[harshach]

The stack targets release 2.1.0.

main → PR1 #35990 → PR2 #35994 → PR3 #35997 → PR4 #35995. Two chains start at PR4:

• PR4 #35995 → PR5 #36183 → PR6 #36187 → PR7 #36188 → PR8 #36190, open as drafts.
• PR4 #35995 → PR10 #35991 → PR12 #35996 → PR15 #35989.

This PR targets PR4 #35995. Its child is PR6 #36187. PR9, PR11, PR13, PR14 and PR16 are not published yet.

Current assessment for acd9930a2d7, recorded 2026-10-29.

Verdict. PASS. Independent source and comment review passed at ced0a567af9, as the checklist below records. The plan audit at that head closed with no change. This head comes from two clean merges of PR4, first 4868c52ace0 with main ca9b8c04a93, then the formatting fix cf429f94388. Neither merge touches a file that PR5 changes. PR5's patch-id stays 9fe014fe8ce over 17 files, so the verdict carries to this head. No minor issue is declared.

Test evidence at this head. The first merge's gates ran on the staged tree, which is the commit 073399e00ab's tree 7fa37383354. Package and spotless passed, and 506 unit tests in 33 classes passed. The 9 database classes ran on local MySQL 9.3 and PostgreSQL 14, one new database per run. All passed apart from two invocations of OntologyEntityDAOTest.reviewLocksSeeEditsAndArchivalCommittedWhileWaiting, whose rows share one database on the local engines. TypeScript reports 0 errors, and the 5 PR4 Jest suites the merge carries pass 75 of 75. The second merge's staged tree is the commit's tree c33d98abb3d. It changes only PR4's two graph-view files, where Jest passes 30 of 30 and ESLint reports 0 errors.

CI. This PR is a draft, so CI skips the build, test and Collate jobs, maven-collate-ci among them. Every check that ran at this head passes.

Still owed. Docker is down on the build machine, so none of these has run. Run each IT on -Pmysql-elasticsearch and then -Ppostgres-opensearch, and confirm a Tests run: line.

• IndependentOntologyReleaseValidationIT, this PR's own IT.
• PR4's IndependentOntologyInverseIT and IndependentOntologyAxiomIT.
• The task and review-list ITs listed on PR1, and every merge-queue IT that main's changes select.
• The two invocations of OntologyEntityDAOTest.reviewLocksSeeEditsAndArchivalCommittedWhileWaiting, and the container-backed classes once under Testcontainers on mysql:8.0 and postgres:15: OntologyConceptStatusStorageTest, OntologyDerivedStatusStorageTest, OntologyEntityDAOTest, OntologyReleaseComparisonStorageTest, OntologyReleaseDAOTest, OntologyReleaseReviewListTest, OntologyWorkingStateTest, OntologyHierarchyStorageTest and OntologyPropertyInverseStorageTest.
• OntologyEntityDAOTest.existingWorkflowEngineCountsDistinctVotesAndFailsClosed on MySQL. It passed locally only with nullDatabaseMeansCurrent=true, because the shared local server held another run's Flowable tables.
• Changed-class coverage, which needs the ITs above.
• The plan's live and performance lanes for this PR.

AI mode. main's Ontology Studio AI-mode restyle #36433 now gates new screens on AI mode. PR5 adds no UI control. Its only UI file is the generated type generated/api/data/ontologyReleaseValidation.ts, so AI mode lacks none of its controls.

Not verified yet. This PR is verified only when its unit, live and performance boxes in the plan are all checked. The operator lands the stack.

Describe your changes

Fixes #36182

Add a read-only validation report for a captured native ontology release. It combines structural checks and native SHACL findings with current authorized asset bindings and captured dependents of newly deprecated definitions.

This is PR5 of the sixteen-part Ontology Studio program for release 2.1.0. It targets PR4, #35995. PR6 will build on this branch. This draft has passed source review and focused unit checks; current database, live and performance verification remains open.

Type of change

• New feature

High-level design

GET /api/v1/ontologyReleases/{id}/validation validates sealed members and the literal captured base. A bounded cache stores detached immutable findings, with authorization repeated on every request. Current bindings are resolved after the cache lookup. Warnings remain distinct from violations, details cap at 1,000, and logicalCheck remains NOT_RUN.

The existing catalog SHACL and signed glossary-impact contracts remain unchanged. See the captured-target and cache decision. When the later PR12 is integrated, the validation caller must drain its paged binding resolver.

Tests

Use cases covered

Captured targets, foreign references, enum findings, warning severity, exact counts and truncation, detached cache responses, literal-base comparison, cache admission and eviction. HTTP tests also cover authorization, missing current definitions, fresh bindings and deprecation impacts.

Unit tests

At 7a8ba8450c8, the merge gate ran 438 tests in 30 unit classes with no failures. Five container-backed classes stop on the missing Docker socket and are owed. An earlier focused run passed 131 tests across these nine suites:

OntologyReleaseValidationTest, NativeOntologyShapesTest, OntologyReleaseProjectionTest, RdfShaclReportMapperTest, RdfShaclValidatorTest, OntologyReleaseComparisonTest, Rdf12CompatibilityTest, RdfClasspathResourceTest, and RdfRuleInputProjectionTest.

Java, TypeScript, Python and ANTLR generation completed. All 1,101 schemas parse; 1,082 licensed TypeScript outputs are present, and 19 schemas independently produce empty output successfully. The Python validation model passes round-trip and four invalid-input checks. Spotless, normal commit hooks and impact-map ownership checks pass. Current whole-class coverage remains pending.

Backend integration tests

IndependentOntologyReleaseValidationIT is added. No integration test has run at 7a8ba8450c8, because Docker is down on the build machine. The stack block above lists what is owed. This draft does not treat historical integration results as proof for the current composition.

Ingestion integration tests

Not applicable. There is no ingestion implementation change.

Playwright and UI recording

Not applicable to this backend-only PR. The frontend change is the generated response contract; the user interface is PR6.

Manual verification

Current live checks remain pending. The required checks capture and validate a clean release, inspect a deprecated class with visible bindings, and verify denial after release, member or asset access changes. The original cold/warm validation and structure-regression performance checks also remain open.

Checklist

• Schema-first models regenerated.
• Behavioral unit and HTTP tests included.
• Independent source and comment review passed at ced0a567af91f20646b85d88fda2088af51aafad, against the current PR4 parent.
• Durable contract recorded in the decision document.
• Current database, coverage, live and performance gates complete.

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Adding captured-release SHACL validation and deprecation-impact reporting could misstate ontology constraints or affected assets if evaluation is incorrect.

Adds a read-only validation endpoint for captured native ontology releases, combining structural checks, native SHACL findings, current asset bindings, and captured dependents of newly deprecated definitions. No issues found during review.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}