Compiled manifest-local contract for application input and Result.value.
Ordinary contracts use the same bounded object profile as Kernel capability
schemas. Application contracts additionally permit one root-only tagged
union: two to sixteen closed object branches in oneOf, all sharing exactly
one required string discriminator whose const value is distinct in every
branch.
The shared bounded schema profile additionally recognizes only the asserted
sha256 string format. References, regexes, arbitrary formats, nested
composition, union types, and arbitrary oneOf remain unsupported. The
normalized contract is limited to 64 KiB and compiled once with JSV.
Summary
Functions
Returns the stable behavior identity of the compiled contract.
Explains a contract rejection without disclosing the rejected value.
Renders the contract's shape as compact text for a model-facing prompt.
Checks that a contract is the unchanged result of bounded compilation.
Returns the rules a tagged-union rejection can carry beyond the object profile.
Types
@type rejection() :: PtcRunner.Kernel.JSONSchema.rejection()
@type t() :: %PtcRunner.Kernel.ValueContract{ attestation: binary(), schema: map(), validator: JSV.Root.t() }
Functions
Returns the stable behavior identity of the compiled contract.
$schema, default, and vendor annotations are removed by compilation.
This projection additionally removes title and description only while
traversing accepted schema positions; property names with those spellings
remain literal application keys.
Explains a contract rejection without disclosing the rejected value.
Every reported name comes from the compiled schema rather than from the
value: the discriminator's name, the branch whose const the value carries,
and bounded, sorted allowed and missing key lists at retained object paths.
The only facts derived from the value itself are its JSON kind, required-key
absence, and per-object counts of keys the schema does not declare — types,
booleans, and numbers, never caller-authored content.
A rejected result is deliberately withheld from the public error, so without this an operator cannot tell a missing key from a wrong shape without re-running under private inspection.
violations locates faults, it does not enumerate them: when several array
elements fail the same way, the reported set may name fewer of them than
actually failed. It is a diagnosis, not a validation report. At most eight
violations are retained. One violation at each retained object path carries
applicable local facts. Closed paths add allowed_keys and any undeclared
count; actual objects add any missing required keys. Open paths never label
valid extension keys undeclared. Schema-name lists keep at most 32 names and
4,096 encoded bytes; truncated lists carry their total count and an explicit
truncation flag.
Renders the contract's shape as compact text for a model-facing prompt.
A task prompt that paraphrases its own result schema drifts from it, and the drift only surfaces as a rejected result after a live run has been paid for. Generating the shape from the compiled contract keeps the schema the single authority and turns drift into a test failure instead.
Types only — no descriptions, no prose, no guidance about when each branch applies. That judgement belongs to the task, which the schema cannot express.
Checks that a contract is the unchanged result of bounded compilation.
@spec union_rules() :: [atom()]
Returns the rules a tagged-union rejection can carry beyond the object profile.