mcpx: Phase 1 of #1481 — schemaval core: a real JSON Schema 2020-12 validator + dialect policy (no call-path changes) #1482

Phase 1 of design #1481 (JSON Schema validation of tool input and output). Design doc: files/designs/code-mcpx-json-schema-validation.md in the keep-the-four-repos-healthy goal workspace. Origin gap: dezren39/darwin-nix#254 — its acceptance requires the validator decision recorded before implementation; that decision is recorded on #1481 (adopt github.com/santhosh-tekuri/jsonschema/v6 behind internal/schemaval; internal/mcpspec stays the test-only protocol-frame validator).

Scope

Build the validator core only — no call-path changes, nothing enforces yet:

• New package internal/schemaval (name indicative; settle at triage) wrapping github.com/santhosh-tekuri/jsonschema/v6; it is the only package importing the dependency. Add the dependency to pkgs/mcpx/go.mod (cause recorded on design(mcpx): JSON Schema validation of tool input and output — one validator at the client choke point #1481: full 2020-12 support is a MUST row in mcpx's own conformance matrix; the library passes the JSON-Schema-Test-Suite and covers drafts 4/6/7/2019-09/2020-12).
• Dialect policy: a schema with no $schema compiles as 2020-12; a declared $schema must name 2020-12, 2019-09, draft-07, draft-06 or draft-04 — anything else returns a distinct, typed UnsupportedDialect error.
• No network, ever: the compiler's loader resolves only inline/already-registered resources. An external $ref is a typed UnresolvedRef compile error; an internal unresolvable $ref is likewise a compile error. Fetching is not an option the API exposes.
• Compilation is bounded: a maximum schema size (settle the number at triage against real catalog schemas) — an oversized or pathological schema fails compilation as invalid rather than consuming the daemon.
• Validation API: compile once from json.RawMessage, validate decoded instances; instances must be decoded the way the library requires (jsonschema.UnmarshalJSON) so >2^53 integers keep numeric fidelity. Validation errors flatten to a concise path-carrying form, e.g. $.count: expected integer, got string.
• Formats are annotations, not assertions, in v1 (format: email alone never fails validation).
• Dialect document: add the supported-dialect list + the policies above to pkgs/mcpx/docs/, and note in internal/conformance/coverage_messages.go that the validator mechanism exists (row closures land with Phases 2–3, not here).
• Package comment in schemaval must state the division of labour plainly: mcpspec = protocol frames, tests only; schemaval = tool/elicitation schemas, in the binary.

Out of scope: any change to ListTools, CallTool, Client.answer, codegen, or the daemon; enforcement of any kind; format assertion.

Acceptance

• Defining tests pass: (a) 2020-12 keyword corpus incl. prefixItems, unevaluatedProperties, boolean schemas, $defs internal refs; (b) declared draft-07 schema compiles and validates per draft-07; (c) unsupported $schema dialect → UnsupportedDialect error, distinct from a generic compile error; (d) unresolvable $ref → compile error; (e) schema with a remote $ref → compile error and zero HTTP requests observed by a counting test server; (f) integer 9007199254740993 (2^53+1) validates as integer and fails a maximum: 9007199254740992 check correctly; (g) a value violating a nested required/type rule returns the path-qualified error form.
• go.mod gains exactly one new direct dependency; internal/mcpspec is untouched and TestNotImportedByBinary still passes.
• Dialect document exists in pkgs/mcpx/docs/ stating supported dialects, the no-network rule, and formats-as-annotations.
• Full suite passes: cd pkgs/mcpx && go test ./... (via CI on the PR per fleet policy).

agent-note:v1 — filed by the repo design architect (dedicated code job, pass 3, 2026-10-27) as a sub-issue of design #1481. Filed as task/triage: triage confirms scope against current main (package name, schema-size bound) and enqueues the implementation packet; do not implement in the triage task.