[shivros]

Summary

Implements COD-489's bounded configuration-safety follow-up without changing Rite's compound grammar or generated public surfaces.

• Rejects wrong structured operand shapes at deserialization and rite_server::load_config: table-shaped all_of/any_of, array-shaped not, and table/array ordinary leaves, including nested occurrences.
• Preserves scalar all_of/any_of/not metadata keys, empty/omitted legacy matchers, flat matching, source guards, legal nesting, and existing mixed/sibling rejection.
• Makes configuration-load diagnostics safe to display: raw TOML parser source is not retained in CLI/log errors; recognized matcher failures retain an actionable key/operator diagnostic.
• Exercises the raw rite.example.toml, all intended README handler TOML fences, and a deliberately malformed matcher copy through the production loader.
• Documents the precise structured-vs-scalar grammar boundary.

Verification

Baseline proof before the repair:

cargo test -p rite-core compound_rejects
2 new wrong-shape regression tests failed because main accepted malformed operands.

After the repair:

cargo build --all-targets                         # pass
cargo test --all-targets                          # pass (54 tests)
cargo clippy --all-targets -- -D warnings         # pass
cargo fmt --all -- --check                        # pass
cargo run -p rite-codegen -- check                # pass
creed diff                                        # pass
git diff --check                                  # pass

A real CLI invocation against a deliberately malformed config confirmed that a synthetic credential marker was absent from both stdout and stderr while the loader returned a nonzero error.

Review

The dual-model panel initially found a raw-TOML diagnostic disclosure path and requested a matcher-specific fixture corruption. Both were fixed, tested, and re-reviewed. Final panel result: approve; the final non-blocking nested-leaf coverage observation was added as direct core and production-loader regression coverage.

Scope / rollout boundary

No auth policy, action-delivery behavior, event normalization, Hydra API/generated artifacts, dependency, release, deployment, configuration rollout, or live webhook behavior changed. This PR only hardens local configuration parsing and its documentation/test evidence.

Linear: COD-489

[shivros]

🤖 Automated Review Panel

Reviewer A — GPT-5.6 Terra (Codex)

Initial result: BLOCK. The reviewer found that displaying toml::de::Error could render raw configuration source in CLI output, including a credential value on the same TOML line as a newly rejected matcher shape.

Resolution verified: the change now uses a safe ConfigLoadError boundary. It preserves only explicitly marked matcher diagnostics (key/operator, never values) and otherwise returns a generic parse/type error. A server regression test and a real CLI run with a synthetic credential marker confirmed that the marker is absent from both stdout and stderr.

Final result: APPROVE. No blocking correctness, security, regression, or goal-alignment findings. The final reviewer noted non-blocking direct coverage for nested ordinary structured leaves; that coverage was added in both core deserialization and production load_config tests before this handoff.

Reviewer B — Gemini 3 Flash

Initial result: soft reject. It requested that the fixture non-vacuity proof corrupt the matcher grammar itself rather than an unrelated field, and raised a nested-validation concern.

Resolution verified: the fixture test now replaces a real example match with an invalid table-shaped all_of. Nested validation is recursive through tree_from_map for every compound child; explicit regressions now cover table leaves under not, array leaves under any_of, and the production-loader path.

Final result: APPROVE. It found the safe diagnostic boundary, structural matcher validation, scalar compatibility coverage, fixture evidence, and scope all aligned with COD-489.

Local verification

• cargo build --all-targets ✅
• cargo test --all-targets ✅ (54 tests)
• cargo clippy --all-targets -- -D warnings ✅
• cargo fmt --all -- --check ✅
• cargo run -p rite-codegen -- check ✅
• creed diff ✅
• git diff --check ✅

No deployment, runtime configuration, release, or live-webhook behavior changed.

[shivros]

Auto-Merge Gate

Confidence: 0.94

COD-489's configuration-safety goal is directly implemented: malformed structured matcher operands are rejected during deserialization/production loading, scalar legacy operands remain supported, raw example/README fixture coverage is made non-vacuous, and parser source is not exposed through user-facing load errors.

Checks observed: GitHub CI test and Creed context drift succeeded. Independent clean-clone verification at 19ddf82d9b5f70b7d6c465d2100892e78381e619 passed git diff --check origin/main...HEAD, cargo test --all-targets (54 tests), cargo clippy --all-targets -- -D warnings, cargo fmt --all -- --check, and cargo run -p rite-codegen -- check.

Scope: three files; no deployment, runtime configuration rollout, credentials, auth policy, delivery behavior, release, or public generated surface changed. The linked Linear issue contains no manual-review/do-not-auto-merge marker.