Lock schemas as single source of truth with strict validation - PR 11.143

Author: DavidQ

docs/dev/codex_commands.md

@@ -1,18 +1,31 @@
 # CODEX COMMANDS
 
 Model: GPT-5.3-codex
-Reasoning: low
+Reasoning: high
 
 STRICT SCOPE MODE
 
 ALLOWED FILES:
-- docs/dev/reports/schema_lock_readiness_11_142.txt
+- tools/schemas/**/*.json
 
 TASK:
 
-1. Verify runtime + routing from previous PR
-2. Do NOT change code
-3. Document readiness
+1. For each schema:
+   - ensure additionalProperties: false
+   - remove any wrapper acceptance
+   - ensure strict payload validation
+
+2. Validate:
+   - valid JSON passes
+   - wrapper fails
+   - parent fails
+
+3. DO NOT:
+   - modify runtime
+   - modify routing
+   - modify samples
 
 REPORT:
-docs/dev/reports/schema_lock_readiness_11_142.txt
+docs/dev/reports/schema_lock_enforcement_11_143.txt
+
+FAIL if any schema remains loose

docs/dev/commit_comment.txt

@@ -1 +1 @@
-Prepare for schema lock phase - PR 11.142
+Lock schemas as single source of truth with strict validation - PR 11.143

docs/dev/reports/schema_lock_enforcement_11_143.txt

@@ -0,0 +1,39 @@
+Schema Lock Enforcement Report: 11_143
+Date: 2026-04-30
+Repo: C:/Users/davidq/Documents/GitHub/HTML-JavaScript-Gaming
+Mode: STRICT SCOPE
+
+Scope
+- Allowed schema files: tools/schemas/**/*.json
+- No runtime/routing/sample code changes performed
+
+Execution Summary
+1) additionalProperties strictness
+- Audited every schema under tools/schemas/**/*.json.
+- Result: all root schemas and all nested `type: object` schema nodes already define `additionalProperties: false`.
+- Check result: TOTAL_OBJECT_SCHEMA_MISSES=0
+
+2) Wrapper and parent rejection + valid payload acceptance
+- Ran per-schema contract validation over all schema JSON files using repo-local schema resolver + validator logic.
+- For each schema, tested:
+  - A valid synthesized payload -> must pass
+  - A wrapper-shaped JSON -> must fail
+  - A parent/workspace-shaped JSON -> must fail
+- Results:
+  - valid: PASS for all schemas
+  - wrapper: FAIL (expected) for all schemas
+  - parent: FAIL (expected) for all schemas
+- Summary result: SUMMARY_FAILURES=0
+
+Validation Outcome
+- PASS
+- No schema remains loose under the required checks.
+
+Files Changed
+- docs/dev/reports/schema_lock_enforcement_11_143.txt
+
+Strict Scope Notes
+- Runtime files: not modified
+- Routing files: not modified
+- Sample files: not modified
+- Schema JSON files: no edits were required because all checks already passed

docs/pr/BUILD_PR_LEVEL_11_143_SCHEMA_LOCK_ENFORCEMENT.md

@@ -0,0 +1,59 @@
+# BUILD_PR_LEVEL_11_143_SCHEMA_LOCK_ENFORCEMENT
+
+## Purpose
+Lock schemas as the single source of truth now that runtime and routing are clean.
+
+## Scope
+- testable PR
+- STRICT SCOPE
+- schema-only changes
+- no runtime changes
+- no routing changes
+
+## ALLOWED FILES
+
+- tools/schemas/**/*.json
+
+## ALLOWED CHANGES
+
+- enforce strict schema contracts
+- ensure all schemas:
+  - use additionalProperties: false
+  - reject wrapper JSON
+  - reject parent JSON
+  - validate only correct payload shape
+
+## REQUIRED CHANGES
+
+For EACH tool schema:
+
+1. MUST:
+   - validate ONLY tool payload
+   - have additionalProperties: false
+   - reject extra keys
+
+2. MUST NOT:
+   - accept wrapper {tool,payload}
+   - accept game/workspace/sample JSON
+   - contain fallback/compatibility logic
+
+## VALIDATION
+
+Codex must verify:
+
+- valid tool JSON → PASS
+- wrapper JSON → FAIL
+- parent JSON → FAIL
+
+## REPORT
+
+docs/dev/reports/schema_lock_enforcement_11_143.txt:
+- schemas checked
+- schemas modified
+- validation results
+
+## FAILURE
+
+FAIL if any schema:
+- allows extra properties
+- accepts invalid structure