[abrichr]

Item 3 of #1677. A task whose field set had no listed contract was stopped at begin. On one held-out app that blocked 22 correct writes. The generator wrote at most 64 field sets per kind, and for a create only the demonstrated sets, their subsets and sets with one optional field added.

What changed

• Each kind in manifest.yaml lists the fields a set may hold (fields): an update's identity fields and the fields it may change, or a create's required and optional fields.
• choose, for a set of those fields that the manifest doesn't list, calls propose(only=(kind, fields, lists)). That builds the set's create/update and found contracts the way the listed ones are built, from the same demonstrations, answers and schema, checks them with the SQL guard and a dry read, and writes them under field_sets/. So a task's field set doesn't need its own demonstration.
• A field the set leaves out must stay as it was (update) or be empty (create), as in every contract.
• Fail closed. The manifest pins the inputs (field_sets: the demonstrations' digest, the schema's digest, the answers, the kinds, the read connection without secrets). choose refuses, and the write stops, when:
  • the demonstrations or the schema changed;
  • a question is open;
  • the set has a field no demonstration placed, or lacks an update's identity;
  • a kind's value names the field to change (dispatch);
  • a column of the new row would be left unchecked without the person's answer (Unpinned, the same guard as Generator refuses joins and pins the demonstrations can't tell apart #1682).
• QUESTIONS.md lists, per kind, the parameters no demonstration gave and no column is named like (not_placed in report.json). A person can then record those demonstrations up front instead of finding out at a blocked task.

Docs: GENERATE_CONTRACTS.md (Field sets), CAPABILITIES.md.

Tests

tests/test_generate_verify_contract.py, real PostgreSQL:

• With one update set dropped from the manifest (as the cap drops them), choose builds it. The built contract equals the listed one document for document. A correct write under it is CONFIRMED, and a wrong done ratio is stopped.
• Changed demonstrations (digest) refuse the unlisted set.
• A set without the update's identity, and a create set with a field no demonstration placed, still have no contract.
• Generator, attack and ensure-contract suites pass locally.

Real-app evidence

Running on a held-out app (instance 1) once the shared VM has room; this section will hold the commands and outputs.