidden strict-variant definition no longer projected as its own path (rewritten # to its visible base schema). api-path-removed-without-deprecation _AssessmentLogStrict # Enum constraints now emitted by the projection (CUE always enforced them). request-body-became-enum ArtifactType request-body-became-enum ConfidenceLevel request-body-became-enum EntityType request-body-became-enum Lifecycle request-body-became-enum Result request-property-became-enum AssessmentLog request-property-became-enum AssessmentRequirement request-property-became-enum Catalog request-property-became-enum Control request-property-became-enum ControlCatalog request-property-became-enum ControlEvaluation request-property-became-enum Entity request-property-became-enum EvaluationLog request-property-became-enum Log request-property-became-enum Metadata # Required fields and types surfaced by rewriting hidden strict variants to their # visible base schemas. new-required-request-property ControlEvaluation new-required-request-property EvaluationLog request-property-type-changed ControlEvaluation request-property-type-changed EvaluationLog response-property-type-changed ControlEvaluation response-property-type-changed EvaluationLog ### Task 12: cue2openapi upstream-migration fidelity changes # # cue2openapi now generates from cuelang.org/go/encoding/openapi rather than a # hand-rolled AST walk. Embedded CUE definitions are emitted as # `allOf` against the embedded schema instead of being dropped, and 51 # properties plus 21 required constraints that the previous generator # silently omitted are now present. No property or constraint that CUE actually # enforces was removed; the change is structural, so oasdiff reports it against # the v1 baseline. Two removals are deliberate fixes oasdiff did not flag: the # old walker leaked the hidden CUE uniqueness-check fields `_uniqueTermIds` # (Lexicon) and `_uniqueMappingIds` (MappingDocument) into the published schema # as REQUIRED properties, so documents had to carry internal bookkeeping to # validate. # # Non-empty-tuple fields (CUE `[T, ...T]`) now surface their CUE-enforced # minimum length as `minItems: 1`, which the old walker did not emit. request-property-min-items-increased AssessmentLog request-property-min-items-increased AssessmentRequirement request-property-min-items-increased Catalog request-property-min-items-increased Control request-property-min-items-increased ControlEvaluation request-property-min-items-increased RACI request-property-min-items-increased Threat # CUE regex constraints (`=~"..."`) on these fields now surface as an # OpenAPI `pattern`, which the old walker did not emit. request-property-pattern-added Entity request-property-pattern-added EvidenceMapping request-property-pattern-added MappingReference # Two distinct fidelity fixes fold into this (id, schema) pair: # - AssessmentLog.steps-executed is `int` in CUE (evaluationlog.cue); the old # walker mistranslated it as `string`. # - Evidence.payload is CUE's top type `_` (auditlog.cue:92), so it accepts # any value; the old walker emitted `string`, forcing structured inline # evidence to be serialised. request-property-type-changed AssessmentLog response-property-type-changed AssessmentLog # Datetime is `time.Format("2006-01-02T15:04:05Z07:00")` (a full RFC 3339 # datetime) in CUE; the old walker mistranslated it as OpenAPI format `date`. response-body-type-changed Datetime # The referenced schema's own `required` list is unchanged; oasdiff reports # these nested paths as removed only because the field's `$ref` is now # wrapped in `allOf` (to carry the field's own description) instead of being # a bare `$ref` sibling. response-required-property-removed AssessmentLog response-required-property-removed AssessmentRequirement response-required-property-removed Catalog response-required-property-removed Control response-required-property-removed Log response-required-property-removed Metadata response-required-property-removed Threat # `state` is `#Lifecycle: *"Active" | …` — it has a CUE default, so a producer # may omit it and the consumer applies "Active". The old asset emitted it as # required, which rejected documents the CUE accepts (the repo's own # good-ccc.yaml, good-osps.yml and good-lifecycle.yaml among them). The # projection now drops a defaulted field from `required` and publishes its # `default` instead; oasdiff sees only the first half and calls it breaking. # The same change on Recommendation and AcceptedMethod (`required: *false | # bool`) is not listed because both schemas are experimental and already exempt. response-property-became-optional AssessmentRequirement response-property-became-optional Control # Strict schema compatibility checks added after this transition file was first # written. These changes are the same projection-fidelity transition documented # above: allOf now preserves embedded CUE definitions rather than flattening or # dropping their fields. Remove these entries with the rest of this file after # re-baselining against a faithful OpenAPI release. response-required-property-removed Actor response-required-property-removed ControlCatalog response-required-property-removed Resource response-required-property-removed ThreatCatalog request-property-removed Actor request-property-removed AssessmentLog request-property-removed AssessmentRequirement request-property-removed Catalog request-property-removed Control request-property-removed ControlCatalog request-property-removed Log request-property-removed Metadata request-property-removed Resource request-property-removed Threat request-property-removed ThreatCatalog response-optional-property-removed Actor response-optional-property-removed AssessmentLog response-optional-property-removed AssessmentRequirement response-optional-property-removed Catalog response-optional-property-removed Control response-optional-property-removed ControlCatalog response-optional-property-removed Log response-optional-property-removed Metadata response-optional-property-removed Resource response-optional-property-removed Threat response-optional-property-removed ThreatCatalog