No JSON Schema validation of bundles (spec §3.1, §8.3)

[sampras343]

Spec Reference

OMS v1.0 §3.1 (Schemas), §8.3 (Statement Validation)

Problem

The spec provides machine-readable JSON Schemas (Draft 2020-12) for validating each layer of an OMS bundle:

Schema	Path
Bundle	schemas/v1.0/bundle.schema.json
Envelope	schemas/v1.0/envelope.schema.json
Statement	schemas/v1.0/statement.schema.json
Predicate	schemas/v1.0/predicate.schema.json

§3.1 states:

"Implementations that produce OMS bundles SHOULD validate the output against the bundle schema."

§8.3 states:

"Implementations SHOULD validate the decoded statement against schemas/v1.0/statement.schema.json."

The Go implementation performs structural validation (checking field presence and types manually in payload.go and serialization.go) but does not validate against the formal JSON schemas.

Impact

• Structural validation may miss constraints that the JSON schemas enforce (e.g., pattern constraints on URIs, additional property restrictions, conditional requirements)
• The conformance test suite spec says: "Conformance test suites MUST validate bundles against all four schemas" — if this implementation is used as a conformance reference, schema validation is expected

Current Behavior

• MarshalPayload builds the statement programmatically but does not validate the output against any schema
• UnmarshalPayload manually checks _type, predicateType, predicate presence, resource field types, etc. — but this is ad-hoc, not schema-driven

Suggested Approach

Consider adding optional JSON Schema validation using a Go JSON Schema library (e.g., github.com/santhosh-tekuri/jsonschema). This could be:

1. A validation step in MarshalPayload (producer-side, per §3.1)
2. A validation step in UnmarshalPayload (verifier-side, per §8.3)
3. A standalone validation function for the conformance test suite

Since this is a SHOULD (not MUST), this is lower priority than normative violations.