# T30 Backend Semantic Serializer Validation

> - Task: T30 — Implement backend serializers and semantic-equivalence oracle - Requirements: VES-CTX-002…004, VES-MDL-005, and VES-HOF-004 - Commit target: feat(context): add backend semantic serializers - Focused evidence: 42 cases — 27 contract and 15 security - Spec deviations: none

Source: https://github.com/accd/verchestra/blob/main/docs/qualification/t30-validation.md
Content digest: `sha256:23247f19219beb119cf5ed01995779752605a7e15307d6818f3985a8d701a377`

## Scope

- Task: T30 — Implement backend serializers and semantic-equivalence oracle
- Requirements: VES-CTX-002…004, VES-MDL-005, and VES-HOF-004
- Commit target: `feat(context): add backend semantic serializers`
- Focused evidence: 42 cases — 27 contract and 15 security
- Spec deviations: none

T30 projects a signed T29 Context Manifest into one closed neutral semantic tree and serializes its canonical JSON into exact Pi, Claude Code, Codex, and OpenCode transport envelopes. A cross-backend oracle performs strict native-envelope extraction, closed-vocabulary validation, content-digest validation, canonical-byte validation, and meaning-digest comparison. Capacity is estimated over the final native envelope through a Driver-owned port before delivery.

## Deterministic gates

| Command | Result |
| --- | --- |
| `node --test tests/contract/context-serializers.test.mjs tests/security/context-serializer-security.test.mjs` | PASS — 42 passed, 0 failed/skipped |
| `node scripts/gate.mjs security` | PASS — format, lint, typecheck, build, 1,346 unit, 10 architecture, 248 qualification, 215 security, and 39 fault cases |
| `pnpm test:contract` | PASS — 131 passed, 0 failed/skipped |

## Check A — sufficient, spec-anchored coverage

| Criterion / requirement | Exact assertion evidence | Spec-defined outcome | Covered |
| --- | --- | --- | --- |
| Four native serializers | `tests/contract/context-serializers.test.mjs:11–79` | Pi, Claude Code, Codex, and OpenCode emit exact target envelopes, round-trip one digest, preserve obligations/trust order, and estimate final bytes | Yes |
| VES-CTX-004 capacity | `tests/contract/context-serializers.test.mjs:81` | Every backend fails before delivery when qualified input capacity is insufficient | Yes |
| Closed target set | `tests/contract/context-serializers.test.mjs:95` | Unsupported generic backend has no fallback serializer | Yes |
| VES-MDL-005/HOF-004 equivalence | `tests/contract/context-serializers.test.mjs:108` | All six pairings among four backends produce the same normalized meaning digest | Yes |
| Injection-safe content boundary | `tests/security/context-serializer-security.test.mjs:9` | Four hostile delimiter/JSON/instruction payloads round-trip only as untrusted content strings | Yes |
| Transport tamper detection | `tests/security/context-serializer-security.test.mjs:36` | Changed content in each backend fails expected semantic equivalence | Yes |
| No fallback parsing | `tests/security/context-serializer-security.test.mjs:52` | Malformed native envelopes fail rather than treating arbitrary prompt text as context | Yes |
| Estimator fail-closed | `tests/security/context-serializer-security.test.mjs:68` | Non-finite capacity evidence blocks serialization | Yes |
| No target-only semantics | `tests/security/context-serializer-security.test.mjs:81` | Pi system instructions outside the neutral tree are forbidden | Yes |
| Closed semantic vocabulary | `tests/security/context-serializer-security.test.mjs:96` | Recomputed digest cannot authorize an extra instruction field | Yes |
| Minimum floor | Focused runner: 42 | At least 35 contract/security cases | Yes |

## Check B — non-shallow litmus

- Every backend independently proves native shape, semantic round-trip, obligation/fragment/trust order, final-envelope estimation, insufficient capacity, hostile content, tamper failure, and malformed-envelope rejection.
- The cross-backend oracle covers all six unordered backend pairs rather than comparing each only to a preferred backend.
- Hostile content includes a closing tag, a system instruction, a forged semantic-obligations object, an authority trust claim, and a reopening tag.
- Canonical JSON provides the structural boundary: content remains an escaped string and cannot create a sibling field.
- The oracle validates an exact field vocabulary at tree, fragment, source, and native-envelope levels; there is no permissive fallback parser.
- Even an attacker who recomputes the wrapper meaning digest cannot introduce a new instruction field.
- Provider-only controller instructions are prohibited, preventing semantic behavior that the shared digest cannot observe.

## Check C — necessary reverse mapping

| Test evidence | Requirement / criterion | Keep |
| --- | --- | --- |
| `context-serializers.test.mjs:11–79` | Native transport, round-trip, semantic/trust order, estimator port | Yes |
| `context-serializers.test.mjs:81–106` | Capacity and unsupported target | Yes |
| `context-serializers.test.mjs:108–132` | Complete cross-backend equivalence graph | Yes |
| `context-serializer-security.test.mjs:9–50` | Injection containment and tamper detection | Yes |
| `context-serializer-security.test.mjs:52–79` | Structural failure and estimator evidence | Yes |
| `context-serializer-security.test.mjs:81–119` | No hidden target semantics and closed tree vocabulary | Yes |

All 42 focused cases map to a T30 done-when criterion. Driver execution/session behavior remains with T34–T37 and is not duplicated here.

## Check D — guideline conformance

- Followed `.specs/features/verchestra-1.0/tasks.md`: contract/security tests preceded implementation, the 35-case floor is exceeded, and `gate:security` passes.
- Reused the T29 `serializedMeaningDigest`; serializer-specific envelopes do not invent another semantic model.
- Capacity is a port evaluated on final target bytes, allowing qualified Driver tokenizers without coupling the agent runtime to provider SDKs.
- Mandatory semantics and trust order are part of the neutral tree and therefore participate in every backend digest.
- Structural JSON fields are closed and content digests are recomputed by the oracle; prompt-like bytes cannot become controller fields.

## Adequacy verdict

PASS. All four serializers preserve one neutral meaning and mandatory trust order, all six cross-backend comparisons agree, hostile content remains structurally data, insufficient capacity fails before delivery, and the security gate is green.