feat(fr-033): Python — wire+gate structural-child placement enforcement

Verifies + pins that a misplaced structural child is rejected at strict load (a
relationship under object.projection; a field under an attr-only validator.required).
Python's S-B2a strict child_rules were registered but the loader's attr-schema pass
did NOT consult them for STRUCTURAL placement (only ERR_UNKNOWN_ATTR for misplaced
attrs) — the two cases loaded clean. Wires the ERR_CHILD_NOT_ALLOWED check into
loader/validation_passes.py (_validate_attr_schema Check 0b): a structural child
(own_children — not an @-attr) not admitted by the parent's registered child_rules
now raises under strict, mirroring TS attr-schema-validate.ts (shared wildcard /
subtype-list match; lax mode stays a no-op; unregistered parent skipped).
registry-conformance stays GREEN. Corpus fixtures fixed: none.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: dmealing

server/python/src/metaobjects/loader/validation_passes.py

@@ -50,7 +50,7 @@
     ATTR_SUBTYPE_PROPERTIES,
     ATTR_SUBTYPE_STRINGARRAY,
 )
-from ..registry import AttrSchema, TypeRegistry
+from ..registry import AttrSchema, ChildRule, TypeRegistry
 from ..shared.base_types import (
     TYPE_FIELD,
     TYPE_IDENTITY,
@@ -212,6 +212,33 @@ def _node_label(node: MetaData) -> str:
     return f"{head} '{node.name}'" if node.name else head
 
 
+# The any-name / any-subtype wildcard a ChildRule field may carry. Mirrors TS's
+# CHILD_RULE_WILDCARD in shared/structural.ts.
+_CHILD_RULE_WILDCARD = "*"
+
+
+def _child_rule_admits(rule: "ChildRule", child: MetaData) -> bool:
+    """Whether *rule* admits *child* under the shared wildcard match semantics.
+
+    childType / childName may be ``"*"``; childSubType may be ``"*"``, a single
+    subtype, or a LIST of subtypes (FR-033). Mirrors the TS ``childRuleMatches``
+    in registry.ts used by Check 0b in attr-schema-validate.ts.
+    """
+    if rule.child_type != _CHILD_RULE_WILDCARD and rule.child_type != child.type:
+        return False
+
+    sub = rule.child_sub_type
+    if isinstance(sub, list):
+        if child.sub_type not in sub:
+            return False
+    elif sub != _CHILD_RULE_WILDCARD and sub != child.sub_type:
+        return False
+
+    if rule.child_name != _CHILD_RULE_WILDCARD and rule.child_name != child.name:
+        return False
+    return True
+
+
 def _effective_schemas(
     type_: str,
     sub_type: str,
@@ -298,6 +325,37 @@ def _validate_attr_schema(
                         )
                     )
 
+        # --- Check 0b (FR-033): strict-load structural-child placement ---
+        #
+        # The structural analogue of Check 0. A STRUCTURAL child (field/identity/
+        # source/validator/… — attrs never appear in own_children(); they live in
+        # own_meta_attrs()) must be admitted by the parent's registered child_rules
+        # under the same wildcard match semantics used everywhere (childType /
+        # childSubType / childName may be "*", and childSubType may be a list). A
+        # child the rules do not admit → ERR_CHILD_NOT_ALLOWED (the structural
+        # analogue of Check 0's ERR_UNKNOWN_ATTR). Strict-load only; lax keeps the
+        # legacy open policy. An UNREGISTERED parent cannot be judged here
+        # (ERR_UNKNOWN_TYPE / ERR_UNKNOWN_SUBTYPE is reported elsewhere) — skip so
+        # we never double-report. Mirrors the TS reference Check 0b in
+        # attr-schema-validate.ts.
+        if strict:
+            parent_def = registry.find(node.type, node.sub_type)
+            if parent_def is not None:
+                rules = parent_def.child_rules
+                for child in node.own_children():
+                    if not any(_child_rule_admits(r, child) for r in rules):
+                        errors.append(
+                            MetaError(
+                                f"Child {_node_label(child)} is not allowed under "
+                                f"{_node_label(node)} — no registered child rule for "
+                                f"{node.type}.{node.sub_type} admits "
+                                f"(type='{child.type}', subType='{child.sub_type}', "
+                                f"name='{child.name}')",
+                                ErrorCode.ERR_CHILD_NOT_ALLOWED,
+                                envelope=node.source,
+                            )
+                        )
+
         if not schemas:
             continue
 

server/python/tests/unit/test_strict_child_placement.py

@@ -0,0 +1,73 @@
+"""FR-033 — strict structural-child placement enforcement (gating test).
+
+A STRUCTURAL child (field/identity/source/validator/… — not an @-attr) placed
+under a parent whose strict registered ``child_rules`` do NOT admit it is
+rejected at strict load with ``ERR_CHILD_NOT_ALLOWED`` (the structural analogue
+of the ``ERR_UNKNOWN_ATTR`` misplaced-attr check). Mirrors the TS gating test
+(``server/typescript/packages/metadata/test/child-placement-enforcement.test.ts``)
+and the Java ``StrictChildPlacementTest`` — the same two cases, the same code.
+
+Pins the loader-wired Check 0b in ``loader/validation_passes.py``. Lax load
+(the default) keeps the legacy open policy — a no-op.
+"""
+from __future__ import annotations
+
+from metaobjects.errors import ErrorCode
+from metaobjects.loader.meta_data_loader import MetaDataFormat, MetaDataLoader
+
+# Case 1 — a `relationship.association` under an `object.projection`. Strict
+# projection children = field/identity/validator/layout/source — NO relationship.
+_RELATIONSHIP_UNDER_PROJECTION = """
+{ "metadata.root": { "package": "test", "children": [
+  { "object.entity": { "name": "Account", "children": [
+      { "field.string": { "name": "id" }},
+      { "identity.primary": { "name": "pk", "@fields": ["id"] }}
+  ]}},
+  { "object.projection": { "name": "AccountView", "extends": "Account", "children": [
+      { "relationship.association": {
+          "name": "bogus", "@cardinality": "one", "@objectRef": "Account" }}
+  ]}}
+]}}
+"""
+
+# Case 2 — a `field.string` under an attr-only `validator.required`. Strict
+# validator children = [] (attr-only) — a structural field is never admitted.
+_FIELD_UNDER_VALIDATOR = """
+{ "metadata.root": { "package": "test", "children": [
+  { "object.entity": { "name": "Account", "children": [
+      { "field.string": { "name": "id", "children": [
+          { "validator.required": { "name": "req", "children": [
+              { "field.string": { "name": "bogus" }}
+          ]}}
+      ]}}
+  ]}}
+]}}
+"""
+
+
+def _codes(content: str, *, strict: bool) -> list[ErrorCode]:
+    result = MetaDataLoader.from_string(
+        content, format=MetaDataFormat.JSON, strict=strict
+    )
+    return [e.code for e in result.errors]
+
+
+def test_relationship_under_projection_rejected_strict() -> None:
+    codes = _codes(_RELATIONSHIP_UNDER_PROJECTION, strict=True)
+    assert ErrorCode.ERR_CHILD_NOT_ALLOWED in codes
+
+
+def test_field_under_validator_rejected_strict() -> None:
+    codes = _codes(_FIELD_UNDER_VALIDATOR, strict=True)
+    assert ErrorCode.ERR_CHILD_NOT_ALLOWED in codes
+
+
+def test_misplaced_structural_child_is_noop_in_lax_mode() -> None:
+    # Lax load (the default) preserves the legacy open placement policy — the
+    # check never fires (downstream apps can loosen the model).
+    assert ErrorCode.ERR_CHILD_NOT_ALLOWED not in _codes(
+        _RELATIONSHIP_UNDER_PROJECTION, strict=False
+    )
+    assert ErrorCode.ERR_CHILD_NOT_ALLOWED not in _codes(
+        _FIELD_UNDER_VALIDATOR, strict=False
+    )