@litfamily/litopencode 1.0.0

package/skills/visual-qa/schemas/evidence-manifest-v1beta1.json

@@ -0,0 +1,141 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "litfamily.evidence-manifest/v1beta1",
+  "title": "LitFamily material Evidence Manifest v1beta1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_id", "design_contract_hash", "source_revision", "tier", "created_at",
+    "maximum_age_seconds", "freshness", "capabilities", "captures", "inventory",
+    "mechanical_checks", "accessibility_checks", "tui_checks", "review_receipt_hashes",
+    "findings", "exception_references", "cleanup", "verdict"
+  ],
+  "properties": {
+    "schema_id": { "const": "litfamily.evidence-manifest/v1beta1" },
+    "design_contract_hash": { "$ref": "#/$defs/hash" },
+    "source_revision": { "$ref": "#/$defs/text" },
+    "tier": { "enum": ["smoke", "full", "reference-fidelity"] },
+    "created_at": { "type": "string", "format": "date-time" },
+    "maximum_age_seconds": { "type": "number", "minimum": 1, "maximum": 86400 },
+    "freshness": {
+      "type": "object", "additionalProperties": false,
+      "required": ["assessed_at", "expires_at", "fresh", "contract_hash_match", "source_hash_match", "capture_hash_match"],
+      "properties": {
+        "assessed_at": { "type": "string", "format": "date-time" },
+        "expires_at": { "type": "string", "format": "date-time" },
+        "fresh": { "type": "boolean" },
+        "contract_hash_match": { "type": "boolean" },
+        "source_hash_match": { "type": "boolean" },
+        "capture_hash_match": { "type": "boolean" }
+      }
+    },
+    "capabilities": {
+      "type": "object", "additionalProperties": false,
+      "required": ["capture", "auth", "test_account_safe", "independent_review"],
+      "properties": {
+        "capture": { "type": "boolean" }, "auth": { "type": "boolean" },
+        "test_account_safe": { "type": "boolean" }, "independent_review": { "type": "boolean" }
+      }
+    },
+    "captures": {
+      "type": "array", "minItems": 1, "maxItems": 10000,
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": [
+          "capture_id", "source_hash", "capture_hash", "created_at", "viewport", "dpr", "os",
+          "runtime", "runtime_version", "font_set", "locale", "reduced_motion", "animation_settling",
+          "color_scheme", "auth_owner", "process_owner", "path", "byte_length", "width", "height"
+        ],
+        "properties": {
+          "capture_id": { "$ref": "#/$defs/text" },
+          "source_hash": { "$ref": "#/$defs/hash" },
+          "capture_hash": { "$ref": "#/$defs/hash" },
+          "created_at": { "type": "string", "format": "date-time" },
+          "viewport": { "$ref": "#/$defs/text" },
+          "dpr": { "type": "number", "exclusiveMinimum": 0, "maximum": 8 },
+          "os": { "$ref": "#/$defs/text" },
+          "runtime": { "$ref": "#/$defs/text" },
+          "runtime_version": { "$ref": "#/$defs/text" },
+          "font_set": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/text" } },
+          "locale": { "$ref": "#/$defs/text" },
+          "reduced_motion": { "type": "boolean" },
+          "animation_settling": { "$ref": "#/$defs/text" },
+          "color_scheme": { "$ref": "#/$defs/text" },
+          "auth_owner": { "$ref": "#/$defs/text" },
+          "process_owner": { "$ref": "#/$defs/text" },
+          "path": { "$ref": "#/$defs/materialPath" },
+          "byte_length": { "type": "integer", "minimum": 1, "maximum": 26214400 },
+          "width": { "type": "integer", "minimum": 1, "maximum": 16384 },
+          "height": { "type": "integer", "minimum": 1, "maximum": 16384 }
+        }
+      }
+    },
+    "inventory": {
+      "type": "array", "minItems": 1, "maxItems": 10000,
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": ["id", "kind", "status", "exception_id", "evidence_path", "evidence_hash"],
+        "properties": {
+          "id": { "$ref": "#/$defs/text" },
+          "kind": { "$ref": "#/$defs/text" },
+          "status": { "enum": ["captured", "not_applicable", "accepted_exception", "blocked"] },
+          "exception_id": { "type": ["string", "null"], "minLength": 1, "maxLength": 4096 },
+          "evidence_path": { "$ref": "#/$defs/materialPath" },
+          "evidence_hash": { "$ref": "#/$defs/hash" }
+        },
+        "allOf": [{
+          "if": { "properties": { "status": { "const": "accepted_exception" } } },
+          "then": { "properties": { "exception_id": { "$ref": "#/$defs/text" } } },
+          "else": { "properties": { "exception_id": { "type": "null" } } }
+        }]
+      }
+    },
+    "mechanical_checks": { "$ref": "#/$defs/checks" },
+    "accessibility_checks": { "$ref": "#/$defs/checks" },
+    "tui_checks": { "$ref": "#/$defs/checks" },
+    "review_receipt_hashes": { "type": "array", "maxItems": 2, "uniqueItems": true, "items": { "$ref": "#/$defs/hash" } },
+    "findings": {
+      "type": "array", "maxItems": 10000,
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": ["code", "severity", "evidence"],
+        "properties": {
+          "code": { "$ref": "#/$defs/text" },
+          "severity": { "enum": ["critical", "high", "medium", "low", "info"] },
+          "evidence": { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/hash" } }
+        }
+      }
+    },
+    "exception_references": { "type": "array", "maxItems": 10000, "uniqueItems": true, "items": { "$ref": "#/$defs/text" } },
+    "cleanup": {
+      "type": "object", "additionalProperties": false,
+      "required": ["owned_processes_stopped", "temporary_artifacts_removed", "remaining"],
+      "properties": {
+        "owned_processes_stopped": { "type": "boolean" },
+        "temporary_artifacts_removed": { "type": "boolean" },
+        "remaining": { "type": "array", "maxItems": 1000, "items": { "$ref": "#/$defs/text" } }
+      }
+    },
+    "verdict": { "enum": ["PASS", "REVISE", "FAIL", "BLOCKED"] }
+  },
+  "$defs": {
+    "text": { "type": "string", "minLength": 1, "maxLength": 4096 },
+    "hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "materialPath": { "type": "string", "minLength": 1, "maxLength": 4096, "pattern": "^(?![A-Za-z]:)(?!/)(?!.*\\\\)[^/\\r\\n]+$" },
+    "channel": { "enum": ["tests", "browser", "keyboard", "accessibility-tree", "screen-reader", "performance", "localization"] },
+    "checks": {
+      "type": "array", "minItems": 1, "maxItems": 10000,
+      "items": {
+        "type": "object", "additionalProperties": false,
+        "required": ["id", "status", "evidence_path", "evidence_hash", "channel"],
+        "properties": {
+          "id": { "$ref": "#/$defs/text" },
+          "status": { "enum": ["pass", "fail", "blocked", "not_applicable"] },
+          "evidence_path": { "$ref": "#/$defs/materialPath" },
+          "evidence_hash": { "$ref": "#/$defs/hash" },
+          "channel": { "$ref": "#/$defs/channel" }
+        }
+      }
+    }
+  }
+}

package/skills/visual-qa/schemas/review-receipt-v1alpha1.json

@@ -0,0 +1,113 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "litfamily.review-receipt/v1alpha1",
+  "title": "LitFamily Review Receipt v1alpha1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_id",
+    "review_id",
+    "reviewer_id",
+    "fresh_context_id",
+    "reviewer_capability_class",
+    "input_hashes",
+    "reviewed_inventory",
+    "findings",
+    "confidence",
+    "independence_assertion",
+    "started_at",
+    "ended_at",
+    "timeout_seconds",
+    "timed_out",
+    "cancelled",
+    "cancellation_reason",
+    "round",
+    "verdict"
+  ],
+  "properties": {
+    "schema_id": { "const": "litfamily.review-receipt/v1alpha1" },
+    "review_id": { "$ref": "#/$defs/text" },
+    "reviewer_id": { "$ref": "#/$defs/text" },
+    "fresh_context_id": { "$ref": "#/$defs/text" },
+    "reviewer_capability_class": { "$ref": "#/$defs/text" },
+    "input_hashes": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["design_contract", "evidence_manifest", "source", "capture"],
+      "properties": {
+        "design_contract": { "$ref": "#/$defs/hash" },
+        "evidence_manifest": { "$ref": "#/$defs/hash" },
+        "source": { "$ref": "#/$defs/hash" },
+        "capture": { "$ref": "#/$defs/hash" }
+      }
+    },
+    "reviewed_inventory": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 10000,
+      "uniqueItems": true,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "kind", "status"],
+        "properties": {
+          "id": { "$ref": "#/$defs/text" },
+          "kind": { "$ref": "#/$defs/text" },
+          "status": { "enum": ["captured", "not_applicable", "accepted_exception", "blocked"] }
+        }
+      }
+    },
+    "findings": {
+      "type": "array",
+      "maxItems": 10000,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["code", "severity", "evidence_pointers", "message"],
+        "properties": {
+          "code": { "$ref": "#/$defs/text" },
+          "severity": { "enum": ["critical", "high", "medium", "low", "info"] },
+          "evidence_pointers": {
+            "type": "array",
+            "minItems": 1,
+            "uniqueItems": true,
+            "items": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": ["path", "hash"],
+              "properties": {
+                "path": { "$ref": "#/$defs/text" },
+                "hash": { "$ref": "#/$defs/hash" }
+              }
+            }
+          },
+          "message": { "$ref": "#/$defs/text" }
+        }
+      }
+    },
+    "confidence": { "type": "number", "minimum": 0, "maximum": 1 },
+    "independence_assertion": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["fresh_context", "same_immutable_inputs", "other_draft_received", "other_verdict_received"],
+      "properties": {
+        "fresh_context": { "const": true },
+        "same_immutable_inputs": { "const": true },
+        "other_draft_received": { "const": false },
+        "other_verdict_received": { "const": false }
+      }
+    },
+    "started_at": { "type": "string", "format": "date-time" },
+    "ended_at": { "type": "string", "format": "date-time" },
+    "timeout_seconds": { "type": "number", "exclusiveMinimum": 0, "maximum": 3600 },
+    "timed_out": { "type": "boolean" },
+    "cancelled": { "type": "boolean" },
+    "cancellation_reason": { "type": ["string", "null"] },
+    "round": { "type": "integer", "minimum": 1, "maximum": 2 },
+    "verdict": { "enum": ["PASS", "REVISE", "FAIL", "BLOCKED"] }
+  },
+  "$defs": {
+    "text": { "type": "string", "minLength": 1, "maxLength": 4096 },
+    "hash": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" }
+  }
+}

package/skills/visual-qa/scripts/artifact.mjs

@@ -0,0 +1,123 @@
+import { canonicalJson } from "./canonical-json.mjs";
+
+const sha256Pattern = /^sha256:[a-f0-9]{64}$/u;
+
+function finding(code, evidence) {
+  return { code, evidence, severity: "high" };
+}
+
+function finiteBox(box) {
+  return (
+    box !== null &&
+    typeof box === "object" &&
+    ["left", "top", "right", "bottom"].every((key) => Number.isFinite(box[key]))
+  );
+}
+
+export function inspectUiArtifact(input) {
+  if (input === null || typeof input !== "object" || Array.isArray(input)) {
+    throw new TypeError("UI artifact input must be an object");
+  }
+  const findings = [];
+  if (input.kind === "accessibility-tree") {
+    if (!Array.isArray(input.nodes)) throw new Error("accessibility-tree nodes must be an array");
+    for (const node of input.nodes) {
+      if (
+        ["button", "link", "checkbox"].includes(node?.role) &&
+        (typeof node.name !== "string" || node.name.trim().length === 0)
+      ) findings.push(finding("WCAG_LABEL_MISSING", { node_id: node?.id }));
+    }
+  } else if (input.kind === "chart-bounds") {
+    if (!finiteBox(input.plot) || !Array.isArray(input.series)) throw new Error("chart bounds are invalid");
+    for (const series of input.series) {
+      if (
+        !finiteBox(series) ||
+        series.left < input.plot.left ||
+        series.top < input.plot.top ||
+        series.right > input.plot.right ||
+        series.bottom > input.plot.bottom
+      ) findings.push(finding("VISUAL_DATA_CLIPPED", { series_id: series?.id }));
+    }
+  } else if (input.kind === "target-sizes") {
+    if (!Number.isFinite(input.minimum) || !Array.isArray(input.targets)) throw new Error("target sizes are invalid");
+    for (const target of input.targets) {
+      if (
+        !Number.isFinite(target?.width) ||
+        !Number.isFinite(target?.height) ||
+        target.width < input.minimum ||
+        target.height < input.minimum
+      ) findings.push(finding("WCAG_TARGET_SIZE", { target_id: target?.id }));
+    }
+  } else if (input.kind === "responsive-bounds") {
+    if (!Number.isFinite(input.viewport_width) || !Array.isArray(input.content)) {
+      throw new Error("responsive bounds are invalid");
+    }
+    for (const item of input.content) {
+      if (
+        !Number.isFinite(item?.left) ||
+        !Number.isFinite(item?.right) ||
+        item.left < 0 ||
+        item.right > input.viewport_width
+      ) findings.push(finding("RESPONSIVE_OVERFLOW", { content_id: item?.id }));
+    }
+  } else if (input.kind === "token-snapshot") {
+    if (input.expected === undefined || input.actual === undefined) throw new Error("token snapshots are required");
+    if (canonicalJson(input.expected) !== canonicalJson(input.actual)) {
+      findings.push(finding("DESIGN_TOKEN_DRIFT", { compared: true }));
+    }
+  } else if (input.kind === "public-accessibility") {
+    if (input.focus_visible !== true) findings.push(finding("WCAG_2_4_7_FOCUS_VISIBLE", {}));
+    if (
+      !Number.isFinite(input.contrast_ratio) ||
+      !Number.isFinite(input.required_contrast_ratio) ||
+      input.contrast_ratio < input.required_contrast_ratio
+    ) findings.push(finding("WCAG_1_4_3_CONTRAST_MINIMUM", {}));
+  } else if (input.kind === "chart-accessibility") {
+    if (input.color_only_encoding === true) findings.push(finding("CHART_COLOR_ONLY_ENCODING", {}));
+    if (typeof input.nonvisual_fallback !== "string" || input.nonvisual_fallback.trim() === "") {
+      findings.push(finding("CHART_NONVISUAL_FALLBACK_MISSING", {}));
+    }
+  } else if (input.kind === "healthcare-safety") {
+    if (input.destructive_confirmation !== true) {
+      findings.push(finding("DESTRUCTIVE_ACTION_CONFIRMATION_MISSING", {}));
+    }
+    if (
+      !Number.isFinite(input.minimum_target_size) ||
+      !Number.isFinite(input.target?.width) ||
+      !Number.isFinite(input.target?.height) ||
+      input.target.width < input.minimum_target_size ||
+      input.target.height < input.minimum_target_size
+    ) findings.push(finding("WCAG_2_5_8_TARGET_SIZE_MINIMUM", {}));
+  } else if (input.kind === "responsive-motion") {
+    if (
+      !Number.isFinite(input.content_right) ||
+      !Number.isFinite(input.viewport_width) ||
+      input.content_right > input.viewport_width
+    ) findings.push(finding("RESPONSIVE_OVERFLOW", {}));
+    if (input.reduced_motion_honored !== true) findings.push(finding("REDUCED_MOTION_NOT_HONORED", {}));
+  } else if (input.kind === "brownfield-system") {
+    if (input.token_reference_used !== true) findings.push(finding("DESIGN_TOKEN_BYPASS", {}));
+    if (!Array.isArray(input.primitives)) throw new Error("brownfield primitives must be an array");
+    const values = input.primitives.map((item) => canonicalJson(item?.value));
+    if (new Set(values).size !== values.length) findings.push(finding("DUPLICATE_PRIMITIVE", {}));
+  } else if (input.kind === "reference-fidelity") {
+    const validDimensions = (value) =>
+      Array.isArray(value) && value.length === 2 &&
+      value.every((dimension) => Number.isFinite(dimension) && dimension > 0);
+    if (!validDimensions(input.expected_dimensions) || !validDimensions(input.actual_dimensions)) {
+      throw new Error("reference dimensions must be finite positive width-height arrays");
+    }
+    if (!sha256Pattern.test(input.expected_hash) || !sha256Pattern.test(input.actual_hash)) {
+      throw new Error("reference hashes must be canonical sha256 identities");
+    }
+    if (canonicalJson(input.expected_dimensions) !== canonicalJson(input.actual_dimensions)) {
+      findings.push(finding("REFERENCE_DIMENSION_MISMATCH", {}));
+    }
+    if (input.expected_hash !== input.actual_hash) {
+      findings.push(finding("REFERENCE_SCREENSHOT_SUBSTITUTION", {}));
+    }
+  } else {
+    throw new Error(`Unknown UI artifact kind: ${String(input.kind)}`);
+  }
+  return { findings, verdict: findings.length === 0 ? "PASS" : "REVISE" };
+}

package/skills/visual-qa/scripts/bounded-json.mjs

@@ -0,0 +1,47 @@
+// Bounded, containment-checked JSON file reader owned by this skill. Evidence
+// manifests and review receipts arrive as untrusted bytes, so size, encoding,
+// symlink, device, and authorized-root checks all run before any parse.
+import fs from "node:fs/promises";
+import path from "node:path";
+import { parseStrictJson } from "./strict-json.mjs";
+
+const decoder = new TextDecoder("utf-8", { fatal: true });
+
+function inside(root, target) {
+  const relative = path.relative(root, target);
+  return relative === "" || (!relative.startsWith(`..${path.sep}`) && relative !== ".." && !path.isAbsolute(relative));
+}
+
+export function parseBoundedJson(buffer, { maxBytes = 1024 * 1024 } = {}) {
+  if (!Buffer.isBuffer(buffer)) throw new TypeError("JSON input must be a Buffer");
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) throw new Error("maxBytes must be a positive integer");
+  if (buffer.length > maxBytes) throw new Error(`JSON input size ${buffer.length} bytes exceeds ${maxBytes} bytes`);
+  let text;
+  try {
+    text = decoder.decode(buffer);
+  } catch {
+    throw new Error("JSON input is not valid UTF-8");
+  }
+  return parseStrictJson(text);
+}
+
+export async function readBoundedJsonFile(
+  filePath,
+  { authorizedRoot, maxBytes = 1024 * 1024, validate = (value) => value } = {}
+) {
+  if (typeof filePath !== "string" || filePath.length === 0) throw new Error("filePath is required");
+  if (typeof authorizedRoot !== "string" || authorizedRoot.length === 0) {
+    throw new Error("authorizedRoot is required");
+  }
+  const rootPath = path.resolve(authorizedRoot);
+  const requested = path.resolve(filePath);
+  if (!inside(rootPath, requested)) throw new Error("JSON path is outside the authorized root");
+  const root = await fs.realpath(rootPath);
+  const stat = await fs.lstat(requested);
+  if (stat.isSymbolicLink()) throw new Error("JSON path must not be a symlink");
+  if (!stat.isFile()) throw new Error("JSON path must be a regular file, not a device");
+  if (stat.size > maxBytes) throw new Error(`JSON file size ${stat.size} bytes exceeds ${maxBytes} bytes`);
+  const resolved = await fs.realpath(requested);
+  if (!inside(root, resolved)) throw new Error("Resolved JSON path is outside the authorized root");
+  return validate(parseBoundedJson(await fs.readFile(resolved), { maxBytes }));
+}

package/skills/visual-qa/scripts/canonical-json.mjs

@@ -0,0 +1,28 @@
+// Canonical byte form for every hash this skill computes, owned by this skill so
+// no evidence helper imports across a managed skill boundary.
+function normalize(value, seen) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new Error("Canonical JSON rejects non-finite numbers");
+    return value;
+  }
+  if (Array.isArray(value)) return value.map((entry) => normalize(entry, seen));
+  if (typeof value !== "object") throw new Error(`Canonical JSON rejects ${typeof value}`);
+  if (seen.has(value)) throw new Error("Canonical JSON rejects cyclic input");
+  seen.add(value);
+  const output = {};
+  for (const key of Object.keys(value).sort()) output[key] = normalize(value[key], seen);
+  seen.delete(value);
+  return output;
+}
+
+export function canonicalizeValue(value) {
+  return normalize(value, new Set());
+}
+
+// Canonical form: object keys sorted recursively, array order preserved, and the
+// document terminated by a single newline. Every hash in this system is taken
+// over that exact byte sequence, so the newline is part of the contract.
+export function canonicalJson(value) {
+  return `${JSON.stringify(canonicalizeValue(value))}\n`;
+}

package/skills/visual-qa/scripts/capabilities.mjs

@@ -0,0 +1,66 @@
+// Blocked and failed vocabulary for this skill.
+//
+// A BLOCKED code always names a capability that was absent, so the honest answer
+// is "this could not be checked". A FAIL code names a check that ran and rejected
+// the work. BLOCKED outranks FAIL: when a capability is missing there is no
+// completed judgement to report, so the absent capability is reported first.
+export const visualQaBlockedCodes = Object.freeze([
+  "BLOCKED_RELEASE_BOUNDARY_UNRESOLVED",
+  "BLOCKED_SOURCE_PROVENANCE_INVALID",
+  "BLOCKED_SCHEMA_OR_PAYLOAD_MISMATCH",
+  "BLOCKED_RENDERER_UNAVAILABLE",
+  "BLOCKED_AUTH_UNAVAILABLE",
+  "BLOCKED_TEST_ACCOUNT_UNSAFE",
+  "BLOCKED_RENDERER_OWNERSHIP_UNVERIFIED",
+  "BLOCKED_INDEPENDENT_REVIEW_UNAVAILABLE",
+  "BLOCKED_REVIEW_TIMEOUT",
+  "BLOCKED_REVIEW_CANCELLED",
+  "BLOCKED_REVIEW_RECONCILIATION",
+  "BLOCKED_INVENTORY_RECONCILIATION",
+  "BLOCKED_EXCEPTION_RECONCILIATION",
+  "BLOCKED_IMMUTABLE_INPUT_MISMATCH",
+  "BLOCKED_EVIDENCE_STALE",
+  "BLOCKED_EVIDENCE_FUTURE",
+  "BLOCKED_CLEANUP_INCOMPLETE"
+]);
+
+export const visualQaFailCodes = Object.freeze([
+  "FAIL_REVIEW_VERDICT",
+  "FAIL_REVIEW_GATING_FINDING"
+]);
+
+export function evaluateCapabilityBlocks(input = {}) {
+  const codes = [];
+  if (input.captureAvailable !== true) codes.push("BLOCKED_RENDERER_UNAVAILABLE");
+  if (input.authAvailable !== true) codes.push("BLOCKED_AUTH_UNAVAILABLE");
+  if (input.testAccountSafe !== true) codes.push("BLOCKED_TEST_ACCOUNT_UNSAFE");
+  if (input.independentReviewAvailable !== true) codes.push("BLOCKED_INDEPENDENT_REVIEW_UNAVAILABLE");
+  return {
+    codes,
+    verdict: codes.length === 0 ? "READY" : "BLOCKED"
+  };
+}
+
+// Renderer ownership is the gate in front of every reuse decision. A port that
+// answers, a familiar process name, or a configured backend is not identity, so
+// each element has to be proven for the current session and project before
+// evidence that renderer produced can be attributed to this run. An unproven
+// element is an absent capability, never a defect in the interface under review.
+export function evaluateRendererOwnership(input = {}) {
+  const text = (value) => typeof value === "string" && value.trim().length > 0;
+  const unproven = [];
+  if (!text(input.sessionId)) unproven.push("sessionId");
+  if (!text(input.projectRoot)) unproven.push("projectRoot");
+  if (!Number.isInteger(input.pid) || input.pid <= 0) unproven.push("pid");
+  if (!text(input.command)) unproven.push("command");
+  if (input.port !== undefined && !(Number.isInteger(input.port) && input.port > 0 && input.port <= 65535)) {
+    unproven.push("port");
+  }
+  if (input.sessionScoped !== true) unproven.push("sessionScoped");
+  const codes = unproven.length === 0 ? [] : ["BLOCKED_RENDERER_OWNERSHIP_UNVERIFIED"];
+  return {
+    codes,
+    unproven,
+    verdict: codes.length === 0 ? "READY" : "BLOCKED"
+  };
+}

package/skills/visual-qa/scripts/contract-text.mjs

@@ -0,0 +1,15 @@
+import { parseStrictJson } from "./strict-json.mjs";
+import { validateEvidenceManifest } from "./evidence.mjs";
+import { validateReviewReceipt } from "./review.mjs";
+
+export function validateEvidenceManifestText(text) {
+  const result = validateEvidenceManifest(parseStrictJson(text));
+  if (!result.valid) throw new Error(`Invalid Evidence Manifest: ${result.errors.join("; ")}`);
+  return result;
+}
+
+export function validateReviewReceiptText(text) {
+  const result = validateReviewReceipt(parseStrictJson(text));
+  if (!result.ok) throw new Error(`Invalid Review Receipt: ${result.errors.join("; ")}`);
+  return result;
+}