Build a versioned, machine-validated public contract

[RollNuts]

Summary

Turn the public integration surface into a versioned contract with one machine-readable source of truth for check states and webhook events.

Changes

• separate exact check_run.name (Veripsa) from human-facing titles;
• lock Heading to to success and reject impossible token/conclusion/ACK combinations;
• define the ACK snapshot as a 12-lowercase-hex opaque wire token;
• define clean Clear as check-only and clear coordination comments as Clear to land;
• add canonical check-state and webhook-event manifests, generated docs/Schemas/types, and parity tests;
• preserve the legacy raw webhook schema/path through the v1 compatibility window while adding an all-event normalized envelope;
• add positive and negative Schema fixtures, TypeScript compile tests, link checks, package validation, CI, changelog, compatibility, release, and truth-matrix documentation;
• version the contract independently as 1.0.0 without publishing Core internals.

Compatibility

Additive and corrective for consumers. Existing exported names and the legacy raw routing schema remain available as deprecated aliases/paths for the v1 compatibility window.

Validation

The branch materializer verifies the payload SHA-256, restores the reviewed tree, runs npm ci, Schema semantic validation, all positive/negative examples, TypeScript impossible-state tests, manifest/generated-file parity, link checks, and npm pack --dry-run, then removes its temporary payload/workflow before publishing the final branch tree.

Security / privacy

No Core source, SQL, scoring logic, heuristics, customer code, diffs, tokens, or proprietary identifiers are published.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.