use-case-c

name

use-case-c

description

The Squeeze Loop instance for Use Case C — an HTTP API where the document plane (OpenAPI contract) and the runtime plane (live server) are forced into exact lockstep, on terrain C (split planes). The dominant failure is blending — a clean schema masking broken runtime behaviour (id leaks, tracebacks, missing auth), or a clean runtime escaping stale documentation. The exerciser RUNS the live server over HTTP but is physically denied the server source and the published schema (the load-bearing "run, don't read" channel). Use when working on src/C — the API governance policy, the canonical OpenAPI contract, the schema linter, the live server, the conformance test matrix, the legacy route-signature regression oracle, or the no-blend cross-check. Trigger phrasings: "use case C", "instance C", "split planes", "document vs runtime plane", "no-blend", "run don't read", "OpenAPI conformance squeeze", "id leak / missing auth on an untested route".

Use Case C — the split-planes API squeeze loop

Use Case C is a base squeeze loop (instance-c, terrain C): an API whose document plane (the published OpenAPI schema) and runtime plane (the live HTTP server) are forced into exact lockstep so neither can mask the other. Its SL-1.0 self-description is src/C/instance-c.sl.json; the companion write-up is src/C/docs/use-case-c.md.

The dominant failure it guards

Coherent-and-wrong here = blending — one plane's weak check standing in for the other's strong claim: a clean schema masking broken runtime behaviour (id leaks, tracebacks, missing auth on an untested route), or a clean runtime escaping stale documentation.

Terrain C — split planes

Correctness divides across two planes, each with its own authority:

• Runtime plane — the API governance policy API_POLICY_081 (CLAUSE_1 auth, CLAUSE_2 uuid-only ids, CLAUSE_3 clean errors).
• Document plane — the canonical OpenAPI contract base_schema.json (0444), read independently by both bands.

The soundness load rests on a no-blend cross-check: each plane is verified separately and the planes must agree.

The bounds

• Upper bound U — both plane authorities (governance policy + canonical contract), which the sentinel refuses to let blend.
• Lower bound L — the schema linter (document plane), the frozen app-state DB, the legacy route-signature regression oracle (ty0_baseline), and — for the exerciser — the live server observed over HTTP.

The cast (three actors) and the run-vs-read channel

Actor	Builds	U	L	Must not see
Gate sentinel / no-blend referee (coordinator)	the gate sequence + the .sl.json	both plane authorities	linter + runtime HTTP + frozen DB + legacy-signature regression + both bands	—
API implementer	the HTTP server + its published OpenAPI schema	policy + canonical contract	the frozen DB it serves; the linter its schema must pass	the conformance matrix
Conformance exerciser	the conformance test matrix	policy + canonical contract, read independently	what the live server returns when RUN over HTTP	the server source + the implementer's openapi.json

The load-bearing subtlety: the implementer produces the running server (runtime_oracle), but the exerciser runs it over HTTP as its lower bound — it never reads the source. A judge may run an oracle over an artifact it is barriered from; it may never read that artifact. That run-vs-read distinction is what keeps the barrier physical rather than honorary.

The gates

• Gate A / isolation. The exerciser has zero import/path linkage to the server source.
• Gate B (runtime). Status codes, exact response keys, no forbidden patterns (no id leaks, no tracebacks) on every tested route; plus the document-plane route cross-check.
• Gate C (coverage / no-blend). Every clause maps to a passing check on its plane, seeded coherent-and-wrong negatives fire, and a clean check on one plane never stands in for the other; the legacy ty0 signature hash re-verifies (no regression).

Disjointness

The implementer is bound by both plane authorities but reads only the frozen DB and the linter below; the exerciser is bound by the same authorities but its lower bound is the running server observed over HTTP — it runs the implementation without ever reading its source. The sentinel certifies only when both planes pass separately and agree, so neither plane's check can mask the other. Catchability: an implementer blend (clean schema/happy path hiding an id leak or missing auth) is caught by the exerciser's runtime assertions + route cross-check; a weak happy-path matrix is caught by the sentinel (Gate C coverage + seeded negatives).

python config/skills/sl-internal/scripts/sl_disjointness_check.py src/C/instance-c.sl.json

(0 FAIL / 8 checks.)