[DMC-001] Strictly validate inputs and fail closed when evidence is unusable #1

Priority: P0
Labels: bug, correctness, agent-contract, release-blocker, dmcheck
Confidence: 100%
Solution confidence: 96%

Evidence

• Missing GM reaches an error object, then CLI counting raises KeyError: rule and exits 1.
• Watch emits repeated errors, then open_count: 0, exit 0.
• Empty transcript and configured-GM-absent input can return clean.
• Zero-compatible/zero-eligible input and rules_enabled=["R99"] can return clean.
• content: 42, non-object charter, missing lint path, and fractional message thresholds traceback.
• Invalid timestamps silently disable time checks; string aliases can become character aliases.
• README documents seat_quiet_gm_beats, but lint-charter rejects it; checkout/package also contain duplicate defaults whose selected copy can differ by execution context.

Scope / specification

Create one normalization and semantic-validation layer for run, craft, file/stdin watch, MCP, and direct API. Publish charter and transcript/event schemas. Require integer message thresholds (booleans excluded), finite nonnegative durations, known rule IDs, nonempty GM/aliases/hidden terms, typed authors/content/timestamps, and an explicit closed/live evaluation mode. Define one canonical packaged default charter with schema, version, and digest.

Acceptance criteria

• Invalid input returns EvaluationResult.status=invalid, exit 2, stable error codes/JSON pointers, and no traceback.
• Empty/all-dropped/zero-compatible/zero-eligible where evidence is required/zero-effective-GM input is incomplete, never clean, in closed mode.
• Invalid timestamps are rejected or counted as skipped with affected rules disclosed.
• File, stdin, MCP, and API normalize identically with explicit UTF-8/timezone handling.
• Error objects never enter finding-count code.
• Charter docs/defaults/schema/runtime accept exactly the same fields.
• One generated packaged default is authoritative; checkout and wheel select the same resource, and semantic default changes require a schema/version migration.
• Malformed or zero-effective craft input is non-authoritative, not clean.

Required tests

Table/property tests for null/list/string objects, numeric/boolean boundaries, missing GM, absent observed GM, empty, malformed row, non-string content, timestamp forms, alias collisions, unknown rules, and every input transport. Assert no traceback and correct status/exit.

Dependencies: the repo-local fail-closed patch has no portfolio dependency and should land immediately; migrate its envelope to PORT-001 when available.