feat(metadata): ADR-0036 Wave 1 — closed-value-set gate + finish @dbColumnType slim (Python port)

Mirrors the TS reference (d841552) for the Python port.

Decision #5 (closed-value-set conformance gate): emit allowedValues into the
Python registry manifest so closed enums are byte-gated cross-port. Rule:
allowedValues is emitted ONLY when the attr declares a non-empty closed set;
the key is OMITTED for open / format-validated attrs (@Currency, @Locale,
@Cardinality). Key order per attr: name, valueType, isArray, required,
allowedValues?, description, rules?/example?/whenToUse?. registry_manifest's
_to_manifest_attr now reads AttrSchema.allowed_values (already carried on the
schema for every closed enum) and inserts it before description.

@dbColumnType previously registered with NO allowed_values; it now carries the
closed set (uuid | jsonb | timestamp_with_tz) on _DB_COLUMN_TYPE_SCHEMA PURELY so
it surfaces in the manifest. Its real constraint is the (subtype × value) pairing
in _validate_db_column_type, so it is EXEMPT from the generic flat allowed_values
membership Check 3 in validation_passes — avoiding the double ERR_BAD_ATTR_VALUE
that would break the single-error tests (matches the TS reference exactly).

Decision #4 (finish the @dbColumnType slim): the dead uuid_array/text_array
constants + value-set + pairing-map entries were already removed in the Phase 1
commit (0a70d32); this finishes it by updating the embedded spec_metamodel/db.json
dbColumnType description prose to list only uuid | jsonb | timestamp_with_tz and
their pairings + add the allowedValues array (byte-identical to the repo-root
spec/metamodel/db.json, satisfying the FR-033 embed gate).

Python registry-conformance byte-matches the canonical
fixtures/registry-conformance/expected-registry.json. All value-sets verified
against the canonical target list (no mismatches).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GF9xLEQZaPus5Y6opk398n

Author: dmealing

server/python/src/metaobjects/loader/validation_passes.py

@@ -439,8 +439,20 @@ def _validate_attr_schema(
                     )
                     continue  # type wrong — skip allowed_values check
 
-            # Check 3: allowed_values membership
-            if schema.allowed_values is not None and len(schema.allowed_values) > 0:
+            # Check 3: allowed_values membership.
+            #
+            # @dbColumnType is EXEMPT: it carries allowed_values ONLY so the
+            # value-set surfaces in the registry manifest (ADR-0036 Wave 1,
+            # decision 5), but its real constraint is the (subtype × value)
+            # pairing enforced by _validate_db_column_type — which emits the single
+            # ERR_BAD_ATTR_VALUE for both an unrecognized value and an illegal
+            # pairing. Running the flat membership check too would double-report
+            # (tests assert exactly one error). Mirrors the TS reference.
+            if (
+                attr_node.name != FIELD_ATTR_DB_COLUMN_TYPE
+                and schema.allowed_values is not None
+                and len(schema.allowed_values) > 0
+            ):
                 if raw_value not in schema.allowed_values:
                     allowed_str = ", ".join(str(v) for v in schema.allowed_values)
                     errors.append(

server/python/src/metaobjects/meta/persistence/db/db_provider.py

@@ -32,6 +32,7 @@
     IDENTITY_SECONDARY_ATTR_WHERE,
     IDENTITY_SECONDARY_ATTR_EXPR,
     IDENTITY_SECONDARY_ATTR_USING,
+    VALID_DB_COLUMN_TYPES,
 )
 
 # Every field subtype the DB-domain attrs apply to: the shared FIELD_SUBTYPES tuple
@@ -44,12 +45,20 @@
 # @column — physical column-name override on a field. Bare string attr.
 _COLUMN_SCHEMA = AttrSchema(name=fc.FIELD_ATTR_COLUMN, value_type=ATTR_SUBTYPE_STRING, required=False)
 
-# @dbColumnType — physical column-type override on a field. Registered as a bare string
-# attr (NO allowed_values) — matching Java/TS/C#, which register it unconstrained and let
-# ONLY the loader's _validate_db_column_type pass enforce the closed set (so an unknown
-# value fires exactly ONE ERR_BAD_ATTR_VALUE).
+# @dbColumnType — physical column-type override on a field. Carries the closed
+# value-set (uuid | jsonb | timestamp_with_tz) PURELY so it surfaces in the
+# registry manifest (ADR-0036 Wave 1, decision 5 — closed-value-set conformance
+# gate). Its REAL constraint is the (subtype × value) pairing enforced by the
+# loader's _validate_db_column_type pass, which emits the single ERR_BAD_ATTR_VALUE
+# for both an unrecognized value and an illegal pairing; that pass is the sole
+# enforcer, so @dbColumnType is EXEMPT from the generic flat allowed_values
+# membership check (Check 3 in validation_passes) to avoid double-reporting —
+# matching the TS reference.
 _DB_COLUMN_TYPE_SCHEMA = AttrSchema(
-    name=FIELD_ATTR_DB_COLUMN_TYPE, value_type=ATTR_SUBTYPE_STRING, required=False
+    name=FIELD_ATTR_DB_COLUMN_TYPE,
+    value_type=ATTR_SUBTYPE_STRING,
+    required=False,
+    allowed_values=VALID_DB_COLUMN_TYPES,
 )
 
 # DB-domain physical attrs EXTENDING identity subtypes — RDB index / FK-constraint

server/python/src/metaobjects/registry_manifest.py

@@ -9,11 +9,13 @@
 
 The IN/OUT boundary (the v1 logical subset emittable byte-identically by all
 five ports) is documented in ``fixtures/registry-conformance/README.md``. In
-short: ``type.subType`` + ``attrs[{name, valueType, required}]`` + ``commonAttrs``
-+ ``defaultSubTypes``. EXCLUDED from v1 (per-port-physical or
-not-universally-tracked-on-the-registry): factories/native bindings;
-``AttrSchema.default`` and ``allowed_values`` (Java's attr model carries
-neither); ``inheritsFrom``; ``child_rules``.
+short: ``type.subType`` + ``attrs[{name, valueType, required, allowedValues?}]`` +
+``commonAttrs`` + ``defaultSubTypes``. ``allowedValues`` (ADR-0036 Wave 1,
+decision 5) is the closed value-set of a closed-enum attr — emitted ONLY when the
+attr declares one, OMITTED for open / format-validated attrs (@currency, @locale).
+EXCLUDED from v1 (per-port-physical or not-universally-tracked-on-the-registry):
+factories/native bindings; ``AttrSchema.default``; ``inheritsFrom``;
+``child_rules``.
 
 The TS emitter (``server/typescript/packages/metadata/src/registry-manifest.ts``,
 ``emitRegistryManifest``) is the reference implementation; the canonical bytes
@@ -118,9 +120,10 @@ def _is_excluded_type_subtype(type_name: str, sub_type: str) -> bool:
 def _to_manifest_attr(attr: AttrSchema) -> dict[str, object]:
     """Normalize one AttrSchema to the manifest's logical attr shape.
 
-    Emits ``{name, valueType, isArray, required}`` — decomposing array-ness into
-    a scalar ``valueType`` + an orthogonal ``isArray`` flag (``allowed_values`` /
-    ``default`` are intentionally dropped, deferred per the v1 boundary).
+    Emits ``{name, valueType, isArray, required, allowedValues?}`` — decomposing
+    array-ness into a scalar ``valueType`` + an orthogonal ``isArray`` flag.
+    ``allowedValues`` is emitted only when the attr declares a non-empty closed
+    set (ADR-0036 Wave 1, decision 5); ``default`` is intentionally dropped.
     ``value_type`` is ``None`` for polymorphic/untyped attrs (e.g. ``@default``);
     the manifest renders that as an explicit JSON ``null``. A legacy
     ``stringarray`` value_type token is decomposed to
@@ -130,16 +133,26 @@ def _to_manifest_attr(attr: AttrSchema) -> dict[str, object]:
     is_legacy_string_array = attr.value_type == ATTR_SUBTYPE_STRINGARRAY
     is_array = attr.is_array or is_legacy_string_array
     value_type = ATTR_SUBTYPE_STRING if is_legacy_string_array else attr.value_type
-    # Fixed key order: name, valueType, isArray, required, description, then the
-    # optional rules/example/whenToUse (FR-033) — emitted ONLY when present so
-    # absent keys stay absent (dict insertion order → byte-stable).
+    # Fixed key order: name, valueType, isArray, required, allowedValues?,
+    # description, then the optional rules/example/whenToUse (FR-033) — emitted
+    # ONLY when present so absent keys stay absent (dict insertion order →
+    # byte-stable).
     out: dict[str, object] = {
         "name": attr.name,
         "valueType": value_type,
         "isArray": is_array,
         "required": attr.required,
-        "description": attr.description,
     }
+    # The closed value-set of a closed-enum attr (ADR-0036 Wave 1, decision 5).
+    # Emitted ONLY when the attr declares a non-empty allowed_values set; OMITTED
+    # for open / format-validated attrs (e.g. @currency ISO-4217, @locale BCP-47,
+    # @cardinality). Byte-gates closed-enum vocabularies cross-port. Inserted
+    # BEFORE description so the key order is name → valueType → isArray → required
+    # → (allowedValues?) → description → (rules?/example?/whenToUse?). Each member
+    # is stringified for a stable cross-port surface.
+    if attr.allowed_values is not None and len(attr.allowed_values) > 0:
+        out["allowedValues"] = [str(v) for v in attr.allowed_values]
+    out["description"] = attr.description
     if attr.rules is not None:
         out["rules"] = attr.rules
     if attr.example is not None:
@@ -308,7 +321,8 @@ def emit_registry_manifest(registry: TypeRegistry) -> str:
      - 2-space indentation.
      - Object keys in a fixed order (``types`` / ``commonAttrs`` /
        ``defaultSubTypes``; each type ``type`` / ``subType`` / ``attrs``; each
-       attr ``name`` / ``valueType`` / ``isArray`` / ``required``).
+       attr ``name`` / ``valueType`` / ``isArray`` / ``required`` /
+       optional ``allowedValues`` / ``description``).
      - All arrays sorted: ``types`` by ``"type.subType"``; each ``attrs`` by
        name; ``commonAttrs`` by name; ``defaultSubTypes`` keys sorted.
      - ``valueType: null`` literal for polymorphic/untyped attrs.

server/python/src/metaobjects/spec_metamodel/db.json

@@ -7,7 +7,7 @@
       "children": [
         { "type": "attr", "subType": "string", "name": "column", "min": 0, "max": 1, "description": "Physical column name for this field on an rdb source. Defaults to the field name via columnNamingStrategy." },
         { "type": "attr", "subType": "boolean", "name": "db.indexed", "min": 0, "max": 1, "description": "When true, suppress the @filterable-without-index Loader warning (the field is indexed by other means)." },
-        { "type": "attr", "subType": "string", "name": "dbColumnType", "min": 0, "max": 1, "description": "Physical DB column-type override (ADR-0013 escape hatch). Legal values are uuid | jsonb | timestamp_with_tz | uuid_array | text_array, each legal only on a specific logical field subtype (uuid/jsonb/uuid_array/text_array on field.string, timestamp_with_tz on field.timestamp). uuid_array/text_array emit native SQL arrays (uuid[]/text[]). The logical field type and its native binding are unchanged." }
+        { "type": "attr", "subType": "string", "name": "dbColumnType", "min": 0, "max": 1, "allowedValues": ["uuid", "jsonb", "timestamp_with_tz"], "description": "Physical DB column-type override (ADR-0013 escape hatch). Legal values are uuid | jsonb | timestamp_with_tz, each legal only on a specific logical field subtype (uuid/jsonb on field.string, timestamp_with_tz on field.timestamp). The logical field type and its native binding are unchanged. Native SQL arrays (uuid[]/text[]) are NOT declared here — they are derived from a field subtype + isArray (ADR-0036 Wave 1)." }
       ]
     },
     {