# project-conformance

The bytes of `wai.lock` ([`schema/README.md`](../schema/README.md)), and a second reader of them and
of a build record, so that the formats are not defined only by the Rust that writes them.

**Provenance.** Written here, from the schema's text. Each outcome in `vectors.json` is set from
those rules and never copied from a reader. Every digest in a case is an example: no case states a
toolchain, a template or a corpus that exists.

| File | What it is |
|---|---|
| `vectors.json` | The reader's cases. An accepted case's `bytes` are written back byte for byte and have the `sha256` stated. A refused case's are refused with the code stated: `lock-not-canonical` (the same values, in other bytes: a line ending added, indented, members out of order, an escape), `lock-repeated-member`, `lock-not-json`, `lock-version`, `lock-unknown-member` or `lock-member-invalid` |
| `fixture/plain/`, `fixture/plain.lock.expected` | A project, and the bytes `wai lock` writes for it. What moves with the toolchain is a placeholder (`@VERSION@`, `@CATALOGUE@`, `@REGISTRY@`), filled in from the committed files, so a change to the catalogue changes no line here |
| `fixture/full/`, `fixture/full.lock.expected` | A project that names everything a lock pins: a template, parameter sets, a packaging policy and a conformance suite (`@TEMPLATE@`, `@CLAIM@` as well) |
| `project_verify.py` | The second reader, standard library only, sharing no code with `wai-rs`. It takes the policy's digest from [`pack-conformance/pack_verify.py`](../pack-conformance/pack_verify.py), the packaging corpus's own second implementation |

```bash
python3 -I project_verify.py vectors vectors.json             # each case's bytes read
python3 -I project_verify.py selftest vectors.json            # each of its rules dropped in turn, and the corpus catches it
python3 -I project_verify.py project <dir> --wai <wai-dir>    # every digest <dir>/wai.lock pins recomputed, and dist/wai-build.json held to the tree
```

`wai-rs/tests/cli_project.rs` runs it on what the binary wrote, and on each change the binary
refuses. The directory is `* -text`: its bytes are what it pins.