[Bug] Empty strings in policy_references and source_id collide with Trace padding #263

What is broken

An empty string is a legal value for policy_id, policy_version and rule_id in policy_references, and for source_id in provenance.json. The #228 PR pads the Trace arrays built from those fields with "" where a value is missing. A trace reader therefore can't tell an absent field from one the Guardian sent as empty.

Where

specification/v0.1.0/response-envelope.json (policy_references items); specification/v0.1.0/provenance.json (source_id)

What the specification says, and what happens instead

Each of those fields is { "type": "string" } with no minLength. The #228 PR adds a SHOULD NOT for Guardians, in Trace text only, because a wire-schema change doesn't belong in a v0.1.x patch. The SHOULD NOT can't be enforced by schema validation.

Impact on implementers

It's small today. Version-level replay ("which policy version fired") is ambiguous for any Guardian that sends empty strings.

Proposed direction for v0.2: add "minLength": 1 to those four fields, so "" in a padded Trace array always means "absent".

Related: #228.

Current Priority Scope

This is deferred or out of scope and I am filing it to be tracked