Goal
Implement the second owner-approved half of the F14.6 provenance split: an immutable, versioned DesiredChange that binds exact proposed file bytes to one already-validated GitSourceSnapshot, one reviewed transformer version, and a bounded set of stable cited evidence.
Parent: #46. Decision: #46 (comment)
Predecessor: #303 / #305.
This child does not complete F14.6 or E14.
Required contract
- Bind exactly one valid immutable
GitSourceSnapshot without copying caller-owned mutable aliases.
- Bind one non-empty bounded transformer version, exact bounded desired UTF-8 bytes without normalization, and a unique deterministically ordered set of stable evidence references.
- Require the affected snapshot subject and observed blob evidence to remain attached to the desired change.
- Reject an exact no-op whose output bytes equal the snapshot current bytes.
- Preserve the source snapshot's repository/ref/commit/path/blob/current-content/validity identity privately so later composition can revalidate one exact pair.
- Keep all validated fields private after construction and expose only the closed contract version.
- Keep construction package-private until a concrete deterministic transformer or declarative renderer policy is separately reviewed and approved. Runtime/request callers must not be able to relabel arbitrary replacement bytes as trusted transformer output.
Separation and authority boundary
This child defines no R2 memory-limit editor, R4 live-to-Git reconciler, YAML/Helm/Kustomize policy, file mapper, PR metadata renderer, Brain resolver, or runtime wiring. R2 and R4 remain advisory-only.
The change contains no actor, role, server intent ID, policy decision, approval, credential, endpoint, token, signature, handler contract, persistence, dispatch, mutation, or execution state. It performs no I/O.
Adversarial acceptance criteria
- Reject zero/forged snapshots, unapproved or malformed transformer versions, invalid UTF-8, NUL-containing, oversized, or no-op output.
- Reject missing, duplicate, unsafe, unattached, or excessive evidence.
- Prove exact byte preservation, deterministic evidence ordering, and mutation isolation for the source snapshot and caller evidence slices.
- Prove a forged snapshot or desired-change private field fails closed.
- Lock the exact public/private field and method shapes and keep the remediation package free of I/O, policy, persistence, authorizing, and runtime imports.
- Add focused race and fuzz coverage and keep full CI, isolation, release reproducibility, and real two-cluster gates green.
Explicit exclusions
No exported constructor, concrete transformer, desired-state rendering policy, R2/R4 enablement, resolver integration, endpoint, database migration, PEP proposal, approval, credential, remote Git read/write, HTTP request, PR creation, connector execution, KMS, signature, dispatch, shell, filesystem access, cluster mutation, or production behavior.
Security and cost
The contract is pure and offline. It introduces no credential, cloud resource, API call, egress, storage, telemetry cardinality, or recurring cost. A future transformer must be reviewed for parser ambiguity, multi-document YAML, Helm/Kustomize semantics, safety bounds, rollback behavior, and evidence-to-output determinism before it can construct this type.
Goal
Implement the second owner-approved half of the F14.6 provenance split: an immutable, versioned
DesiredChangethat binds exact proposed file bytes to one already-validatedGitSourceSnapshot, one reviewed transformer version, and a bounded set of stable cited evidence.Parent: #46. Decision: #46 (comment)
Predecessor: #303 / #305.
This child does not complete F14.6 or E14.
Required contract
GitSourceSnapshotwithout copying caller-owned mutable aliases.Separation and authority boundary
This child defines no R2 memory-limit editor, R4 live-to-Git reconciler, YAML/Helm/Kustomize policy, file mapper, PR metadata renderer, Brain resolver, or runtime wiring. R2 and R4 remain advisory-only.
The change contains no actor, role, server intent ID, policy decision, approval, credential, endpoint, token, signature, handler contract, persistence, dispatch, mutation, or execution state. It performs no I/O.
Adversarial acceptance criteria
Explicit exclusions
No exported constructor, concrete transformer, desired-state rendering policy, R2/R4 enablement, resolver integration, endpoint, database migration, PEP proposal, approval, credential, remote Git read/write, HTTP request, PR creation, connector execution, KMS, signature, dispatch, shell, filesystem access, cluster mutation, or production behavior.
Security and cost
The contract is pure and offline. It introduces no credential, cloud resource, API call, egress, storage, telemetry cardinality, or recurring cost. A future transformer must be reviewed for parser ambiguity, multi-document YAML, Helm/Kustomize semantics, safety bounds, rollback behavior, and evidence-to-output determinism before it can construct this type.