Use a reviewed source commit
Do not add an indexed dependency yet.
The repository push will provide public source; the publication configuration prepares Pages documentation. Neither creates an Alire index entry. The implementation review accepted source 54720e6dd6c3ec340fe6c0cba9e27bb64dbd3486 and tree 39d73339751fc3dcf813907417be643219cc88cc. The Ada library sources prepared for publication match those in the reviewed source identity.
Use the 13 reviewed public units
| Layer | Capability |
|---|---|
| Parsing | Step and Drain, exact coordinates, syntax events, arbitrary input bounds, and explicit borrowed-or-owned fragment representation. |
| Writing | Bounded, allocating, and external transactional facades with unpublished staging. |
| Values | Raw CBOR lengths, integers, tags, simple values, float widths, and bits. |
| Numbers | Checked signed, unsigned, and binary64-interchange conversion. |
| Profiles and errors | Complete explicit identities and nonraising syntax diagnostics. |
Rely on executed local evidence
The maintained test action covers:
- direct parser and writer transcripts and the legacy oracle corpus;
- every small split, one-byte chunks, randomized chunks, and arbitrary array bounds;
- malformed and adversarial input, lifecycle transitions, abort, and allocation failure;
- work bounds, dependency isolation, an installed client, and an allocation-restricted client.
The final independent implementation, consumer, and release-shape reviews reported no P0, P1, or P2 findings for the reviewed source identity. A pristine archive passed the local release reproduction.
Limit claims to current behavior
Ordinary_Compactis not canonical CBOR and does not sort map keys.- Tags have no schema, Type IR, Reflection, or Wire identity.
- Syntax depth is independent of a consumer’s logical depth, path, item budget, and allocation policy.
- The parser exposes events rather than a DOM or collector.
- The allocating writer may raise
Storage_Error; the bounded core does not allocate. - Inspect hosted CI for the exact source commit before treating it as evidence.
- Alire publication, indexed reproduction, and downstream migration remain separate authorization gates.