audit-tools 0.28.1 → 0.28.3

package/dist/audit/types/auditState.js

@@ -1,2 +1,25 @@
-export {};
+import { z } from "zod";
+import { ObligationSchema } from "audit-tools/shared";
+export const AuditTopLevelStatusSchema = z.enum([
+    "not_started",
+    "active",
+    "blocked",
+    "complete",
+]);
+export const AuditObligationSchema = ObligationSchema;
+export const AuditStateSchema = z
+    .object({
+    status: AuditTopLevelStatusSchema,
+    last_executor: z.string().optional(),
+    last_obligation: z.string().optional(),
+    blockers: z.array(z.string()).optional(),
+    obligations: z.array(AuditObligationSchema),
+    /**
+     * Set when the rolling dispatch engine fires a partial-completion terminal
+     * (empty pool or livelock). Allows synthesis to proceed on partial coverage
+     * without hard-gating on `audit_tasks_completed`.
+     */
+    partial_coverage_terminal: z.boolean().optional(),
+})
+    .strict();
 //# sourceMappingURL=auditState.js.map

package/dist/audit/types/auditState.js.map

@@ -1 +1 @@
-{"version":3,"file":"auditState.js","sourceRoot":"","sources":["../../../src/audit/types/auditState.ts"],"names":[],"mappings":""}
+{"version":3,"file":"auditState.js","sourceRoot":"","sources":["../../../src/audit/types/auditState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC9C,aAAa;IACb,QAAQ;IACR,SAAS;IACT,UAAU;CACX,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAGtD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,MAAM,EAAE,yBAAyB;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC3C;;;;OAIG;IACH,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClD,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/audit/types/flowCoverage.d.ts

@@ -1,16 +1,73 @@
+import { z } from "zod";
 export declare const FLOW_COVERAGE_STATUSES: readonly ["pending", "partial", "complete"];
-export type FlowCoverageStatus = (typeof FLOW_COVERAGE_STATUSES)[number];
+export declare const FlowCoverageStatusSchema: z.ZodEnum<["pending", "partial", "complete"]>;
+export type FlowCoverageStatus = z.infer<typeof FlowCoverageStatusSchema>;
 /** Coverage for one critical flow across the lenses the audit expects to see. */
-export interface FlowCoverageRecord {
+export declare const FlowCoverageRecordSchema: z.ZodObject<{
+    flow_id: z.ZodString;
+    paths: z.ZodArray<z.ZodString, "many">;
+    required_lenses: z.ZodArray<z.ZodString, "many">;
+    completed_lenses: z.ZodArray<z.ZodString, "many">;
+    status: z.ZodEnum<["pending", "partial", "complete"]>;
+    notes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+}, "strict", z.ZodTypeAny, {
+    status: "partial" | "complete" | "pending";
+    paths: string[];
+    required_lenses: string[];
+    completed_lenses: string[];
     flow_id: string;
+    notes?: string[] | undefined;
+}, {
+    status: "partial" | "complete" | "pending";
     paths: string[];
     required_lenses: string[];
     completed_lenses: string[];
-    status: FlowCoverageStatus;
-    notes?: string[];
-}
+    flow_id: string;
+    notes?: string[] | undefined;
+}>;
+export type FlowCoverageRecord = z.infer<typeof FlowCoverageRecordSchema>;
 /** Aggregated flow coverage written beside the critical flow manifest. */
-export interface FlowCoverageManifest {
-    flows: FlowCoverageRecord[];
-}
+export declare const FlowCoverageManifestSchema: z.ZodObject<{
+    flows: z.ZodArray<z.ZodObject<{
+        flow_id: z.ZodString;
+        paths: z.ZodArray<z.ZodString, "many">;
+        required_lenses: z.ZodArray<z.ZodString, "many">;
+        completed_lenses: z.ZodArray<z.ZodString, "many">;
+        status: z.ZodEnum<["pending", "partial", "complete"]>;
+        notes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        status: "partial" | "complete" | "pending";
+        paths: string[];
+        required_lenses: string[];
+        completed_lenses: string[];
+        flow_id: string;
+        notes?: string[] | undefined;
+    }, {
+        status: "partial" | "complete" | "pending";
+        paths: string[];
+        required_lenses: string[];
+        completed_lenses: string[];
+        flow_id: string;
+        notes?: string[] | undefined;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    flows: {
+        status: "partial" | "complete" | "pending";
+        paths: string[];
+        required_lenses: string[];
+        completed_lenses: string[];
+        flow_id: string;
+        notes?: string[] | undefined;
+    }[];
+}, {
+    flows: {
+        status: "partial" | "complete" | "pending";
+        paths: string[];
+        required_lenses: string[];
+        completed_lenses: string[];
+        flow_id: string;
+        notes?: string[] | undefined;
+    }[];
+}>;
+export type FlowCoverageManifest = z.infer<typeof FlowCoverageManifestSchema>;
 //# sourceMappingURL=flowCoverage.d.ts.map

package/dist/audit/types/flowCoverage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flowCoverage.d.ts","sourceRoot":"","sources":["../../../src/audit/types/flowCoverage.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,sBAAsB,6CAIzB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC7B"}
+{"version":3,"file":"flowCoverage.d.ts","sourceRoot":"","sources":["../../../src/audit/types/flowCoverage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,sBAAsB,6CAIzB,CAAC;AACX,eAAO,MAAM,wBAAwB,+CAAiC,CAAC;AACvE,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,iFAAiF;AACjF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;EAW1B,CAAC;AACZ,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,0EAA0E;AAC1E,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC"}

package/dist/audit/types/flowCoverage.js

@@ -1,6 +1,27 @@
+import { z } from "zod";
 export const FLOW_COVERAGE_STATUSES = [
     "pending",
     "partial",
     "complete",
 ];
+export const FlowCoverageStatusSchema = z.enum(FLOW_COVERAGE_STATUSES);
+/** Coverage for one critical flow across the lenses the audit expects to see. */
+export const FlowCoverageRecordSchema = z
+    .object({
+    flow_id: z.string(),
+    paths: z.array(z.string()),
+    // Producer emits custom lens names too, so these stay free strings (the old
+    // JSON schema's canonical-lens $ref was over-strict).
+    required_lenses: z.array(z.string()),
+    completed_lenses: z.array(z.string()),
+    status: FlowCoverageStatusSchema,
+    notes: z.array(z.string()).optional(),
+})
+    .strict();
+/** Aggregated flow coverage written beside the critical flow manifest. */
+export const FlowCoverageManifestSchema = z
+    .object({
+    flows: z.array(FlowCoverageRecordSchema),
+})
+    .strict();
 //# sourceMappingURL=flowCoverage.js.map

package/dist/audit/types/flowCoverage.js.map

@@ -1 +1 @@
-{"version":3,"file":"flowCoverage.js","sourceRoot":"","sources":["../../../src/audit/types/flowCoverage.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,SAAS;IACT,SAAS;IACT,UAAU;CACF,CAAC"}
+{"version":3,"file":"flowCoverage.js","sourceRoot":"","sources":["../../../src/audit/types/flowCoverage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,SAAS;IACT,SAAS;IACT,UAAU;CACF,CAAC;AACX,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;AAGvE,iFAAiF;AACjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,4EAA4E;IAC5E,sDAAsD;IACtD,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,EAAE,wBAAwB;IAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,0EAA0E;AAC1E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/audit/types/reviewPlanning.d.ts

@@ -127,6 +127,7 @@ export declare const ReviewPacketSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     unit_ids: string[];
     rationale: string;
+    lenses: string[];
     file_paths: string[];
     file_line_counts: Record<string, number>;
     priority: "high" | "low" | "medium";
@@ -134,7 +135,6 @@ export declare const ReviewPacketSchema: z.ZodObject<{
     packet_id: string;
     task_ids: string[];
     pass_ids: string[];
-    lenses: string[];
     quality: {
         cohesion_score: number;
         internal_edge_count: number;
@@ -156,6 +156,7 @@ export declare const ReviewPacketSchema: z.ZodObject<{
 }, {
     unit_ids: string[];
     rationale: string;
+    lenses: string[];
     file_paths: string[];
     file_line_counts: Record<string, number>;
     priority: "high" | "low" | "medium";
@@ -163,7 +164,6 @@ export declare const ReviewPacketSchema: z.ZodObject<{
     packet_id: string;
     task_ids: string[];
     pass_ids: string[];
-    lenses: string[];
     quality: {
         cohesion_score: number;
         internal_edge_count: number;

package/dist/audit/types.d.ts

@@ -323,6 +323,7 @@ export declare const AuditTaskSchema: z.ZodObject<{
     pass_id: string;
     file_paths: string[];
     status?: "complete" | "pending" | undefined;
+    completed_at?: string | undefined;
     file_line_counts?: Record<string, number> | undefined;
     line_ranges?: {
         path: string;
@@ -334,7 +335,6 @@ export declare const AuditTaskSchema: z.ZodObject<{
     token_estimate?: number | undefined;
     risk_estimate?: number | undefined;
     tags?: string[] | undefined;
-    completed_at?: string | undefined;
     completion_reason?: string | undefined;
 }, {
     unit_id: string;
@@ -344,6 +344,7 @@ export declare const AuditTaskSchema: z.ZodObject<{
     pass_id: string;
     file_paths: string[];
     status?: "complete" | "pending" | undefined;
+    completed_at?: string | undefined;
     file_line_counts?: Record<string, number> | undefined;
     line_ranges?: {
         path: string;
@@ -355,7 +356,6 @@ export declare const AuditTaskSchema: z.ZodObject<{
     token_estimate?: number | undefined;
     risk_estimate?: number | undefined;
     tags?: string[] | undefined;
-    completed_at?: string | undefined;
     completion_reason?: string | undefined;
 }>;
 export type AuditTask = z.infer<typeof AuditTaskSchema>;
@@ -416,6 +416,7 @@ export declare const AuditVerificationSchema: z.ZodObject<{
         pass_id: string;
         file_paths: string[];
         status?: "complete" | "pending" | undefined;
+        completed_at?: string | undefined;
         file_line_counts?: Record<string, number> | undefined;
         line_ranges?: {
             path: string;
@@ -427,7 +428,6 @@ export declare const AuditVerificationSchema: z.ZodObject<{
         token_estimate?: number | undefined;
         risk_estimate?: number | undefined;
         tags?: string[] | undefined;
-        completed_at?: string | undefined;
         completion_reason?: string | undefined;
     }, {
         unit_id: string;
@@ -437,6 +437,7 @@ export declare const AuditVerificationSchema: z.ZodObject<{
         pass_id: string;
         file_paths: string[];
         status?: "complete" | "pending" | undefined;
+        completed_at?: string | undefined;
         file_line_counts?: Record<string, number> | undefined;
         line_ranges?: {
             path: string;
@@ -448,7 +449,6 @@ export declare const AuditVerificationSchema: z.ZodObject<{
         token_estimate?: number | undefined;
         risk_estimate?: number | undefined;
         tags?: string[] | undefined;
-        completed_at?: string | undefined;
         completion_reason?: string | undefined;
     }>, "many">>;
 }, "strip", z.ZodTypeAny, {
@@ -465,6 +465,7 @@ export declare const AuditVerificationSchema: z.ZodObject<{
         pass_id: string;
         file_paths: string[];
         status?: "complete" | "pending" | undefined;
+        completed_at?: string | undefined;
         file_line_counts?: Record<string, number> | undefined;
         line_ranges?: {
             path: string;
@@ -476,7 +477,6 @@ export declare const AuditVerificationSchema: z.ZodObject<{
         token_estimate?: number | undefined;
         risk_estimate?: number | undefined;
         tags?: string[] | undefined;
-        completed_at?: string | undefined;
         completion_reason?: string | undefined;
     }[] | undefined;
 }, {
@@ -493,6 +493,7 @@ export declare const AuditVerificationSchema: z.ZodObject<{
         pass_id: string;
         file_paths: string[];
         status?: "complete" | "pending" | undefined;
+        completed_at?: string | undefined;
         file_line_counts?: Record<string, number> | undefined;
         line_ranges?: {
             path: string;
@@ -504,7 +505,6 @@ export declare const AuditVerificationSchema: z.ZodObject<{
         token_estimate?: number | undefined;
         risk_estimate?: number | undefined;
         tags?: string[] | undefined;
-        completed_at?: string | undefined;
         completion_reason?: string | undefined;
     }[] | undefined;
 }>;
@@ -794,6 +794,7 @@ export declare const AuditResultSchema: z.ZodObject<{
             pass_id: string;
             file_paths: string[];
             status?: "complete" | "pending" | undefined;
+            completed_at?: string | undefined;
             file_line_counts?: Record<string, number> | undefined;
             line_ranges?: {
                 path: string;
@@ -805,7 +806,6 @@ export declare const AuditResultSchema: z.ZodObject<{
             token_estimate?: number | undefined;
             risk_estimate?: number | undefined;
             tags?: string[] | undefined;
-            completed_at?: string | undefined;
             completion_reason?: string | undefined;
         }, {
             unit_id: string;
@@ -815,6 +815,7 @@ export declare const AuditResultSchema: z.ZodObject<{
             pass_id: string;
             file_paths: string[];
             status?: "complete" | "pending" | undefined;
+            completed_at?: string | undefined;
             file_line_counts?: Record<string, number> | undefined;
             line_ranges?: {
                 path: string;
@@ -826,7 +827,6 @@ export declare const AuditResultSchema: z.ZodObject<{
             token_estimate?: number | undefined;
             risk_estimate?: number | undefined;
             tags?: string[] | undefined;
-            completed_at?: string | undefined;
             completion_reason?: string | undefined;
         }>, "many">>;
     }, "strip", z.ZodTypeAny, {
@@ -843,6 +843,7 @@ export declare const AuditResultSchema: z.ZodObject<{
             pass_id: string;
             file_paths: string[];
             status?: "complete" | "pending" | undefined;
+            completed_at?: string | undefined;
             file_line_counts?: Record<string, number> | undefined;
             line_ranges?: {
                 path: string;
@@ -854,7 +855,6 @@ export declare const AuditResultSchema: z.ZodObject<{
             token_estimate?: number | undefined;
             risk_estimate?: number | undefined;
             tags?: string[] | undefined;
-            completed_at?: string | undefined;
             completion_reason?: string | undefined;
         }[] | undefined;
     }, {
@@ -871,6 +871,7 @@ export declare const AuditResultSchema: z.ZodObject<{
             pass_id: string;
             file_paths: string[];
             status?: "complete" | "pending" | undefined;
+            completed_at?: string | undefined;
             file_line_counts?: Record<string, number> | undefined;
             line_ranges?: {
                 path: string;
@@ -882,7 +883,6 @@ export declare const AuditResultSchema: z.ZodObject<{
             token_estimate?: number | undefined;
             risk_estimate?: number | undefined;
             tags?: string[] | undefined;
-            completed_at?: string | undefined;
             completion_reason?: string | undefined;
         }[] | undefined;
     }>>;
@@ -960,6 +960,7 @@ export declare const AuditResultSchema: z.ZodObject<{
             pass_id: string;
             file_paths: string[];
             status?: "complete" | "pending" | undefined;
+            completed_at?: string | undefined;
             file_line_counts?: Record<string, number> | undefined;
             line_ranges?: {
                 path: string;
@@ -971,7 +972,6 @@ export declare const AuditResultSchema: z.ZodObject<{
             token_estimate?: number | undefined;
             risk_estimate?: number | undefined;
             tags?: string[] | undefined;
-            completed_at?: string | undefined;
             completion_reason?: string | undefined;
         }[] | undefined;
     } | undefined;
@@ -1052,6 +1052,7 @@ export declare const AuditResultSchema: z.ZodObject<{
             pass_id: string;
             file_paths: string[];
             status?: "complete" | "pending" | undefined;
+            completed_at?: string | undefined;
             file_line_counts?: Record<string, number> | undefined;
             line_ranges?: {
                 path: string;
@@ -1063,7 +1064,6 @@ export declare const AuditResultSchema: z.ZodObject<{
             token_estimate?: number | undefined;
             risk_estimate?: number | undefined;
             tags?: string[] | undefined;
-            completed_at?: string | undefined;
             completion_reason?: string | undefined;
         }[] | undefined;
     } | undefined;

package/dist/remediate/contractPipeline/artifactStore.d.ts

@@ -17,6 +17,13 @@ export interface ContractPipelineArtifactEnvelope {
     dependency_hashes: Partial<Record<ContractPipelineArtifactName, string>>;
     payload: unknown;
 }
+/**
+ * Canonical predicate for a stored content-hash envelope. Single-sourced here so
+ * any consumer (the contract-pipeline ingest path, the `validate-artifact` CLI)
+ * unwraps with identical structural rules and cannot drift. A plain payload that
+ * happens to carry an `artifact_name` but no `content_hash` is NOT an envelope.
+ */
+export declare function isEnvelope(value: unknown): value is ContractPipelineArtifactEnvelope;
 export declare function contractPipelineDir(artifactsDir: string): string;
 /**
  * Path to the optional Path-A seed file. Present only when the intake source

package/dist/remediate/contractPipeline/artifactStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifactStore.d.ts","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/artifactStore.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,iBAAiB,mWAgBpB,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAM9E,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,4BAA4B,EAAE,4BAA4B,EAAE,CAiC/F,CAAC;AAIF,MAAM,WAAW,gCAAgC;IAC/C,aAAa,EAAE,4BAA4B,CAAC;IAC5C,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,OAAO,EAAE,OAAO,CAAC;CAClB;AAID,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,GACjC,MAAM,CAER;AAiBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,gCAAgC,GACzC,MAAM,CAKR;AAID,wEAAwE;AACxE,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,EAClC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gCAAgC,CAAC,CAyB3C;AAED,0DAA0D;AAC1D,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAMlD;AAED,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,KAAK,EAAE,4BAA4B,EAAE,CAAC;IACtC,gEAAgE;IAChE,MAAM,EAAE,4BAA4B,EAAE,CAAC;CACxC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,CAAC,CAqD1B;AAED,8DAA8D;AAC9D,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAET"}
+{"version":3,"file":"artifactStore.d.ts","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/artifactStore.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,iBAAiB,mWAgBpB,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAM9E,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,4BAA4B,EAAE,4BAA4B,EAAE,CAiC/F,CAAC;AAIF,MAAM,WAAW,gCAAgC;IAC/C,aAAa,EAAE,4BAA4B,CAAC;IAC5C,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,gCAAgC,CAO3C;AAID,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,GACjC,MAAM,CAER;AAiBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,gCAAgC,GACzC,MAAM,CAKR;AAID,wEAAwE;AACxE,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,EAClC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,gCAAgC,CAAC,CAyB3C;AAED,0DAA0D;AAC1D,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAMlD;AAED,MAAM,WAAW,eAAe;IAC9B,uFAAuF;IACvF,KAAK,EAAE,4BAA4B,EAAE,CAAC;IACtC,gEAAgE;IAChE,MAAM,EAAE,4BAA4B,EAAE,CAAC;CACxC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,eAAe,CAAC,CAqD1B;AAED,8DAA8D;AAC9D,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,4BAA4B,GACjC,OAAO,CAET"}

package/dist/remediate/contractPipeline/artifactStore.js

@@ -12,7 +12,7 @@
 import { existsSync } from "node:fs";
 import { mkdir } from "node:fs/promises";
 import { join } from "node:path";
-import { hashContent, readOptionalJsonFile, writeJsonFile } from "audit-tools/shared";
+import { hashContent, isRecord, readOptionalJsonFile, writeJsonFile } from "audit-tools/shared";
 import { semanticProjection, stableStringifyProjection, } from "./semanticProjection.js";
 // ── Artifact names ────────────────────────────────────────────────────────────
 export const CP_ARTIFACT_NAMES = [
@@ -69,6 +69,18 @@ export const DEPENDENCY_MAP = {
         "implementation_dag",
     ],
 };
+/**
+ * Canonical predicate for a stored content-hash envelope. Single-sourced here so
+ * any consumer (the contract-pipeline ingest path, the `validate-artifact` CLI)
+ * unwraps with identical structural rules and cannot drift. A plain payload that
+ * happens to carry an `artifact_name` but no `content_hash` is NOT an envelope.
+ */
+export function isEnvelope(value) {
+    return (isRecord(value) &&
+        typeof value.artifact_name === "string" &&
+        typeof value.content_hash === "string" &&
+        "payload" in value);
+}
 // ── Helpers ───────────────────────────────────────────────────────────────────
 export function contractPipelineDir(artifactsDir) {
     return join(artifactsDir, "intake", "contract");

package/dist/remediate/contractPipeline/artifactStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifactStore.js","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/artifactStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AAEjC,iFAAiF;AAEjF,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW;IACX,gBAAgB;IAChB,sBAAsB;IACtB,kBAAkB;IAClB,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,mBAAmB;IACnB,wBAAwB;IACxB,qBAAqB;IACrB,4BAA4B;IAC5B,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,qBAAqB;CACb,CAAC;AAIX,iFAAiF;AACjF,wEAAwE;AACxE,sDAAsD;AAEtD,MAAM,CAAC,MAAM,cAAc,GAAyE;IAClG,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,CAAC,WAAW,CAAC;IAC7B,oBAAoB,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACrD,gBAAgB,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,sBAAsB,CAAC;IACzE,0BAA0B,EAAE,CAAC,sBAAsB,EAAE,kBAAkB,CAAC;IACxE,0BAA0B,EAAE,CAAC,kBAAkB,EAAE,4BAA4B,CAAC;IAC9E,0BAA0B,EAAE,CAAC,WAAW,EAAE,4BAA4B,CAAC;IACvE,iBAAiB,EAAE,CAAC,WAAW,EAAE,4BAA4B,CAAC;IAC9D,sBAAsB,EAAE,CAAC,mBAAmB,CAAC;IAC7C,mBAAmB,EAAE,CAAC,WAAW,EAAE,mBAAmB,CAAC;IACvD,0BAA0B,EAAE,CAAC,WAAW,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,qBAAqB,CAAC;IAC7I,cAAc,EAAE,CAAC,WAAW,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,4BAA4B,CAAC;IAC/J,YAAY,EAAE,CAAC,WAAW,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,gBAAgB,CAAC;IAC/K,kBAAkB,EAAE;QAClB,WAAW;QACX,gBAAgB;QAChB,4BAA4B;QAC5B,mBAAmB;QACnB,wBAAwB;QACxB,qBAAqB;QACrB,4BAA4B;QAC5B,gBAAgB;QAChB,cAAc;KACf;IACD,mBAAmB,EAAE;QACnB,WAAW;QACX,gBAAgB;QAChB,4BAA4B;QAC5B,mBAAmB;QACnB,4BAA4B;QAC5B,oBAAoB;KACrB;CACF,CAAC;AAqBF,iFAAiF;AAEjF,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,OAAO,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,OAAO,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,YAAoB,EACpB,IAAkC;IAElC,OAAO,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,kFAAkF;AAClF,SAAS,mBAAmB,CAC1B,IAAkC,EAClC,OAAgB;IAEhB,OAAO,WAAW,CAChB,yBAAyB,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAC5D,EAAE,MAAM,EAAE,EAAE,EAAE,CACf,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAA0C;IAE1C,OAAO,CACL,QAAQ,CAAC,aAAa;QACtB,mBAAmB,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,IAAkC,EAClC,OAAgB;IAEhB,MAAM,KAAK,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAEzD,+EAA+E;IAC/E,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,iBAAiB,GAA0D,EAAE,CAAC;IACpF,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,WAAW,EAAE,CAAC;YAChB,iBAAiB,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAqC;QACjD,aAAa,EAAE,IAAI;QACnB,YAAY;QACZ,aAAa;QACb,iBAAiB;QACjB,OAAO;KACR,CAAC;IACF,MAAM,aAAa,CAAC,wBAAwB,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,IAAkC;IAElC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACzC,wBAAwB,CAAC,YAAY,EAAE,IAAI,CAAC,CAC7C,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB;IAEpB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEvD,oEAAoE;IACpE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyE,CAAC;IACnG,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QAED,mCAAmC;QACnC,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,8CAA8C;gBAC9C,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChB,MAAM;YACR,CAAC;YACD,MAAM,YAAY,GAAG,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,YAAY,KAAK,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,OAAO,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClD,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAChB,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;QACjB,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC;KACpB,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,IAAkC;IAElC,OAAO,UAAU,CAAC,wBAAwB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;AAClE,CAAC"}
+{"version":3,"file":"artifactStore.js","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/artifactStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAChG,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AAEjC,iFAAiF;AAEjF,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,WAAW;IACX,gBAAgB;IAChB,sBAAsB;IACtB,kBAAkB;IAClB,4BAA4B;IAC5B,4BAA4B;IAC5B,4BAA4B;IAC5B,mBAAmB;IACnB,wBAAwB;IACxB,qBAAqB;IACrB,4BAA4B;IAC5B,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,qBAAqB;CACb,CAAC;AAIX,iFAAiF;AACjF,wEAAwE;AACxE,sDAAsD;AAEtD,MAAM,CAAC,MAAM,cAAc,GAAyE;IAClG,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,CAAC,WAAW,CAAC;IAC7B,oBAAoB,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACrD,gBAAgB,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,sBAAsB,CAAC;IACzE,0BAA0B,EAAE,CAAC,sBAAsB,EAAE,kBAAkB,CAAC;IACxE,0BAA0B,EAAE,CAAC,kBAAkB,EAAE,4BAA4B,CAAC;IAC9E,0BAA0B,EAAE,CAAC,WAAW,EAAE,4BAA4B,CAAC;IACvE,iBAAiB,EAAE,CAAC,WAAW,EAAE,4BAA4B,CAAC;IAC9D,sBAAsB,EAAE,CAAC,mBAAmB,CAAC;IAC7C,mBAAmB,EAAE,CAAC,WAAW,EAAE,mBAAmB,CAAC;IACvD,0BAA0B,EAAE,CAAC,WAAW,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,qBAAqB,CAAC;IAC7I,cAAc,EAAE,CAAC,WAAW,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,4BAA4B,CAAC;IAC/J,YAAY,EAAE,CAAC,WAAW,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,gBAAgB,CAAC;IAC/K,kBAAkB,EAAE;QAClB,WAAW;QACX,gBAAgB;QAChB,4BAA4B;QAC5B,mBAAmB;QACnB,wBAAwB;QACxB,qBAAqB;QACrB,4BAA4B;QAC5B,gBAAgB;QAChB,cAAc;KACf;IACD,mBAAmB,EAAE;QACnB,WAAW;QACX,gBAAgB;QAChB,4BAA4B;QAC5B,mBAAmB;QACnB,4BAA4B;QAC5B,oBAAoB;KACrB;CACF,CAAC;AAqBF;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,KAAc;IAEd,OAAO,CACL,QAAQ,CAAC,KAAK,CAAC;QACf,OAAO,KAAK,CAAC,aAAa,KAAK,QAAQ;QACvC,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,SAAS,IAAI,KAAK,CACnB,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,OAAO,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,OAAO,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,YAAoB,EACpB,IAAkC;IAElC,OAAO,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,kFAAkF;AAClF,SAAS,mBAAmB,CAC1B,IAAkC,EAClC,OAAgB;IAEhB,OAAO,WAAW,CAChB,yBAAyB,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,EAC5D,EAAE,MAAM,EAAE,EAAE,EAAE,CACf,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAA0C;IAE1C,OAAO,CACL,QAAQ,CAAC,aAAa;QACtB,mBAAmB,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,YAAoB,EACpB,IAAkC,EAClC,OAAgB;IAEhB,MAAM,KAAK,CAAC,mBAAmB,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAEzD,+EAA+E;IAC/E,4EAA4E;IAC5E,mDAAmD;IACnD,MAAM,iBAAiB,GAA0D,EAAE,CAAC;IACpF,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAClE,IAAI,WAAW,EAAE,CAAC;YAChB,iBAAiB,CAAC,GAAG,CAAC,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAqC;QACjD,aAAa,EAAE,IAAI;QACnB,YAAY;QACZ,aAAa;QACb,iBAAiB;QACjB,OAAO;KACR,CAAC;IACF,MAAM,aAAa,CAAC,wBAAwB,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,IAAkC;IAElC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACzC,wBAAwB,CAAC,YAAY,EAAE,IAAI,CAAC,CAC7C,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AASD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB;IAEpB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEvD,oEAAoE;IACpE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyE,CAAC;IACnG,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,oBAAoB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QAED,mCAAmC;QACnC,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,8CAA8C;gBAC9C,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChB,MAAM;YACR,CAAC;YACD,MAAM,YAAY,GAAG,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACrD,IAAI,YAAY,KAAK,oBAAoB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAChB,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,OAAO,EAAE,CAAC;QACf,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClD,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACtC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAChB,OAAO,GAAG,IAAI,CAAC;oBACf,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;QACjB,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC;KACpB,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,IAAkC;IAElC,OAAO,UAAU,CAAC,wBAAwB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/remediate/contractPipeline/semanticProjection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"semanticProjection.d.ts","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/semanticProjection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAY,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAiDrC;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,4BAA4B,EAClC,OAAO,EAAE,OAAO,GACf,OAAO,CAmBT;AAED;;;;;GAKG"}
+{"version":3,"file":"semanticProjection.d.ts","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/semanticProjection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAY,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAEvE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAmErC;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,4BAA4B,EAClC,OAAO,EAAE,OAAO,GACf,OAAO,CAsBT;AAED;;;;;GAKG"}

package/dist/remediate/contractPipeline/semanticProjection.js

@@ -63,6 +63,26 @@ function projectModuleContract(value) {
     }
     return out;
 }
+/**
+ * Collapse cosmetic whitespace in every projected string (trim + runs → single
+ * space), recursively. A reflow / trailing-space / indentation edit to a contract
+ * field is not a semantic change, but without this it churns the projection hash
+ * and re-stales the downstream chain. Safe: the downstream gates/derivers match on
+ * word boundaries and substrings, which whitespace normalization never alters.
+ */
+function normalizeWhitespaceDeep(value) {
+    if (typeof value === "string")
+        return value.replace(/\s+/g, " ").trim();
+    if (Array.isArray(value))
+        return value.map(normalizeWhitespaceDeep);
+    if (isRecord(value)) {
+        const out = {};
+        for (const [key, v] of Object.entries(value))
+            out[key] = normalizeWhitespaceDeep(v);
+        return out;
+    }
+    return value;
+}
 /**
  * Project a contract-pipeline artifact payload to only its load-bearing
  * structure for downstream-staleness purposes. The universal provenance strip
@@ -77,21 +97,23 @@ export function semanticProjection(name, payload) {
     if (!isRecord(payload))
         return payload;
     const stripped = stripFields(payload, UNIVERSAL_NON_SEMANTIC_FIELDS);
-    if (name === "finalized_module_contracts") {
-        // Keep every top-level field (contract_version, goal_id, …) but narrow each
-        // module entry to its derivable fields, so a reworded per-module rationale /
-        // seam-prose edit projects identically while a changed interface / new
-        // invariant does not. Narrowing entries (not the whole artifact) keeps the
-        // projection conservative: any top-level field a downstream might read still
-        // participates in staleness.
-        if (!Array.isArray(stripped.module_contracts))
-            return stripped;
-        return {
-            ...stripped,
-            module_contracts: stripped.module_contracts.map(projectModuleContract),
-        };
+    // Both the intermediate `module_contracts` and the `finalized_module_contracts`
+    // carry the same module-entry shape; narrow each entry to its derivable fields for
+    // BOTH so a reworded per-module rationale / a tweaked non-derivable array
+    // (side_effects / seam_adjustments / neighbor_needs) projects identically while a
+    // changed interface / new invariant does not. Keep every top-level field
+    // (contract_version, goal_id, …): the narrowing is per-entry, so any top-level
+    // field a downstream might read still participates in staleness.
+    if (name === "finalized_module_contracts" || name === "module_contracts") {
+        if (Array.isArray(stripped.module_contracts)) {
+            return normalizeWhitespaceDeep({
+                ...stripped,
+                module_contracts: stripped.module_contracts.map(projectModuleContract),
+            });
+        }
+        return normalizeWhitespaceDeep(stripped);
     }
-    return stripped;
+    return normalizeWhitespaceDeep(stripped);
 }
 /**
  * The order-independent stable serialization used to hash a projection is the

package/dist/remediate/contractPipeline/semanticProjection.js.map

@@ -1 +1 @@
-{"version":3,"file":"semanticProjection.js","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/semanticProjection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAGzE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAsB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AAExF;;;;;;;;;GASG;AACH,MAAM,gCAAgC,GAAsB;IAC1D,MAAM;IACN,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,eAAe;IACf,qBAAqB;CACtB,CAAC;AAEF,SAAS,WAAW,CAClB,MAA+B,EAC/B,MAAyB;IAEzB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,gCAAgC,EAAE,CAAC;QACrD,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAkC,EAClC,OAAgB;IAEhB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IAErE,IAAI,IAAI,KAAK,4BAA4B,EAAE,CAAC;QAC1C,4EAA4E;QAC5E,6EAA6E;QAC7E,uEAAuE;QACvE,2EAA2E;QAC3E,6EAA6E;QAC7E,6BAA6B;QAC7B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC/D,OAAO;YACL,GAAG,QAAQ;YACX,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,qBAAqB,CAAC;SACvE,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG"}
+{"version":3,"file":"semanticProjection.js","sourceRoot":"","sources":["../../../src/remediate/contractPipeline/semanticProjection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAGzE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC;;;;;;GAMG;AACH,MAAM,6BAA6B,GAAsB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AAExF;;;;;;;;;GASG;AACH,MAAM,gCAAgC,GAAsB;IAC1D,MAAM;IACN,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,eAAe;IACf,qBAAqB;CACtB,CAAC;AAEF,SAAS,WAAW,CAClB,MAA+B,EAC/B,MAAyB;IAEzB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,gCAAgC,EAAE,CAAC;QACrD,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACpE,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAC;QACpF,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAkC,EAClC,OAAgB;IAEhB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACvC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IAErE,gFAAgF;IAChF,mFAAmF;IACnF,0EAA0E;IAC1E,kFAAkF;IAClF,yEAAyE;IACzE,+EAA+E;IAC/E,iEAAiE;IACjE,IAAI,IAAI,KAAK,4BAA4B,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACzE,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC7C,OAAO,uBAAuB,CAAC;gBAC7B,GAAG,QAAQ;gBACX,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,qBAAqB,CAAC;aACvE,CAAC,CAAC;QACL,CAAC;QACD,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG"}

package/dist/remediate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/remediate/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAoDjD,QAAA,MAAM,OAAO,SAAgB,CAAC;AA2R9B,OAAO,EAAE,OAAO,EAAE,CAAC;AAEnB;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAEjD;AAUD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAU/E;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,MAAM,GACvB,MAAM,CAuBR;AAYD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,MAAM,CAIR;AAED,wBAAgB,kBAAkB,CAChC,IAAI,GAAE;IACJ,GAAG,CAAC,EAAE,OAAO,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B,GACL,MAAM,CAcR;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAkB,EACxC,OAAO,SAAY,GAClB,IAAI,CAQN;AA4FD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,OAAO,EACd,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAkB,EACxC,OAAO,SAAY,EACnB,IAAI,SAAgB,GACnB,IAAI,CA4EN"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/remediate/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAqDjD,QAAA,MAAM,OAAO,SAAgB,CAAC;AA+R9B,OAAO,EAAE,OAAO,EAAE,CAAC;AAEnB;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAEjD;AAUD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAU/E;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,MAAM,GACvB,MAAM,CAuBR;AAYD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GACnB,MAAM,CAIR;AAED,wBAAgB,kBAAkB,CAChC,IAAI,GAAE;IACJ,GAAG,CAAC,EAAE,OAAO,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B,GACL,MAAM,CAcR;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,EACd,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAkB,EACxC,OAAO,SAAY,GAClB,IAAI,CAQN;AA4FD,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,OAAO,EACd,GAAG,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAkB,EACxC,OAAO,SAAY,EACnB,IAAI,SAAgB,GACnB,IAAI,CA4EN"}

package/dist/remediate/index.js

@@ -10,7 +10,7 @@ import { mergeImplementResults, prepareImplementDispatch, } from "./steps/dispat
 import { advanceHostRolling } from "./steps/rollingSession.js";
 import { validateArtifacts } from "./validation/artifacts.js";
 import { CONTRACT_PIPELINE_VALIDATORS } from "./validation/contractPipeline.js";
-import { CP_ARTIFACT_NAMES, } from "./contractPipeline/artifactStore.js";
+import { CP_ARTIFACT_NAMES, isEnvelope, } from "./contractPipeline/artifactStore.js";
 import { setQuotaStateDir, parseHostModelRoster, remediationArtifactsDir, mergeOpenCodeAgentPermissionRule, mergeOpenCodeGlobalPermissionRule, migrateOpenCodeGlobalExternalDirectory, withoutOpenCodeWildcard, } from "audit-tools/shared";
 // src/remediate/index.ts (source) or dist/remediate/index.js (built) → three
 // dirnames up is the package root, holding package.json + skills/ + opencode.json.
@@ -178,14 +178,18 @@ program
         console.log(JSON.stringify({ status: "error", message: `Could not read artifact input: ${err.message}` }, null, 2));
         process.exit(2);
     }
-    let payload;
+    let parsed;
     try {
-        payload = JSON.parse(raw);
+        parsed = JSON.parse(raw);
     }
     catch (err) {
         console.log(JSON.stringify({ status: "error", message: `Artifact is not valid JSON: ${err.message}` }, null, 2));
         process.exit(2);
     }
+    // Unwrap a stored content-hash envelope so the bare payload is validated
+    // against its contract; a plain payload validates as-is. Uses the canonical
+    // isEnvelope predicate so CLI self-check and ingest unwrap identically.
+    const payload = isEnvelope(parsed) ? parsed.payload : parsed;
     const issues = validator(payload, name);
     const errors = issues.filter((issue) => issue.severity === "error");
     console.log(JSON.stringify({