Fix deny TOML production value shapes

Author: tartakovsky

.plans/2026-07-07-141120-deny-production-shape-repair.md

@@ -0,0 +1,51 @@
+# Deny Production Shape Repair
+
+## Goal
+
+`aqc-deny-toml-engine` must write `deny.toml` values that `cargo deny` can parse.
+Shackles deny policy must use ordered threshold semantics for `licenses.confidence-threshold`.
+
+## Current Failure
+
+- Generated `maximum-db-staleness = "90d"` is rejected by `cargo deny`.
+- Generated `confidence-threshold = "0.8"` is rejected by `cargo deny`; it expects a float.
+- `DenyConfidenceThreshold` implements `ScalarValue::compare_for_order` as `None`, so `ScalarAssertion::AtLeast` cannot work for the field.
+
+## Approach
+
+- In `aqc-deny-toml-engine`, change `DenyConfidenceThreshold` from plain text semantics to a typed ratio:
+  - parse constructor input like `"0.8"`
+  - store a canonical text representation and an integer ordering key
+  - implement `ScalarValue::compare_for_order` using the ordering key
+  - parse TOML floats and write TOML floats
+- In `aqc-deny-toml-engine`, strengthen `DenyDuration` enough to reject the known wrong product default:
+  - require constructor input to start with `P`
+  - keep TOML representation as string
+- Add engine tests:
+  - `AtLeast(0.8)` accepts `confidence-threshold = 0.9`
+  - `AtLeast(0.8)` repairs `confidence-threshold = 0.7`
+  - expected output writes `confidence-threshold = 0.8`, not a string
+  - `DenyDuration::new("90d")` fails and `DenyDuration::new("P90D")` passes
+- Bump and publish `aqc-deny-toml-engine` to `0.1.1`.
+- In Shackles, update `shakrs-deny-policy`:
+  - use `ScalarAssertion::AtLeast(DenyConfidenceThreshold::new("0.8"), ...)`
+  - use `DenyDuration::new("P90D")`
+  - update fixtures and spec/verifier expectations
+  - bump and publish `shakrs-deny-policy` to `0.1.1`
+  - bump and publish `shakrs` to `0.1.4`
+- Verify installed `shakrs` output with `cargo deny check`, not only `shakrs validate`.
+
+## Files To Modify
+
+- `packages/file-types/toml/aqc-deny-toml-engine/Cargo.toml`
+- `packages/file-types/toml/aqc-deny-toml-engine/src/requirement/value.rs`
+- `packages/file-types/toml/aqc-deny-toml-engine/src/requirement/value/value_impls/core.rs`
+- `packages/file-types/toml/aqc-deny-toml-engine/src/reconcile/scalar_value.rs`
+- `packages/file-types/toml/aqc-deny-toml-engine/tests/*`
+- Shackles deny policy, specs, fixtures, app lockfile, and release worklog
+
+## Key Decisions
+
+- Core already has `ScalarAssertion::AtLeast`; do not add another assertion type.
+- The field-specific fix belongs in the deny engine value type because only that type knows whether ordering is meaningful.
+- Do not make `DenyDuration` a generic duration parser here; this repair only prevents the rejected `90d` form and uses the cargo-deny `P90D` form.

.worklogs/2026-07-07-141615-deny-production-shape-repair.md

@@ -0,0 +1,41 @@
+# Deny Production Shape Repair
+
+## Summary
+
+Fixed `aqc-deny-toml-engine` so `licenses.confidence-threshold` is an ordered cargo-deny float and `advisories.maximum-db-staleness` rejects the known invalid non-cargo-deny duration form.
+Published `aqc-deny-toml-engine v0.1.1`.
+
+## Decisions Made
+
+- Kept `ScalarAssertion::AtLeast` in `aqc-file-engine-core`; no new core assertion was needed.
+- Changed `DenyConfidenceThreshold` semantics in the deny engine value type because that type owns the field's ordering and TOML representation.
+- Stored confidence thresholds with canonical text and an integer ordering key so merge uses deterministic ordering without float equality.
+- Made deny reconciliation parse and write confidence thresholds as TOML floats, matching cargo-deny.
+- Required `DenyDuration` strings to start with `P`, preventing the known rejected `90d` value from entering requirements.
+- Added tests for `AtLeast(0.8)` accepting `0.9`, repairing `0.7`, and writing `confidence-threshold = 0.8`.
+
+## Key Files For Context
+
+- `.plans/2026-07-07-141120-deny-production-shape-repair.md`
+- `packages/file-types/toml/aqc-deny-toml-engine/src/requirement/value.rs`
+- `packages/file-types/toml/aqc-deny-toml-engine/src/requirement/value/value_impls/core.rs`
+- `packages/file-types/toml/aqc-deny-toml-engine/src/reconcile/scalar_value.rs`
+- `packages/file-types/toml/aqc-deny-toml-engine/tests/reconcile.rs`
+- `packages/file-types/toml/aqc-deny-toml-engine/tests/merge.rs`
+- `specs/verifiers/verify_deny_toml_engine.py`
+
+## Verification
+
+- `cargo fmt --manifest-path packages/file-types/toml/aqc-deny-toml-engine/Cargo.toml`
+- `cargo test --manifest-path packages/file-types/toml/aqc-deny-toml-engine/Cargo.toml --all-targets`
+- `cargo deny --manifest-path packages/file-types/toml/aqc-deny-toml-engine/Cargo.toml check`
+- `specular lint specs/2026-07-07-103006-deny-toml-engine.spec.json`
+- `specular verify specs/2026-07-07-103006-deny-toml-engine.spec.json`
+- `cargo package --manifest-path packages/file-types/toml/aqc-deny-toml-engine/Cargo.toml --allow-dirty`
+- `cargo publish --manifest-path packages/file-types/toml/aqc-deny-toml-engine/Cargo.toml --allow-dirty`
+
+## Next Steps
+
+- Update Shackles deny policy to emit `ScalarAssertion::AtLeast(DenyConfidenceThreshold::new("0.8"), ...)`.
+- Update Shackles deny policy to use `DenyDuration::new("P90D")`.
+- Verify installed `shakrs` output with `cargo deny check`.

packages/file-types/toml/aqc-deny-toml-engine/Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "aqc-deny-toml-engine"
-version = "0.1.0"
+version = "0.1.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.85"

packages/file-types/toml/aqc-deny-toml-engine/Cargo.toml

@@ -63,7 +63,23 @@ macro_rules! impl_string_scalar {
 
 impl_string_scalar!(DenyNonEmptyString);
 impl_string_scalar!(DenyDuration);
-impl_string_scalar!(DenyConfidenceThreshold);
+
+impl DenyTomlScalar for DenyConfidenceThreshold {
+    fn parse_item(item: &Item) -> Option<Self> {
+        item.as_float()
+            .map(|value| value.to_string())
+            .or_else(|| item.as_integer().map(|value| value.to_string()))
+            .and_then(|value| Self::new(value).ok())
+    }
+
+    fn write_item(value: &Self) -> Item {
+        toml_edit::value(value.as_f64())
+    }
+
+    fn render_value(value: &Self) -> String {
+        value.as_str().to_owned()
+    }
+}
 
 macro_rules! impl_enum_scalar {
     ($type_name:ty) => {

packages/file-types/toml/aqc-deny-toml-engine/src/reconcile/scalar_value.rs

@@ -1,5 +1,6 @@
 //! Deny TOML scalar and item value types.
 
+use std::cmp::Ordering;
 use std::collections::BTreeSet;
 
 use serde::{Deserialize, Serialize};
@@ -8,9 +9,22 @@ mod value_impls;
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub enum DenyTomlValueError {
-    Empty { field: &'static str },
-    UnknownEnum { field: &'static str, value: String },
-    OverlappingFeatures { package: String, feature: String },
+    Empty {
+        field: &'static str,
+    },
+    Invalid {
+        field: &'static str,
+        value: String,
+        reason: &'static str,
+    },
+    UnknownEnum {
+        field: &'static str,
+        value: String,
+    },
+    OverlappingFeatures {
+        package: String,
+        feature: String,
+    },
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
@@ -52,8 +66,32 @@ pub struct DenyPackageSpec(String);
 #[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
 pub struct DenyDuration(String);
 
-#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
-pub struct DenyConfidenceThreshold(String);
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(try_from = "String", into = "String")]
+pub struct DenyConfidenceThreshold {
+    text: String,
+    millionths: u32,
+}
+
+impl PartialEq for DenyConfidenceThreshold {
+    fn eq(&self, other: &Self) -> bool {
+        self.millionths == other.millionths
+    }
+}
+
+impl Eq for DenyConfidenceThreshold {}
+
+impl PartialOrd for DenyConfidenceThreshold {
+    fn partial_cmp(&self, other: &Self) -> Option<Ordering> {
+        Some(self.cmp(other))
+    }
+}
+
+impl Ord for DenyConfidenceThreshold {
+    fn cmp(&self, other: &Self) -> Ordering {
+        self.millionths.cmp(&other.millionths)
+    }
+}
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct DenyGraphTargetSpec {
@@ -200,5 +238,111 @@ macro_rules! impl_text_wrapper {
 
 impl_text_wrapper!(DenyNonEmptyString, "text");
 impl_text_wrapper!(DenyPackageSpec, "package");
-impl_text_wrapper!(DenyDuration, "duration");
-impl_text_wrapper!(DenyConfidenceThreshold, "confidence-threshold");
+
+impl DenyDuration {
+    pub fn new(value: impl Into<String>) -> Result<Self, DenyTomlValueError> {
+        let value = value.into();
+        if value.is_empty() {
+            return Err(DenyTomlValueError::Empty { field: "duration" });
+        }
+        if !value.starts_with('P') {
+            return Err(DenyTomlValueError::Invalid {
+                field: "duration",
+                value,
+                reason: "duration must use cargo-deny ISO-8601 form such as P90D",
+            });
+        }
+        Ok(Self(value))
+    }
+
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl DenyConfidenceThreshold {
+    pub fn new(value: impl Into<String>) -> Result<Self, DenyTomlValueError> {
+        let value = value.into();
+        if value.is_empty() {
+            return Err(DenyTomlValueError::Empty {
+                field: "confidence-threshold",
+            });
+        }
+        let millionths = parse_confidence_millionths(&value)?;
+        Ok(Self {
+            text: canonical_confidence_text(&value),
+            millionths,
+        })
+    }
+
+    #[must_use]
+    pub fn as_str(&self) -> &str {
+        &self.text
+    }
+
+    #[must_use]
+    pub fn as_f64(&self) -> f64 {
+        self.text.parse::<f64>().unwrap_or(0.0)
+    }
+}
+
+impl TryFrom<String> for DenyConfidenceThreshold {
+    type Error = DenyTomlValueError;
+
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        Self::new(value)
+    }
+}
+
+impl From<DenyConfidenceThreshold> for String {
+    fn from(value: DenyConfidenceThreshold) -> Self {
+        value.text
+    }
+}
+
+fn parse_confidence_millionths(value: &str) -> Result<u32, DenyTomlValueError> {
+    let Some((whole, fraction)) = value.split_once('.') else {
+        return match value {
+            "0" => Ok(0),
+            "1" => Ok(1_000_000),
+            _ => Err(invalid_confidence(value)),
+        };
+    };
+    if fraction.is_empty()
+        || fraction.len() > 6
+        || !fraction.bytes().all(|byte| byte.is_ascii_digit())
+    {
+        return Err(invalid_confidence(value));
+    }
+    let padded = format!("{fraction:0<6}");
+    let fraction_value = padded
+        .parse::<u32>()
+        .map_err(|_| invalid_confidence(value))?;
+    match whole {
+        "0" => Ok(fraction_value),
+        "1" if fraction_value == 0 => Ok(1_000_000),
+        _ => Err(invalid_confidence(value)),
+    }
+}
+
+fn canonical_confidence_text(value: &str) -> String {
+    let mut out = value.to_owned();
+    if out.contains('.') {
+        while out.ends_with('0') {
+            let _ = out.pop();
+        }
+        if out.ends_with('.') {
+            out.push('0');
+        }
+    }
+    out
+}
+
+fn invalid_confidence(value: &str) -> DenyTomlValueError {
+    DenyTomlValueError::Invalid {
+        field: "confidence-threshold",
+        value: value.to_owned(),
+        reason: "confidence-threshold must be a number from 0.0 through 1.0",
+    }
+}

packages/file-types/toml/aqc-deny-toml-engine/src/requirement/value.rs

@@ -74,10 +74,10 @@ impl ScalarValue for value::DenyDuration {
 
 impl ScalarValue for value::DenyConfidenceThreshold {
     fn render(&self) -> String {
-        self.0.clone()
+        self.as_str().to_owned()
     }
-    fn compare_for_order(&self, _other: &Self) -> Option<Ordering> {
-        None
+    fn compare_for_order(&self, other: &Self) -> Option<Ordering> {
+        Some(self.cmp(other))
     }
 }
 

packages/file-types/toml/aqc-deny-toml-engine/src/requirement/value/value_impls/core.rs

@@ -8,6 +8,11 @@ impl fmt::Display for DenyTomlValueError {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
             Self::Empty { field } => write!(f, "{field} must not be empty"),
+            Self::Invalid {
+                field,
+                value,
+                reason,
+            } => write!(f, "invalid {field} value {value}: {reason}"),
             Self::UnknownEnum { field, value } => {
                 write!(f, "unknown {field} value {value}")
             }