# Use Case C

> Use Case C — the split-planes API squeeze loop

- Skill: `canonical/use-case-c` (Agent Skill)
- Install (CLI): `npx skillmds@latest add canonical/use-case-c`
- Raw SKILL.md: https://api.skillmd.com/api/skills/canonical/use-case-c/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: canonical (https://skillmd.com/u/canonical)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/canonical/use-case-c

---


# Use Case C — the split-planes API squeeze loop

Use Case C is a **base** squeeze loop (`instance-c`, terrain **C**): an API whose
**document plane** (the published OpenAPI schema) and **runtime plane** (the live HTTP
server) are forced into exact lockstep so neither can mask the other. Its SL-1.0
self-description is [`src/C/instance-c.sl.json`](../../../instance-c.sl.json); the companion
write-up is [`src/C/docs/use-case-c.md`](../../../docs/use-case-c.md).

## The dominant failure it guards

**Coherent-and-wrong here = blending** — one plane's weak check standing in for the other's
strong claim: a clean schema masking broken runtime behaviour (id leaks, tracebacks,
missing auth on an untested route), or a clean runtime escaping stale documentation.

## Terrain C — split planes

Correctness divides across **two planes, each with its own authority**:

- **Runtime plane** — the API governance policy `API_POLICY_081` (`CLAUSE_1` auth,
  `CLAUSE_2` uuid-only ids, `CLAUSE_3` clean errors).
- **Document plane** — the canonical OpenAPI contract `base_schema.json` (`0444`), read
  independently by both bands.

The soundness load rests on a **no-blend cross-check**: each plane is verified *separately*
and the planes must *agree*.

## The bounds

- **Upper bound `U`** — *both* plane authorities (governance policy + canonical contract),
  which the sentinel refuses to let blend.
- **Lower bound `L`** — the schema linter (document plane), the frozen app-state DB, the
  legacy route-signature regression oracle (`ty0_baseline`), and — for the exerciser — the
  **live server observed over HTTP**.

## The cast (three actors) and the run-vs-read channel

| Actor | Builds | `U` | `L` | Must not see |
|---|---|---|---|---|
| **Gate sentinel / no-blend referee** (coordinator) | the gate sequence + the `.sl.json` | both plane authorities | linter + runtime HTTP + frozen DB + legacy-signature regression + both bands | — |
| **API implementer** | the HTTP server + its published OpenAPI schema | policy + canonical contract | the frozen DB it serves; the linter its schema must pass | the conformance matrix |
| **Conformance exerciser** | the conformance test matrix | policy + canonical contract, read independently | **what the live server returns when RUN over HTTP** | the server source + the implementer's `openapi.json` |

The load-bearing subtlety: the implementer *produces* the running server
(`runtime_oracle`), but the exerciser **runs** it over HTTP as its lower bound — it never
**reads** the source. A judge may *run* an oracle over an artifact it is barriered from; it
may never *read* that artifact. That run-vs-read distinction is what keeps the barrier
physical rather than honorary.

## The gates

- **Gate A / isolation.** The exerciser has zero import/path linkage to the server source.
- **Gate B (runtime).** Status codes, exact response keys, no forbidden patterns (no id
  leaks, no tracebacks) on every tested route; plus the document-plane route cross-check.
- **Gate C (coverage / no-blend).** Every clause maps to a passing check on *its* plane,
  seeded coherent-and-wrong negatives fire, and a clean check on one plane never stands in
  for the other; the legacy `ty0` signature hash re-verifies (no regression).

## Disjointness

The implementer is bound by both plane authorities but reads only the frozen DB and the
linter below; the exerciser is bound by the same authorities but its lower bound is the
**running server observed over HTTP** — it runs the implementation without ever reading its
source. The sentinel certifies only when both planes pass separately and agree, so neither
plane's check can mask the other. Catchability: an implementer blend (clean schema/happy
path hiding an id leak or missing auth) is caught by the exerciser's runtime assertions +
route cross-check; a weak happy-path matrix is caught by the sentinel (Gate C coverage +
seeded negatives).

```sh
python config/skills/sl-internal/scripts/sl_disjointness_check.py src/C/instance-c.sl.json
```

(0 FAIL / 8 checks.)