cadrumo.domain.calculations.registry.schema_governance module¶

Declared governance provenance for a modelo revision: bounds and validation rules.

Every other conformance fact about the registry is DERIVED — coverage, grounding, classification coherence are all read back out of the tree. Authorship and signoff are not: who engineered a revision and who reviewed it are facts about people and agents, and nothing in the tree can compute them. They are therefore declared, on a stamp — engineered_by, review_status, reviewed_by, reviewed_at, and on an edition that inherits rows reviewed_against — and this module owns the rules that keep a declaration honest.

The stamp is optional and its absence reads as PENDING_REVIEW, so an unstamped revision is a visible unreviewed backlog entry rather than a silent pass. That fail-closed default is what makes the remaining rules matter: the only way to leave the backlog is to make a claim, and a claim that cannot be checked is worse than the backlog it escapes.

What a dishonest stamp looks like¶

Three shapes each render in a conformance report as a signed-off revision while recording nothing an auditor could verify, and each has a rule here:

Naming nobody. reviewed_by = " " satisfies any length constraint — whitespace counts — while leaving the attribution exactly as unfalsifiable as omitting it (validate_attribution_names_somebody()).
A date outside human reach. A signoff stamped 9999-12-31 or 1970-01-01 is a sentinel or a template artefact wearing a date (validate_reviewed_at_within_horizon()).
A stamp disagreeing with itself. A reviewed status with no reviewer is an unfalsifiable claim; a reviewer recorded against pending_review is a review the status denies (validate_governance_stamp_coherence()).

Why the horizon is a fixed date and not the clock¶

The registry is the authority behind every calculation the application performs, so a validation rule that consults the wall clock would make the shipped tree’s validity a property of the machine that loads it: a container whose clock is behind reality, or a stamp written the other side of a timezone boundary, would refuse the whole registry and take the product with it. A false refusal here costs incomparably more than a missed absurd date, so the bounds are fixed calendar dates, identical on every machine in every year.

They are consequently absurdity bounds, not freshness checks. They catch the sentinel no auditor could ever check and deliberately do not catch a near-future typo or a review stamped last year. Freshness is a governance question for the dev-side conformance audit, where consulting the clock costs one contributor a re-run rather than bricking the registry.

Why the stamp must be readable in one place¶

A revision compiles from its revision.toml manifest plus up to several hundred section fragments. The stamp is an authorship and signoff claim about the whole revision, so it has to be readable in the manifest alone: a fragment thousands deep that declared reviewed_by would win the merge while revision.toml still read unstamped. The loader therefore refuses the governance keys anywhere but the manifest, and takes its input from the field markers rather than a hand-written list — a hand-written list catches a rename, because the names stop matching real fields, but cannot catch an addition, and a fifth governance scalar forgotten there would become silently declarable in any fragment. Marking the field is the whole of enrolling it.

The same placement guarantee, for a different subject, covers the legally load-bearing scalars legal_refs, orden_aplicabilidad and valid_to: orden_aplicabilidad is an append array, so a fragment silently ADDS an approving orden the manifest never names, while valid_to and legal_refs merge in wherever the manifest is silent. Governance provenance and legal grounding are different subjects, which is why they carry different markers, but they need the same guarantee and the loader refuses both sets in the same place.