fix(stats): bind telemetry port schema admission

[8Dionysus]

What Changed

• Land the reviewed exact authored candidate 15e96f2aa66a00de3e3b67a33340a230520584f6 from merge base 88ff38b1b38eef939f2c5b4541cbe8363a05fc8d.
• Close the direct validation-telemetry forged-empty owner-port admission bypass with canonical, content-bound port-schema validation and typed admission binding.
• Add the required deterministic owner-family reconciliation commit ddea6a24422cdf285fa7ea9633a13192cd9e10ab: pinned aoa-kag portable-family manifest/shards plus its accepted changed-generated-bytes budget receipt.

Why

The authored candidate makes omitted, forged-empty, stale, changed-content, and legacy caller-supplied port findings fail closed while preserving the direct no-filesystem admission boundary and the derived-only stats authority ceiling. The generated refresh is required because the pinned repo-local KAG CI action detected candidate-caused owner-family drift; origin/main passed the same sentinel before the repair.

Validation

• Independent exact-head review handoff for the authored candidate SHA256: eaca7437823637b31d4a10e45d867fab81b485f377c8761649cd8c5e702855a9; verdict pass with no material findings.
• Exact pinned KAG owner-family DAG after reconciliation: sentinel, full-parity, family-contract, and compatibility-assembly all passed; family digest 8f69b138938499a089d3a697a4adf51a56c05ba958f679327f875f9aec689af2.
• Focused telemetry tests: 48 passed; source-home/mechanics/docs route tests: 48 passed.
• scripts/validate_stats_protocol.py, validate_stats_source_home.py, validate_mechanics_topology.py, validate_nested_agents.py --fail-on-untracked, decision index/record checks, and Agon registry checks: passed.
• Pinned scripts/build_views.py --check and scripts/validate_repo.py: passed against clean 8Dionysus@3baafa395906e93dee23a9479ef4f9aed576bd8a.
• Full scripts/release_check.py: passed; 547 passed, 694 subtests passed.

Boundary/Direction Impact

• Authored stats families: measurement_contract and federation; no mechanic package route changed.
• Reconciliation is generated-only under kag/indexes/ plus one owner-family budget receipt; no new authored meaning, receipt-envelope shape, live watcher, runtime, or deployment behavior.
• Owner-local metric truth, live freshness, runtime/deployment health, semantic Goal acceptance, and owner/human acceptance remain outside this candidate.

Risk/Follow-ups

• Required GitHub Repo Validation replacement check is authoritative and must complete before merge.
• Post-merge current-main convergence will verify the squash result, ancestry, clean source worktree, and the same bounded gates.
• No release tag or live watcher/runtime change is included.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 15e96f2aa6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".