Additional independent Codex design review — CHANGES REQUIRED
Source: 293ccd0a94266c8b8d00fd0b9b31a1ab812a0c75, clean overnight-links worktree. Reviewer: inherited Codex agent /root/sheets_track, session overnight-20260907-sheets, harness codex. Developer identifies this agent as Codex based on GPT-6; no more specific runtime model ID is exposed. I did not author the proposal (root owns it). This is not a Fable verdict or a waiver; requested Fable review remains outstanding before promotion.
Read AGENTS.md, implementation/link-roundtrip.md, Plan7 D1/D3, actual Rust HTML/JSON/text walkers, generated ProseMirror/Yjs fixture and RED test, Go export model/Markdown/PDF layout, and low-level PDF builder. Existing before.log records the genuine missing-link failure; I inspected that evidence, not independently reran Cargo. I independently ran local Node URL parsing for the ambiguity below. No live requests or source changes.
- Medium, implementation/link-roundtrip.md:17–24: close the accepted-URL/encoding contract before implementation. The positive scheme check rejects controls before/in the scheme but does not specify controls after the colon, and accepts base-dependent forms such as https:relative. The same paragraph promises no relative inference, preserving accepted href content, and equivalent URL meaning in Markdown/PDF. Those requirements are not yet mutually executable for this accepted set. Local Node WHATWG URL parsing with base https://docs.example.test/d/abc resolves https:relative to https://docs.example.test/d/relative and https://example.test/a<TAB>b or a<LF>b to https://example.test/ab. Percent-encoding those controls for Markdown instead yields a different path; raw controls risk destination syntax breaks. A PDF reader has no defined Docs base to reproduce the relative result. This is a design fidelity ambiguity, not a reproduced script-execution exploit.
Required amendment: specify the full accepted href shape and exact output encoding, retaining Plan7's positive scheme rule. Choose explicitly whether suffix controls/base-dependent HTTP forms become unlinked text or are normalized once in the shared core. If narrowing a previously intended accepted set changes Plan7's product contract, record that design amendment rather than leaving renderers to disagree. This is a routine bounded design resolution under existing authorization unless an attributed ruling explicitly forbids the chosen correction; no new human permission gate is requested. Include http/https authority shape, backslashes, whitespace/control handling, mailto body/query, valid existing percent escapes, parentheses, angle brackets and non-ASCII examples. Tests must compare the effective parsed destination across HTML and Markdown and the actual decoded PDF URI bytes, with an explicit parity definition; string containment alone cannot certify preserved meaning. Do not fetch any target.
Nonblocking implementation/test notes:
- PDF architecture supports this slice without changing pagination: carry href through tokenization and splitToWidth, add annotation on the actual page after drawLine resolves alignment and baseline, preserving the existing line metrics. Test mixed linked/unlinked runs, long unbroken labels split into multiple lines, center/right alignment, list/quote indentation and page boundaries; rectangle membership must cover only linked text. Current text API does not return geometry, so deriving rectangles in a second independent layout pass would violate the stated contract.
- Markdown's current code-span branch returns early and whitespace-only runs bypass ordinary mark emission. Include linked code and linked leading/trailing whitespace tests so adding only the ordinary emphasis path does not silently omit links. Parse exported Markdown with an independent actual parser in the evidence, including adjacent differently marked runs.
- Current RED test is meaningful but its first HTML assertion prevents JSON assertions from executing on baseline. Implementation evidence should make HTML and JSON hostile-path tests separately observable, as the proposal already requires.
Otherwise the scope is sound: no storage/ABI migration, normalize before both readers, preserve text/other marks, drop unknown mark values, safe HTML attributes/no target/noreferrer, no insertion-menu completion claim, unchanged disputed fragment_text behavior, and separate whole-branch/CI/browser/canary/Fable gates. No additional authorization or lifecycle blocker found in this bounded read/export slice.
amadan