The role@profile:field=value form of --subject (parse_subject_argument in crates/registry-evidencectl/src/request.rs) hands its value to parse_progressive_selector_value, the progressive typed parse. A string selector value that looks numeric or boolean (a registration code 00123, the word true) is sent typed, and the runtime refuses it as mistyped. The escape is the JSON-quoted form (code="00123"), which no help text or tutorial names. The unprofiled role:field=value form keeps its value lexical.
The progressive form has no local project and must keep the rule. The profiled form does not need it: the compiled project knows every profile's field types.
Options:
- Thread the selector field types from the authoring plan through
CompiledSelector and the persisted dev state document (with a default for documents written without them) into a type-directed parse for the profiled form. Recommended.
- Keep the rule and document the quoted escape in the
--subject help (regenerating the CLI reference) and in the BReg tutorial.
Either way the plain shorthand stays lexical. Not a trust boundary: the runtime's selector validation refuses the mistyped value before any source call.
Origin: review of PR #865 (raised by Codex, answered in-thread).
The
role@profile:field=valueform of--subject(parse_subject_argumentincrates/registry-evidencectl/src/request.rs) hands its value toparse_progressive_selector_value, the progressive typed parse. A string selector value that looks numeric or boolean (a registration code00123, the wordtrue) is sent typed, and the runtime refuses it as mistyped. The escape is the JSON-quoted form (code="00123"), which no help text or tutorial names. The unprofiledrole:field=valueform keeps its value lexical.The progressive form has no local project and must keep the rule. The profiled form does not need it: the compiled project knows every profile's field types.
Options:
CompiledSelectorand the persisted dev state document (with a default for documents written without them) into a type-directed parse for the profiled form. Recommended.--subjecthelp (regenerating the CLI reference) and in the BReg tutorial.Either way the plain shorthand stays lexical. Not a trust boundary: the runtime's selector validation refuses the mistyped value before any source call.
Origin: review of PR #865 (raised by Codex, answered in-thread).