feat(stdlib): aLib aggregate.json schema loader (alib-roadmap #11)

[hyperpolymath]

Summary

Closes alib-roadmap.adoc item #11 (○ → ●). Unblocks #12 (test-vector executor).

Adds stdlib/AlibSchema.affine — Approach A (AffineScript-side parser, no new build tool needed) layered on the existing hpm_json_* lazy-handle FFI from stdlib/json.affine.

Public surface

pub type TestCase   = { description: String, input_count: Int }
pub type AlibOp     = { name, category, signature_string, purpose: String, test_cases: [TestCase] }
pub type AlibSchema = { schema_version: String, total_operations: Int, operations: [AlibOp] }

pub fn parse_schema(src: String)  -> Result<AlibSchema, String>
pub fn load_schema(path: String)  -> Result<AlibSchema, String>
pub fn load_estate_schema()       -> Result<AlibSchema, String>
pub fn estate_path()              -> String

test_cases[].input / output are intentionally NOT decoded to a sum type here — aggregate.json mixes Int / Float / String / Bool / arrays and per-op-named-fields objects (conditional has {condition, then_value, else_value}). The #12 executor will re-descend per-op with a known shape.

Verification

• affinescript check stdlib/AlibSchema.affine → Type checking passed
• Full stdlib re-check → all .affine files still pass
• No regressions to stdlib/alib.affine or stdlib/json.affine

Ownership / safety

Every Some(h) from hpm_json_parse / hpm_json_object_get / hpm_json_array_get is paired with a matching hpm_json_free. The root handle is freed inside parse_schema.

Notes

• GH Actions budget: estate is over the monthly cap; admin-merging on clean local verify per estate-wide standing directive. Type-check is the only gate that matters at this scope.
• AffineScript syntax gotchas honoured (record literal #{...}, generics not relevant here, no label/total collisions, no for-over-while inside the tree-walk).
• Lazy-handle pattern was preferred over to_json because to_json returns None for object roots (object-key enumeration is not yet a Zig export on hpm-json-rsr).

Test plan

• affinescript check stdlib/AlibSchema.affine
• Full stdlib/*.affine re-check (no regressions)
• (Follow-up ci: Bump webfactory/ssh-agent from 0.9.1 to 0.10.0 #12) feed load_estate_schema() into the dispatch loop and confirm 20 ops × N test-cases iterate

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 81 issues detected

Severity	Count
🔴 Critical	4
🟠 High	10
🟡 Medium	67

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v6 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affine-vscode-publish.yml",
    "type": "unknown",
    "file": "affine-vscode-publish.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence