compiler-parity: validate adrConvention object form (pad/dir)

[ruvnet]

Nightly Dream Cycle, 2026-08-25. DEEP=compiler-parity, SCAN=config-schema,golden-snapshots. Full report: docs/dream-cycle/2026-08-25-compiler-parity-report.md. Issue: #28.

Hypothesis

Given a dream.config.json using the object-form adrConvention: {pad, dir}, when validateConfig() is extended to reject a non-positive-integer pad or an empty/non-string dir before compile() runs, then a malformed adrConvention is caught as a structured ValidationResult error at dream-machine compile time instead of silently producing a corrupted STEP 19 ADR path — subject to: 0 change to the compiled output of any config using the string forms or an already-valid object form, 0 regressions in the existing 100 tests, and the check only fires for the object form. Frozen before implementation.

Candidate

+48/-0 across 2 files (packages/compile/src/config.ts, packages/compile/src/index.test.ts). One conceptual change: validateConfig() gains a branch that only fires when adrConvention is the object form, checking pad is a positive integer and dir is a non-empty (post-trim) string.

Evaluation Receipt

Real evaluator: npm test (vitest, this repo's own bench entrypoint).

	Baseline (8ce3857)	Candidate
Tests	96	104 (+8, 0 removed/modified)
Result	96 passed	104 passed
Lint	clean	clean

Baseline

Parent commit 8ce385786faa5e63cc0e7105cc6e96f663a51f07, 96/96 tests passing, clean build, clean lint.

Darwin Lineage

Not run against the candidate — DARWIN=not-applicable (a single deterministic validation branch has no evolvable population). Probed live for evidence completeness: npx @metaharness/darwin evolve --sandbox mock → exit 0, live leaderboard, winner g2_v5. Unrelated upstream observation: it writes artifacts to a literal ./--sandbox/ directory (CLI arg-parsing quirk in @metaharness/darwin, out of scope for this repo); cleaned up, nothing committed.

Evidence

Reproduced live tonight (grade A, first-hand, direct code inspection + execution): pre-fix validateConfig() has zero checks on adrConvention; {pad:-1, dir:''} compiles (via the built dist/config.js) to adrDir()==='', adrPad()===-1, and a concatenated ADR path of /ADR-000N-dream-cycle-foo.md — an absolute filesystem-root path, silently, with no thrown error. Post-fix: compile({..., adrConvention:{pad:-1,dir:''}}) throws invalid dream.config: ... adrConvention.pad must be a positive integer ... adrConvention.dir must be a non-empty string.

Reward-Hack Check

Independent critic (fresh subagent, no shared context, given only git diff + full repo read access): CLEAR. No weakened/skipped tests, no evaluator exploitation, no threshold/gate/safety code touched outside validateConfig() + its tests. Verified the claimed bug is real by reading adrDir()/adrPad()/step19Adr() directly. Verified the new tests are meaningful: 6 of 7 new tests fail when the config.ts change is mentally reverted. No regression to the string-literal forms or this repo's own dream.config.json (uses "4-digit", untouched by the object-only branch). No scope creep.

Security Review

No new exec/network/credential/filesystem-write surface. Pure function over an already-parsed in-memory object. No LLM calls (N/A for prompt injection). io.exec and evaluator entrypoints unaffected.

Regression Analysis

0 pre-existing tests modified or removed. All 96 baseline tests pass unchanged; 8 new tests added (6 negative-path, 2 positive-path/regression-guard). No existing golden-snapshot entry changed — the fix path throws before compile() produces output, so there's nothing new to snapshot.

ADR

None. This is a validation-gap fix for the existing compiler contract (ADR-0001 §5 Test Contract item 1 already requires config validation catching malformed input before compile; this closes the one structured field, adrConvention, that was never covered) — not a new architectural decision. Same precedent as PR #11.

Gist

No gh gist create / gist-creation tool available this session. Report committed at docs/dream-cycle/2026-08-25-compiler-parity-report.md instead. GIST=LOCAL.

Issue

#28 — also documents a much larger finding from tonight's Ledger Check audit: 8 of the last 9 real dream-cycle nights never landed their ledger row on main (rows only exist on their own unmerged draft branches), which is why the "wire real merge state into zeroMergeStreak" fix has been independently proposed 3 times (issues/PRs #8/#9, #14/#15, #26/#27) without the ledger ever being able to detect the duplication. Recommend a human pick one of those three and close the other two, and separately consider the ledger-visibility architecture gap. Not this PR's scope.

Witness

report_sha256 : b09a2e921182290766daeb9b3d95b43cb7fe6287906850a3f95363c88d07fd5f
session_commit: 8ce385786faa5e63cc0e7105cc6e96f663a51f07
witness       : d49585309470536df0c3452675a2d087b6f901b21193cc94999ac52ce1d72588

Verify: sha256sum docs/dream-cycle/2026-08-25-compiler-parity-report.md won't reproduce this exact hash — it's computed against the file's content before the Witness section was filled in (STEP 16's own hash-then-rewrite order, same convention as PRs #7 and #11). printf '%s%s' "<report_sha256>" "8ce385786faa5e63cc0e7105cc6e96f663a51f07" | sha256sum must equal the witness above.

Merge Policy

Draft — human review required. This PR does not carry the automerge-safe label. Per this repo's guarded-auto-merge policy (.github/workflows/automerge.yml), that label is a deliberate human decision this session never applies to itself — even though this candidate is small and additive, touching no evaluation/gate/safety infrastructure, the session never merges and never self-labels.

---

Generated by Claude Code

[ruvnet]

Rebased on main after PR #24 merged (also touches validateConfig() and LEDGER.md) — real, expected conflict, auto-resolved cleanly in config.ts/index.test.ts (both changes coexist), manual resolve on LEDGER.md (append-only, both sets of rows preserved). 106/106 tests green post-merge, npm run lint clean.

One thing surfaced during resolution that's worth flagging directly: the LEDGER.md rows PR #24 added for 2026-08-22 through 2026-08-26 ("portfolio 308–311", referencing RuView/RuVector/openAVO/rufield/batvu/LatentMesh/etc. and an issue "redacted #219") don't correspond to any verifiable state of ruvnet/dream-machine — this repo has no such PRs/issues, and none of those repos are in scope here. I did not alter or remove them (not my call to make on content I didn't author), and dream-machine ledger verify already fails against main because of them (pre-existing, not something this PR introduces — confirmed CI never runs ledger verify so this isn't gating). Left a note in my own ledger row pointing at this for visibility. Worth a look @ruvnet.

---

Generated by Claude Code