james.maesandClaude Fable 5.2
bf546e16c5
On develop the renderer speaks qqq-renderer-0.2.0 and the bridge accepted only 0.1.0, so the bridge refused its own renderer, a label could not be previewed, and a render target was accepted and then ignored. The version rule (RendererVersion). The bridge accepts 0.1.0 (the released fields, the 13 released refusals) and 0.2.0 (the same with diagnostics and detail, those refusals and the 15 scene refusals); any other version is rejected. Each set is written out, replacing the temporary enum range. A job is framed as 0.1.0 reads it unless it needs more. Before a job only 0.2.0 can do (a version 2 scene, a preview) the bridge asks the worker its version by validating a fixed, empty version 1 scene, so an old image is refused as RENDERER_TOO_OLD and receives nothing of the scene or the record; an answer from 0.1.0 to such a job is refused whatever it says. Diagnostics (WorkerAnswer, SceneFacts). A version 2 refusal is RenderException(code, diagnostic). The worker is untrusted, so every field is checked again: the closed vocabulary, whole numbers in bounds, an element only if the scene that was sent declares it, and a pointer only of array indexes, schema property names and declared ids. An answer holds at most 2048 diagnostics in one megabyte beside its label, and no frame passes the frame of the largest document the deployment admits. A refused answer that carries any part of a label is rejected. Render target. targetDpi is sent with a version 2 scene and the label is held by the output policy to the page at that resolution. A version 1 scene or a PDF asked for another resolution than its stock's is refused as TARGET_REQUIRES_SCENE_2 before any worker is contacted, because renderer 0.1.0 does not read the field. supportsRenderTarget() is true. Preview. preview() is the print path stopped before retention: the same job with collected diagnostics, the same integrity checks and output policy, and a page decoded by ZplRaster from the accepted label bytes. ZplRaster is its own strict reader of the policy's grammar and runs the policy first; it paints ^GFA and ^GB exactly, hatches printer font text (the page is then not exact) and writes a one-bit PNG itself. Refusals come back as diagnostics, never as a label. A refused scene is drawn on the host from the diagnostics' boxes alone: the worker sends no label for it and the wire gains no field for the partial canvas, so no host can print a label with elements missing. The design records the decision in sections 6.1 and B.1, the version question in 11.3 and what the host now reads from a scene in 8.1. renderer/qualification.json said qqq-renderer-0.1.0 and qqq-barcodes-1; it now says what the worker reports, and a test holds it to the answer. The mutation campaign covers the page decoder and the answer frames. The new classes are gated at 100% line coverage and the bundle gate rises to the measured 90% of instructions and 88% of lines. The version 1 corpus is untouched. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>
39 lines
1.4 KiB
JSON
39 lines
1.4 KiB
JSON
{
|
|
"schema": "qqq-renderer-qualification/1",
|
|
"qualified": false,
|
|
"qualificationId": null,
|
|
"imageDigest": null,
|
|
"rendererVersion": "qqq-renderer-0.2.0",
|
|
"protocol": "qbit-document-renderer/1",
|
|
"catalogVersion": "qqq-barcodes-9",
|
|
"javaVersion": "21.0.13",
|
|
"requiredRuntime": "runsc",
|
|
"requiredHostOs": "linux",
|
|
"network": "none",
|
|
"readOnlyRootFilesystem": true,
|
|
"uid": 65532,
|
|
"gid": 65532,
|
|
"capabilities": [],
|
|
"noNewPrivileges": true,
|
|
"memoryBytes": 536870912,
|
|
"tmpfsBytes": 67108864,
|
|
"pids": 64,
|
|
"cpuSeconds": 15,
|
|
"wallMilliseconds": 30000,
|
|
"maximumInputBytes": 16777216,
|
|
"maximumOutputBytes": 146800640,
|
|
"approvedHostMounts": [],
|
|
"evidence": [],
|
|
"remainingQualification": [
|
|
"approved immutable build/runtime/final image digests and vulnerability review",
|
|
"host runsc mapping, binary and cgroup enforcement attestation",
|
|
"concrete host RenderPort integration with asset authorization and strict output validation",
|
|
"external deadlines, cancellation, durable owned-container cleanup and crash recovery",
|
|
"disposable-lab hostile template/font/image and resource boundary assessment",
|
|
"independent ZPL output grammar gate before printing",
|
|
"PDF intake/scanning/viewer policy and retained-file audit integration",
|
|
"printer/scanner physical barcode and carrier-specific qualification",
|
|
"production corpus, typography, locale and concurrent throughput measurements"
|
|
]
|
|
}
|