Module validator 

Strict ingress validator for sealed .mem archives.

Single trust boundary: every byte that enters any cache passes through validate_and_normalize_archive. Parses the zip, validates each markdown file against its declared schema over the raw bytes (tolerant-parser fallbacks are the wrong default at ingress), builds a Store, runs community detection, and canonically re-packs. Fails hard on any violation.

Pure function: takes &[u8], returns Result<ValidatedMem, ValidationError>, performs no I/O.

Modules

archive

Archive-level checks over raw zip bytes.

canonical

Deterministic re-packing of a validated archive.

config

Strict config parsing for the archive’s .memstead/config.json.

graph

Graph construction + community detection for the validator.

ids

Entity-ID uniqueness across the archive after Unicode normalization.

strict

Per-entity strict checks over raw markdown bytes.

Structs

DanglingCrossMemEdge

One relationship whose target lives in a different mem than the one being validated/exported — i.e. an edge that cannot travel inside a single-mem archive. install refuses on these (ARCHIVE_VALIDATION_FAILED); export warns on them (DANGLING_CROSS_MEM_EDGE_IN_EXPORT) so the operator sees the install-time failure before sharing — one predicate, two postures.

MemStats

Aggregate statistics reported alongside a successful validation.

PublishedMemConfig

Strict-ingress shape of a mem config. This is the only metadata form that enters a .mem archive. MemConfig carries author-only fields (writeGuidance, rules, publish, readMems, language, community, defaultSchema, vcs, plus any key captured in extra) that never belong in a published archive; published_config_from projects MemConfig → PublishedMemConfig, dropping everything outside the whitelist.

ValidatedMem

The successful output of validation: strict-checked entities, a built graph, community assignments, and the canonical bytes that should replace the input in any cache.

ValidatorLimits

Numeric limits enforced by archive-level checks. Callers that need different caps (e.g. enterprise registry) construct a custom instance; the default matches the published registry limits.

Enums

SizeCapKind

Which size cap a given SizeCapExceeded refers to.

ValidationError

Every reason the validator can reject an archive. Each variant carries enough context (file path, reason string, size numbers) to give the caller an actionable error.

Functions

collect_dangling_cross_mem_edges_from_bytes

Cross-mem-only scan over an archive’s bytes: extract + tolerant parse + the shared cross-mem predicate (graph::dangling_cross_mem_edges_in), with no strict section/field validation and no store construction. Returns every edge whose target won’t travel inside this single-mem archive.

validate_and_normalize_archive

The single ingress entry point. Callers (registry publish, CLI install, MCP read-mem attach, macOS drop-to-install) hand in bytes and receive either a ValidatedMem with canonical bytes to install, or a typed ValidationError.

validate_and_normalize_archive_lenient

Export-side validation: identical strict checks, except a cross-mem edge whose target won’t travel inside this single-mem archive is collected onto ValidatedMem::dangling_cross_mem_edges instead of refused. Lets export warn (DANGLING_CROSS_MEM_EDGE_IN_EXPORT) and still produce the archive, while install keeps refusing the same edge — one predicate, two postures. Every other strict check (schema drift, malformed markdown, …) still refuses, so export never emits an otherwise-invalid archive.

validate_and_normalize_archive_with_limits