canonical Use Case C — the split-planes API squeeze loop
Use Case C is a base squeeze loop (instance-c, terrain C): an API whose
document plane (the published OpenAPI schema) and runtime plane (the live HTTP
server) are forced into exact lockstep so neither can mask the other. Its SL-1.0
self-description is src/C/instance-c.sl.json; the companion
write-up is src/C/docs/use-case-c.md.
The dominant failure it guards
Coherent-and-wrong here = blending — one plane's weak check standing in for the other's strong claim: a clean schema masking broken runtime behaviour (id leaks, tracebacks, missing auth on an untested route), or a clean runtime escaping stale documentation.
Terrain C — split planes
Correctness divides across two planes, each with its own authority:
- Runtime plane — the API governance policy
API_POLICY_081(CLAUSE_1auth,CLAUSE_2uuid-only ids,CLAUSE_3clean errors). - Document plane — the canonical OpenAPI contract
base_schema.json(0444), read independently by both bands.
The soundness load rests on a no-blend cross-check: each plane is verified separately and the planes must agree.
The bounds
- Upper bound
U— both plane authorities (governance policy + canonical contract), which the sentinel refuses to let blend. - Lower bound
L— the schema linter (document plane), the frozen app-state DB, the legacy route-signature regression oracle (ty0_baseline), and — for the exerciser — the live server observed over HTTP.
The cast (three actors) and the run-vs-read channel
| Actor | Builds | U |
L |
Must not see |
|---|---|---|---|---|
| Gate sentinel / no-blend referee (coordinator) | the gate sequence + the .sl.json |
both plane authorities | linter + runtime HTTP + frozen DB + legacy-signature regression + both bands | — |
| API implementer | the HTTP server + its published OpenAPI schema | policy + canonical contract | the frozen DB it serves; the linter its schema must pass | the conformance matrix |
| Conformance exerciser | the conformance test matrix | policy + canonical contract, read independently | what the live server returns when RUN over HTTP | the server source + the implementer's openapi.json |
The load-bearing subtlety: the implementer produces the running server
(runtime_oracle), but the exerciser runs it over HTTP as its lower bound — it never
reads the source. A judge may run an oracle over an artifact it is barriered from; it
may never read that artifact. That run-vs-read distinction is what keeps the barrier
physical rather than honorary.
The gates
- Gate A / isolation. The exerciser has zero import/path linkage to the server source.
- Gate B (runtime). Status codes, exact response keys, no forbidden patterns (no id leaks, no tracebacks) on every tested route; plus the document-plane route cross-check.
- Gate C (coverage / no-blend). Every clause maps to a passing check on its plane,
seeded coherent-and-wrong negatives fire, and a clean check on one plane never stands in
for the other; the legacy
ty0signature hash re-verifies (no regression).
Disjointness
The implementer is bound by both plane authorities but reads only the frozen DB and the linter below; the exerciser is bound by the same authorities but its lower bound is the running server observed over HTTP — it runs the implementation without ever reading its source. The sentinel certifies only when both planes pass separately and agree, so neither plane's check can mask the other. Catchability: an implementer blend (clean schema/happy path hiding an id leak or missing auth) is caught by the exerciser's runtime assertions + route cross-check; a weak happy-path matrix is caught by the sentinel (Gate C coverage + seeded negatives).
python config/skills/sl-internal/scripts/sl_disjointness_check.py src/C/instance-c.sl.json
(0 FAIL / 8 checks.)