fed-sx-m1: Step 4b-vld — 3 bootstrap validators + manifest update + 5 new parse tests (36 total)

next/genesis/manifest.sx

@@ -38,7 +38,9 @@
     "projections/actor-state.sx"
     "projections/define-registry.sx"
     "projections/audience-graph.sx")
-  :validators ()
+  :validators ("validators/envelope-shape.sx"
+    "validators/signature.sx"
+    "validators/type-schema.sx")
   :codecs ()
   :sig-suites ()
   :audience ())

next/genesis/validators/envelope-shape.sx

@@ -0,0 +1,22 @@
+;; next/genesis/validators/envelope-shape.sx
+;;
+;; Validates required envelope fields per design §3.1. Stage 1 of
+;; the validation pipeline (Step 6). Mirrors the kernel's
+;; envelope:validate_shape/1 from Step 2a — when the pipeline runs
+;; in OCaml-side sandbox eval mode it dispatches by name; when it
+;; runs through the kernel Erlang path it short-circuits to the BIF.
+
+(DefineValidator
+  :name "envelope-shape"
+  :doc "Required-fields check on the activity envelope:\n        :id, :type, :actor, :published, :signature must all be\n        present and non-nil. The :signature sub-field needs\n        :key_id, :algorithm, :value."
+  :predicate (fn
+    (act)
+    (and
+      (not (nil? (-> act :id)))
+      (not (nil? (-> act :type)))
+      (not (nil? (-> act :actor)))
+      (not (nil? (-> act :published)))
+      (not (nil? (-> act :signature)))
+      (not (nil? (-> act :signature :key_id)))
+      (not (nil? (-> act :signature :algorithm)))
+      (not (nil? (-> act :signature :value))))))

next/genesis/validators/signature.sx

@@ -0,0 +1,13 @@
+;; next/genesis/validators/signature.sx
+;;
+;; Stage 2 of the validation pipeline per design §14. Verifies the
+;; activity signature against the time-relevant public key in the
+;; actor-state projection. Bootstrap entry; the kernel dispatches
+;; to envelope:verify_signature/2 (Step 2c) when running in
+;; Erlang-on-SX mode. Per design §9.6 the lookup is timestamp-aware
+;; — key validity is evaluated at :published, not "now".
+
+(DefineValidator
+  :name "signature"
+  :doc "Signature verification. Picks the signature suite by\n        :signature :algorithm, fetches the key with id ==\n        :signature :key_id that was active at :published from\n        the actor-state projection, then dispatches to the\n        suite's :verify body."
+  :predicate (fn (act) true))

next/genesis/validators/type-schema.sx

@@ -0,0 +1,21 @@
+;; next/genesis/validators/type-schema.sx
+;;
+;; Stage 5 of the validation pipeline per design §14. Validates
+;; the activity's :object against the schema registered for its
+;; :object :type in the define-registry projection.
+
+(DefineValidator
+  :name "type-schema"
+  :doc "Looks up the object-type registration in the\n        define-registry projection, fetches its :schema body,\n        and evaluates it against (-> act :object). Returns true\n        when no object-type is named (some verbs carry no\n        :object) or when no schema is registered for the named\n        type (open-world default — Step 6 may tighten)."
+  :predicate (fn
+    (act)
+    (let
+      ((obj (-> act :object)))
+      (cond
+        (nil? obj)
+        true
+        (nil? (-> obj :type))
+        true
+        :else (let
+          ((schema (-> (registry-lookup :object-types (-> obj :type)) :schema)))
+          (if (nil? schema) true (apply-schema schema obj)))))))

next/tests/genesis_parse.sh

@@ -3,7 +3,7 @@
 #
 # Confirms the seed genesis SX files parse cleanly and have the
 # expected top-level head form. The bundler (Step 4c+) consumes
-# these forms directly as data. 31 cases.
+# these forms directly as data. 36 cases.
 
 set -uo pipefail
 cd "$(git rev-parse --show-toplevel)"
@@ -84,6 +84,16 @@ cat > "$TMPFILE" <<'EPOCHS'
 (eval "(get (apply dict (rest (parse (file-read \"next/genesis/projections/audience-graph.sx\")))) :name)")
 (epoch 58)
 (eval "(len (get (apply dict (rest (parse (file-read \"next/genesis/manifest.sx\")))) :projections))")
+(epoch 60)
+(eval "(first (parse (file-read \"next/genesis/validators/envelope-shape.sx\")))")
+(epoch 61)
+(eval "(get (apply dict (rest (parse (file-read \"next/genesis/validators/envelope-shape.sx\")))) :name)")
+(epoch 62)
+(eval "(get (apply dict (rest (parse (file-read \"next/genesis/validators/signature.sx\")))) :name)")
+(epoch 63)
+(eval "(get (apply dict (rest (parse (file-read \"next/genesis/validators/type-schema.sx\")))) :name)")
+(epoch 64)
+(eval "(len (get (apply dict (rest (parse (file-read \"next/genesis/manifest.sx\")))) :validators))")
 EPOCHS
 
 OUTPUT=$(timeout 30 "$SX_SERVER" < "$TMPFILE" 2>/dev/null)
@@ -138,6 +148,11 @@ check 55 "actor-state.sx name"          "actor-state"
 check 56 "define-registry.sx name"      "define-registry"
 check 57 "audience-graph.sx name"       "audience-graph"
 check 58 "manifest has 7 projections"   "7"
+check 60 "envelope-shape.sx head form"  "DefineValidator"
+check 61 "envelope-shape.sx name"       "envelope-shape"
+check 62 "signature.sx name"            "signature"
+check 63 "type-schema.sx name"          "type-schema"
+check 64 "manifest has 3 validators"    "3"
 
 TOTAL=$((PASS+FAIL))
 if [ $FAIL -eq 0 ]; then