Public Contract Runtime

TypeScript trust-boundary guards compile every canonical schema with Ajv 2020, strict mode, and standard format validation. JSON Schema is the single language-neutral source of truth; runtime code adds only cross-object invariants that JSON Schema cannot express, such as tenant and authorization binding, immutable release-policy-registry resolution, domain-family and competency-rubric ownership, review/link/lineage relationships, ontology sums, and raw-byte artifact hashes.

The guards reject unknown fields, malformed formats, non-basis-point quantities, conflated evidence axes, numeric fields emitted by evaluators, official 0.1 modes, public numeric profiles, uncalibrated research indices, unsafe concealed-control policy, and cross-tenant or cross-purpose scoring inputs. Run npm test and npm run typecheck locally.

Digests use RFC 8785 JSON Canonicalization Scheme. Arrays retain order in the general canonicalizer; the separately versioned scoring-input normalizer sorts only arrays declared as sets. Calculation and public artifacts record both method identifiers. The contract test also runs the real evaluator serializer through the public Ajv boundary for ordinary and quarantined observations. assertPublicProfile is structural validation; any issuance or publication boundary must additionally call assertProfileManifestBinding with the exact result, calculation manifest, and authorization context.