json patch safety audit derived

{
  "input": {
    "body": {
      "patch": "[{\"op\":\"remove\",\"path\":\"/limits\"},{\"op\":\"replace\",\"path\":\"/replicas\",\"value\":\"three\"},{\"op\":\"replace\",\"path\":\"/limits/cpu\",\"value\":\"500m\"},{\"op\":\"add\",\"path\":\"/hosts/-\",\"value\":\"c.test\"},{\"op\":\"move\",\"from\":\"/hosts\",\"path\":\"/hosts/0\"},{\"op\":\"remove\",\"path\":\"/name\"}]",
      "document": "{\"name\":\"service\",\"replicas\":3,\"limits\":{\"cpu\":\"200m\",\"memory\":\"256Mi\"},\"hosts\":[\"a.test\",\"b.test\"]}",
      "protected_paths": [
        "/name"
      ]
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxFindings": 500,
        "maxJsonBytes": 1048576,
        "maxResources": 5000,
        "maxTextBytes": 262144,
        "maxEnvEntries": 2000,
        "maxPatchOperations": 1000
      },
      "passed": false,
      "complete": false,
      "findings": [
        {
          "code": "VALUE_REMOVED",
          "path": "/limits",
          "detail": "patch[0] removes /limits, which holds 2 member(s). A patch has no inverse, so this is not undone by re-applying.",
          "operation": "patch[0]"
        },
        {
          "code": "REPLACE_CHANGES_TYPE",
          "path": "/replicas",
          "detail": "patch[1] replaces /replicas, which is number, with string. Anything reading that path with a type expectation breaks.",
          "operation": "patch[1]"
        },
        {
          "code": "TARGET_DOES_NOT_EXIST",
          "path": "/limits/cpu",
          "detail": "patch[2] replaces /limits/cpu and nothing is there at this point in the sequence, so applying the patch fails.",
          "operation": "patch[2]"
        }
      ],
      "operations": [
        {
          "op": "remove",
          "path": "/limits",
          "operation": "patch[0]",
          "target_existed": true
        },
        {
          "op": "replace",
          "path": "/replicas",
          "operation": "patch[1]",
          "target_existed": true
        },
        {
          "op": "replace",
          "path": "/limits/cpu",
          "operation": "patch[2]",
          "target_existed": false
        }
      ],
      "request_id": "example-request",
      "service_id": "json_patch_safety_audit",
      "assumptions": [
        "The patch is applied to a copy as a sequence, so each operation is judged against the state it will actually see. Checking each one against the original document would miss the whole class of defect w...",
        "RFC 6902 requires the target of remove, replace, move and copy to exist, so a missing target is reported as the patch failing rather than as doing nothing.",
        "A fingerprint of the resulting document is returned so a caller can confirm the result matches what they expect without the result being echoed back."
      ],
      "limitations": [
        "The patch and the document supplied. Whether the resulting document is correct for its consumer is outside this.",
        "safe_to_apply is true only when every operation applies and none of them removes or retypes existing data."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [
        "NO_TEST_OPERATION: The patch contains no test operation, so it will apply to a document in any state. A test is how a patch refuses to apply to a document it was not written against."
      ],
      "finding_count": 6,
      "safe_to_apply": false,
      "operation_count": 6,
      "service_version": "1.0.0",
      "findings_by_code": {
        "VALUE_REMOVED": 2,
        "MOVE_INTO_ITSELF": 1,
        "REPLACE_CHANGES_TYPE": 1,
        "TARGET_DOES_NOT_EXIST": 1,
        "PROTECTED_PATH_MODIFIED": 1
      },
      "result_fingerprint": {
        "sha256": "86e5785b5a4b56dbd848528a323325b44ddf5611b267a762e971e7a84d3c1f8f"
      },
      "declares_test_operation": false,
      "destructive_operation_count": 3
    }
  }
}