Spec v0.3 and mock receiver: remove HTTP Basic and 429, require ts on escalation events

[ciopulse]

Documentation corrections to spec v0.3 and the reference mock receiver. The wire contract and its version are unchanged; the forwarder's sending behaviour is untouched.

Spec (docs/send-a-copy-spec-v0.3.md)

• Auth is X-API-Key only. HTTP Basic was cut from the endpoint scope on 28 Aug 2026 and never implemented; the forwarder has only ever sent X-API-Key.
• 429 is no longer a documented response, because no ciopulse endpoint returns it. Senders are still told to treat any 429 as retryable with backoff.
• Voice requires contract_version "0.2" or later. The forwarder sends voice on 0.3, which the old wording made look non-conformant.
• A dated corrections note in the header. Status line and version footer unchanged.

Mock receiver (tools/mock-receiver/mock_ingest.py)

• HTTP Basic removed from _authed(), the docstring and the 401 hint, so the reference can no longer certify a request the real endpoint rejects.
• escalation_to_human now requires an ISO ts, with a field-level error naming the actor fallback that depends on it. Any other event's ts must be ISO when present; other event types still need only type.
• Comment at STATE: the real endpoint keys idempotency on (tenant, session_id); this single-key mock cannot model that.

Also

• README contract reference: stops listing a 429 response, matching the spec.
• CHANGELOG [Unreleased] → Fixed.
• Three tests: Basic auth gets a 401; an escalation event without ts, or with a non-ISO ts, gets a field-level 400; other event types still pass with only type. 54 tests pass locally.

Note: the mock is stricter by design. An escalation_to_human event without ts, accepted before, now gets a 400. The forwarder has always sent ts.

🤖 Generated with Claude Code