Add: dynamic schema RFC for user-defined keys (#39)

[0xLeif]

Summary

• Accepts the v1.0 dynamic-schema RFC in docs/design/dynamic-schema.md: <state-root>/schema.json as source of truth, aps key add/remove as sugar, demo keys as the default namespace, plus SpecSync strategy and phased go plan.
• Links the RFC from README and refreshes 0.x non-goals / next-goal text for the 1.0 train.
• SpecSync CHG-0026 (docs-only) plus a stale-evidence rebind sweep so fledge spec check stays green after the README edit (including definition-digest repair for CHG-0022..0025).

Closes #39

Test plan

• fledge lanes run verify
• fledge spec check
• specsync change check (no stale accepted evidence)
• CI Trust / CI / smoke on the PR

Made with Cursor

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[0xLeif]

Review from the Kimi Code agent (requested by 0xLeif). Docs-only PR: RFC + README + CHG-0026 record + a mechanical SpecSync evidence rebind. Verified the RFC's claims against the code and checked the ceremony artifacts. Overall: solid, one substantive fix requested before merge.

Verified

• RFC claims match the code: state-root precedence --state-dir > APS_HOME > ~/.aps, parseBool exists, Schema.schemaVersion is static, and the proposed codes (unknown_key / schema_conflict at 64, schema_invalid at 65) fit the #31 taxonomy (invalid_value = 64, corrupt_state = 65).
• README claims hold: docs/windows-readiness.md exists, linux/windows smoke CI run on hosted runners (linux-smoke green on this PR). Links resolve. No em/en dashes.
• CHG-0026 artifacts are valid JSON; sequence bump 25 to 26 is clean; the stale-evidence rebind matches the #50 precedent.
• All five RFC questions from #39 are answered, with a go/no-go and a phased plan.

1. Demo-key inventory mismatch (please fix before merge)
Issue #39 says "the five demo keys", but DemoKey has seven cases: counter, message, flag, note, profile, secret, profileName. The RFC's seed schema.json example lists only 5 entries, omitting message (State/String) and flag (StoredState/Bool), while locked decision #3 says "the current demo keys ship as the initial schema.json contents". As written, the example silently drops two keys, and this example is what implementers will copy. The omission also means the seed never exercises StoredState or Bool, both of which are in the closed 1.0 enums. Add the two entries (flag also nails down the aps.user.<name> prefix from open question 1), or state the exclusion deliberately.

2. Materialize-on-read (settle in the RFC)
Missing schema.json is materialized "on first mutating command or on aps key / aps schema that needs it". aps schema is the read-only, cacheable contract endpoint from #32; a read that writes a file will fail on read-only state roots and surprise CI sandboxes. Suggest: reads fall back to the built-in default in memory; only mutations persist the file.

3. Nits

• Declaration-UX table says invalid hand-edits fail with "invalid_value / dedicated schema_invalid if needed", while section 8 firmly defines schema_invalid / 65. For an accepted design, pick one.
• The RFC narrows parseBool to true/false/1/0; the real one also accepts yes/y/on/no/n/off. Implementation should reuse it as-is.
• CHG-0026 change.md "Intent" restates the title, and docs.md Added/Updated are empty. Cosmetic.

CI note: linux-smoke passed; build-test-smoke, trust, and windows-smoke were still pending at review time.

Verdict: approve-with-comments, but please address point 1 (and ideally settle point 2) before merge. This doc is the contract the 1.0 implementation changes will be written against.

[0xLeif]

Trust failed on a flaky Fledge download (curl exit 18), not SpecSync.

Pushed:

1. Preseed Fledge 1.7.0 into Trust's install root with curl retries
2. SpecSync rebind for CHG-0004 after trust.yml edit