[chubirka]

Plan 15, decision 10: the inventory-export reporting slice. Ownership is recorded in progress-tracker as 52fa16dc4.

What

• Add the ephemeral inventory-export ViewModel contract: a required rows array whose rows preserve the existing eight human-label inventory columns and string/list types.
• Reject missing/extra fields and malformed/null collections while retaining empty inventories and raw historical/untrusted strings.
• No DDL, persisted artifact discriminator, inventory-declaration model, or URL/UUID restrictions.

Verification

• 103 focused schema boundary cases passed.
• Full repository lint/format gates passed; 1,641 tests passed and 1 skipped with isolated PostgreSQL enabled.
• Built-wheel smoke loaded the packaged schema from an isolated installed wheel, accepted a complete raw row, and rejected a null owner list.

Merge order

Merge this schema before the Core registered inventory view, then merge/re-pin the Traust consumer. Core owns composition, ordering and safe Markdown/HTML/CSV rendering. No automatic merges.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chubirka

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [chubirka]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[qodo-for-traust-sci]

PR Summary by Qodo

Define the inventory-export ViewModel contract

✨ Enhancement 🧪 Tests 📝 Documentation 🕐 10-20 Minutes

AI Description

• Add an ephemeral inventory-export ViewModel with a required rows array and eight legacy columns.
• Reject malformed or extra fields while preserving empty inventories and unrestricted raw strings.
• Document the contract and test its validation boundaries.

Diagram

graph TD
  A["Inventory rows"] --> B["Rows ViewModel"] --> C["Inventory schema"] --> D["Core Insight"] --> E["Safe renderers"]

Loading

High-Level Assessment

Keep the strict, ephemeral rows wrapper separate from the legacy bare CLI array. Reusing the bare array would lose the native ViewModel boundary, while sanitizing or constraining strings in the schema would reject historical data and duplicate Core's rendering responsibility.

Files changed (3) +184 / -0

Enhancement (1) +38 / -0

inventory-export.schema.jsonDefine the strict inventory-export JSON Schema +38/-0

Define the strict inventory-export JSON Schema

• Adds a Draft 2020-12 schema requiring a rows array of objects with five string columns and three string-array columns. Disallows additional fields at both object levels without imposing URL or content restrictions.

views_schema/v1/inventory-export.schema.json

Tests (1) +135 / -0

test_inventory_export_view.pyCover inventory ViewModel validation boundaries +135/-0

Cover inventory ViewModel validation boundaries

• Tests valid complete and empty inventories, preservation of raw strings, and rejection of missing fields, wrong types, extra fields, and bare legacy arrays.

tests/test_inventory_export_view.py

Documentation (1) +11 / -0

README.mdDocument the inventory-export contract and ownership boundaries +11/-0

Document the inventory-export contract and ownership boundaries

• Describes the rows wrapper, eight column types, and rejection of unknown fields and null lists. Clarifies that the CLI's bare array remains separate and Core owns composition and safe rendering.

README.md

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can hide the parts of a finding you never read, like the evidence or the agent prompt

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-for-traust-sci]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[chubirka]

The complete inventory-export implementation is now available for dependency-ordered review: this schema → Core traust-security/traust-core#397 → consumer traust-security/traust#384. Core and consumer are draft-gated for canonical merged-dependency re-pins; no automatic merges. Full verification and the performance caveats are recorded on those PRs and in the shared plan-15 decision log.

[chubirka]

Conflict with development resolved in f7630ed: both this branch and the merged benchmark-scorecards view (#124) added a view paragraph to the README at the same spot. Union kept — scorecards paragraph first, inventory-export paragraph after. No other overlap; schemas and tests are disjoint adds. Gates: 1,633 passed, 42 skipped; ruff clean; CI green (lint, 3.11, 3.12).