fix: enforce the §2 unknown-property rule below the envelope (#10)

* fix(component): reject unknown properties below the envelope

spec.md §2 requires unknown properties to be rejected at every level, but
additionalProperties: false was present on only SeedComponentMetadata. The 21
Component*Request defs were open, so a misspelled optional key anywhere below
the envelope validated clean and fell back to its default.

The gap is an artifact of the bootstrap import (ADR 0001): platform Seed*
models set Pydantic extra="forbid"; reused *Request wire models inherit the
default extra="ignore".

Map-shaped schemas (contract inputs/outputs, workload endpoints/volumes, build
arguments) are untouched — their keys are chosen by the document author.

Refs #6

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Merrell <merrelljustin@gmail.com>

* fix(blueprint): reject unknown properties below the envelope

The six Blueprint*Request defs carried no additionalProperties, so a misspelled
optional key inside a parameter or a connection ref validated clean. The Seed*
defs were already closed, which is why the first level below the envelope
appeared strict while everything under it was not.

Refs #6

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Merrell <merrelljustin@gmail.com>

* test(conformance): pin nested unknown-field rejection

structural/003-unknown-field only injects a key at the root, which is why the
gap below the envelope survived the bootstrap import. structural-005 injects
the typo deeper: a probe field on component, a parameter's ui block on
blueprint, and an array element on listing.

Against the pre-change schemas the component case validated cleanly and the
blueprint case produced no ERR_UNKNOWN_FIELD. The listing case passes either
way — listing was already fully strict, so it is a regression pin rather than
proof of a fix.

Refs #6

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Merrell <merrelljustin@gmail.com>

* feat(tools): require object schemas to close additionalProperties

Nothing checked this before, which is how 27 open defs survived the import.
Any subschema declaring type: object and properties must now also declare
additionalProperties: false.

Map-shaped schemas declare no properties and are unaffected, so the rule needs
no exemption list. walkObjects now carries a JSON Pointer so the diagnostic can
name the offending subschema.

Refs #6

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Merrell <merrelljustin@gmail.com>

* docs(component): name ERR_UNKNOWN_FIELD in the envelope clause

All four unknown-field fixtures cite #envelope, but §2 never named the code
they assert — the binding came only from the §8 registry. State it inline, as
the specVersion sentence two lines down already does, and say explicitly that
the rule covers optional fields, where ignoring a typo substitutes the default.

Refs #6

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Justin Merrell <merrelljustin@gmail.com>

---------

Signed-off-by: Justin Merrell <merrelljustin@gmail.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: justinmerrell

conformance/blueprint/v1/cases.json

@@ -26,6 +26,11 @@
       "id": "structural-004-unsupported-spec-version",
       "phase": "structural",
       "path": "structural/004-unsupported-spec-version"
+    },
+    {
+      "id": "structural-005-nested-unknown-field",
+      "phase": "structural",
+      "path": "structural/005-nested-unknown-field"
     }
   ]
 }

conformance/blueprint/v1/structural/005-nested-unknown-field/case.yaml

@@ -0,0 +1,22 @@
+# A misspelled optional field below the envelope. `lable` is a typo for
+# `label`, three levels down inside a parameter's presentation block.
+# Rejection must not depend on how deeply the typo is nested.
+specVersion: v1
+kind: BLUEPRINT
+metadata:
+  slug: web-and-database
+  version: 1
+spec:
+  components:
+    db:
+      component: postgres
+      size: general.standard.small
+      connections: {}
+  parameters:
+    siteTitle:
+      schema:
+        type: STRING
+        default: My Application
+      isRequired: false
+      ui:
+        lable: Site title

conformance/blueprint/v1/structural/005-nested-unknown-field/diagnostics.json

@@ -0,0 +1,6 @@
+[
+  {
+    "code": "ERR_UNKNOWN_FIELD",
+    "path": "/spec/parameters/siteTitle/ui"
+  }
+]

conformance/blueprint/v1/structural/005-nested-unknown-field/metadata.json

@@ -0,0 +1,7 @@
+{
+  "id": "structural-005-nested-unknown-field",
+  "phase": "structural",
+  "expected": "fail",
+  "clause": "specifications/blueprint/v1/spec.md#envelope",
+  "summary": "An undefined property nested below the envelope is rejected, not silently dropped."
+}

conformance/component/v1/cases.json

@@ -26,6 +26,11 @@
       "id": "structural-004-unsupported-spec-version",
       "phase": "structural",
       "path": "structural/004-unsupported-spec-version"
+    },
+    {
+      "id": "structural-005-nested-unknown-field",
+      "phase": "structural",
+      "path": "structural/005-nested-unknown-field"
     }
   ]
 }

conformance/component/v1/structural/005-nested-unknown-field/case.yaml

@@ -0,0 +1,17 @@
+# A misspelled optional field below the envelope. `initialDelaySecond` is
+# singular; the defined property is `initialDelaySeconds`. Rejection must not
+# depend on how deeply the typo is nested.
+specVersion: v1
+kind: COMPONENT
+metadata:
+  version: 1
+spec:
+  workload:
+    kind: SERVICE
+    source:
+      type: IMAGE
+      ref: nginx:1.29.4-alpine
+    health:
+      readiness:
+        path: /healthz
+        initialDelaySecond: 30

conformance/component/v1/structural/005-nested-unknown-field/diagnostics.json

@@ -0,0 +1,6 @@
+[
+  {
+    "code": "ERR_UNKNOWN_FIELD",
+    "path": "/spec/workload/health/readiness"
+  }
+]

conformance/component/v1/structural/005-nested-unknown-field/metadata.json

@@ -0,0 +1,7 @@
+{
+  "id": "structural-005-nested-unknown-field",
+  "phase": "structural",
+  "expected": "fail",
+  "clause": "specifications/component/v1/spec.md#envelope",
+  "summary": "An undefined property nested below the envelope is rejected, not silently dropped."
+}

conformance/listing/v1/cases.json

@@ -26,6 +26,11 @@
       "id": "structural-004-unsupported-spec-version",
       "phase": "structural",
       "path": "structural/004-unsupported-spec-version"
+    },
+    {
+      "id": "structural-005-nested-unknown-field",
+      "phase": "structural",
+      "path": "structural/005-nested-unknown-field"
     }
   ]
 }

conformance/listing/v1/structural/005-nested-unknown-field/case.yaml

@@ -0,0 +1,17 @@
+# A misspelled optional field below the envelope. `captions` is a typo for
+# `caption`, inside an array element. Rejection must not depend on how deeply
+# the typo is nested, nor on whether it sits inside an array.
+specVersion: v1
+kind: LISTING
+metadata:
+  slug: postgres
+  version: 1
+spec:
+  listingKind: COMPONENT
+  displayName: PostgreSQL
+  summary: The open-source relational database
+  category: INFRASTRUCTURE
+  lifecycleStage: STABLE
+  screenshots:
+    - file: media/overview.png
+      captions: Connection details after deployment