Publication, diagnostics and permissions

Edit the XML and Lua source together. Save compiles a draft against the server's schema and checks its component vocabulary, bindings, handler contracts and form requirements. Publish the intended version after validation. The CoCoCo app displays the compiled version; it does not reinterpret XML or derive input types.

Compiler diagnostics identify the source, element or attribute and an editor range. Ranges count UTF-16 code units, including when the source contains emoji, entities or CRLF line endings. Fix the indicated source and save again. Generated block JSON is an execution artifact, not the supported authoring editor.

An AI assistant that authors workspaces over MCP should read the current schema, component specification and manual chapters before authoring. Use the source envelope accepted by the Workspace mutation; obtain exact mutation arguments from that schema. Version IDs matter: stale versions must not invoke newly published behavior by accident.

Workspace visibility and business-data authorization are separate checks. A user who can open a workspace may still lack permission to write contacts. Conditions, hidden values and disabled controls do not enforce server security. Review errors from both the workspace action and the underlying business mutation.

Unsupported conditional-form capabilities fail closed with an upgrade message. Do not work around that by removing capability metadata: doing so could turn a conditional transaction into a different payload. Update the CoCoCo app instead.

Workspaces are authored as XML and Lua in the editor. There is no visual builder, and editing the compiled JSON directly is not supported.

Reading an invalid-source example

This example is deliberately invalid: the compiler rejects its unknown child element.

<workspace id="invalid-example" title="Invalid example" role="Operations" xmlns:t="urn:cococo:dataxml">
  <unknown/>
</workspace>

Replace the unknown element with a supported component and satisfy that component's required attributes and child contracts before saving again.

Infrastructure as code

Sync the schema and iacGuides together. The synced folder includes the complete manual and every chapter under an edition-qualified filename, with local links. The generated component reference is the same contract used by the editor.

The writable Workspace artifact is source: a JSON transport envelope whose format is cococo-workspace-source/1, with sourceXML and serverLua strings. Supply the exact authored text, including an empty Lua string when unused. This format pins the source contract; the server owns AST construction and compilation. Do not submit compiled block JSON or generated AST. The definition output is an internal rendering contract marked computed for IaC, not deployable source.

Create submits source and optional distribution settings. Update replaces source when supplied and leaves it untouched when omitted. XML workspace IDs are stable; changing one requires a new workspace. An author reads the latest authored source, including an open draft, so planning does not compare a draft with stale published bytes. Reapplying identical published source does not create another draft. An explicit version-creation operation still creates an independent snapshot.

Publication remains explicit: publish the intended version ID. Updating source does not change what readers run until publication. Source read-back preserves XML/Lua strings exactly; JSON envelope key ordering is immaterial to IaC diffs. Only authors can retrieve source, including the Lua text. Ordinary workspace readers receive the published rendering contract and cannot retrieve source from workspace or version reads.

The schema names two source validators. The offline structural validator checks the envelope shape and format. The remote validator compiles XML and schema-derived forms, validates bounded Lua setup/exports, and checks compiled GraphQL and MagicQuery against the instance schema. It performs no business mutations. Dynamic GraphQL constructed inside a Lua function still needs checking with real data before you publish; source validation is not proof of its behavior or tenant permissions. Inspect which validators ran rather than interpreting offline success as complete validation.

What validation cannot prove

Validation does not prove live authorization, the correctness of GraphQL built dynamically inside Lua, or that the tenant has the data a panel expects. Display bindings must tolerate conditional fields that are absent at runtime. Compiler diagnostics stop at the first failure; fix that failure and save again. A successful compile is not a successful business transaction.

App compatibility

If a recently published Workspace cannot open, the CoCoCo app on that device may be older than the Workspace requires. An unknown component reports its type and asks for an updated app. An unknown conditional-form profile reports both the required profile and the profile the app supports. Ordinary malformed records still report schema errors. Updating the app resolves these messages; removing the capability from the Workspace would change its behavior instead.