Add inactive GitHub forge normalizer payload

[yihanzhu]

What this adds

This lands the immutable GitHub forge normalizer payload for Roadmap item 4. The pure jq filter validates one caller-bound, untrusted change-request snapshot and returns a generic observation for ready, blocked, closed, merged, stale, incomplete, or unknown state.

Its instruction and config content references now use the exact public core v2 content-ID and media-type domain. Colon and slash IDs are rejected, media types are capped at 127 bytes, and accepted references are checked through the public schema.

Why this is payload-first

The earlier manifest pointed to a branch-parent package commit. That reference is unavailable in a shallow CI checkout and would not remain durable after squash delivery. This revision removes the manifest instead of weakening CI or fetching remote history.

After this payload merges, a later assembly PR can create the manifest against the durable payload commit on main and add default-set selection. This PR does not add a manifest, profile entry, default-set wiring, workflow change, or live adapter.

Safety boundary

The payload is inactive, offline, and unqualified. It does not call GitHub or a CLI, use credentials, change a repository or request, grant authority or qualification, or activate a profile. Provider metadata remains opaque data and cannot decide normalized state.

Exact scope

Base: c276b42
Head: 8c52943

The final diff has exactly six paths: README, RESTORE, the normalizer payload, two append-only restore entries, the strengthened focused test, and one exact schema-import guard entry. The unmerged manifest and its restore entry are absent.

Proof

• Focused payload suite: 45/45
• Portable-core schema: 47/47 owned rules, 141/141 direct, 13/13 routes, 8/8 registry, 39/39 guard, 8/8 numeric, 8/8 review accounting, 44/44 legacy accounting; failures 0
• Bash syntax and ShellCheck 0.11.0: passed
• Exact 127-byte acceptance, colon/slash/over-limit rejection, public-core reference validation, static jq, canonical repeat output, append-only manifest versus base, exact six paths, preserved history, and clean-state checks: passed

[cloudflare-workers-and-pages]

Deploying ystack with    Cloudflare Pages

Latest commit:	8c52943
Status:	✅  Deploy successful!
Preview URL:	https://b73169a8.fabrica-6yx.pages.dev
Branch Preview URL:	https://codex-default-github-forge-a.fabrica-6yx.pages.dev

View logs

[yihanzhu]

Codex reviewer (cross-vendor, read-only)

Reviewed-head: 8c52943
Reviewed-base: c276b42
reviewer: review_forge_payload_218 @ high

CLEAN — zero unresolved Important findings.

Bugs

• Instruction and config references match public core v2: exact fields, colon and slash exclusion, media-type syntax and 127-byte limit, and lowercase SHA-256.
• Tests cover the exact 127 boundary, colon, slash, 128-byte rejection, and public schema acceptance.
• State normalization, stale precedence, timestamps, completeness, ordered unique file facts, digests, and malformed or unknown handling are deterministic and fail closed.

Security

• Caller trust context remains separate from the untrusted snapshot.
• Provider metadata is opaque and cannot influence normalized state.
• Binding mismatches become stale before other classifications.
• Output stays inactive with authority none, qualification unavailable, and effects empty.
• No credential, network, command execution, write, merge, label, comment, activation, permission, or capability surface exists.

Compliance

• Exact six-path payload diff; local and remote head, base, and clean worktree match.
• No adapter manifest, profile/default-set wiring, workflow, constitution path, or live adapter was added.
• Restore manifest is append-only; schema guard adds only the exact focused-test import.
• Payload-first delivery correctly defers manifest assembly until this payload has a durable main commit.
• Required CI run 33649504425, check 100312614956, completed successfully from app 15368.
• Focused payload proof passed 45/45; portable schema groups passed with zero failures.

[yihanzhu]

Construction publish receipt

• reviewed head/base: 8c52943 / c276b42
• required CI: app 15368, check 100312614956, success
• independent review: comment 5512556226, zero unresolved Important
• squash merge/main and durable payload revision: 0e10634
• reviewed/merged tree: 9938cd9dca099d274f46903352b4d9582678bb25
• payload blob: feb4622bc4371dce337b1406062919ef2c2c5b49
• canonical receipt SHA-256: 9670bb3821afc46bd774d01e4f712bc8c56c90a69bb92326444c3768d0143030
• local main: clean and fast-forwarded
• manifest/default-set assembly: deferred until all four payload revisions are on main