tegwick 21acb5cdd6 Make snapshot attribute validation enforce a real rule ... Closes gap G06. checkNoUnknownAttributes was named for a rule it did not implement: it rejected blank keys, which is not an allow-list, so a snapshot carrying malformed or shadowing attribute names passed a check whose name said otherwise. A rule that passes for the wrong reason is worse than an absent one, because the report is read as evidence. raw_attributes_well_formed requires each key to be a valid LDAP attribute descriptor, forbids shadowing an attribute the canonical model owns (uid, cn, mail) in any casing, and rejects keys differing only by case, which LDAP treats as one attribute. spec/ldap-schema.yaml carries the same wording. Two corrections to the gap's description rather than implementations of it. An allow-list is not derivable: ldapAttributes is defined as what the canonical model does not cover, so the schema cannot enumerate what may appear there. And the reference constraint already existed -- checkValidGroupMemberships only checks emptiness, but the semantic rule checkReferencedUsersExist resolves every member against the user set. Neutering the rule fails four of the five new tests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NV9oijZukGyGbRQGGKnK4P Assistant: claude-code Assistant-Model: opus Assistant-Process: 713576@bnt-lap001 Assistant-Session: 384c511d-9bce-4cb8-a676-2aef6c0c8df6		2026-09-07 23:22:55 +02:00
..
canonical-model.yaml	Reconcile the canonical model and discovery with the runtime	2026-09-07 00:22:49 +02:00
ldap-schema.yaml	Make snapshot attribute validation enforce a real rule	2026-09-07 23:22:55 +02:00