Close architecture contracts D1–D5 (#675)

[mberrys]

What changed

Closes the 0.3.0 architecture decisions in #675 as contract closure and proof (not a rebuild of governed execution). Adds ADR-011, docs/CANONICAL_JSON.md, governed-execution proof lanes, canonical JSON golden vectors, and UnitTestsGovernedExecution cases for D1–D5. Dispositions #656 as out of the D5 equality contract (plan/governed identity, not independent PDF writer bytes). Does not touch #674.

Release changelog

changes/cursor-arch-contracts-d1-d5-63c7.md

Proof

• python scripts/agent/check-change.py --base origin/dev reports pass (proof head ff7b76563119980390e1a4cd0737e904007e6fac; tip d8741c4373a82fbf4b455367aac2ed917a61031b)
• One changes/cursor-arch-contracts-d1-d5-63c7.md fragment added (Category, Audience, Breaking-Change, Summary)
• Changed behaviour has a test that fails without the change (UnitTestsGovernedExecution D1–D5 cases + golden digests)
• Protected-path or contract change named above, with the reason it is required

No protected path is in the diff (LoopLibCore/**, docs/schemas/**, and UnitTests/CMakeLists.txt untouched). Contracts live under architecture/, docs, fixtures, and existing test TU.

check-change pass excerpt

Internal logic (touched behavior-bearing code)

• Guard clauses handle invalid, stale, cancelled, absent, unauthorized, and terminal cases before the happy path
• Untrusted input is parsed once at the boundary into trusted typed or domain state, with no repeated checks downstream
• Invalid state stops before partial mutation or publication and returns a descriptive error or result
• Names carry the domain intent, and comments explain rationale rather than restating the code

Anti-slop pass

• Redundant or explanatory comments that do not match the file's style removed
• Abnormal defensive checks and broad try/catch blocks removed where a trusted upstream boundary already guarantees the invariant, with real boundary and safety checks kept
• No any or equivalent cast added only to suppress a type error
• Python imports stay at file scope unless a local import is required
• Generated boilerplate, needless wrappers, and local-style drift removed
• Validation, security, cancellation, provenance, and failure handling preserved

Anti-slop summary (1-3 sentences):

Extended existing governed-execution tests instead of adding a parallel harness. Documented Qt Compact / scalar-root exceptions beside RFC 8785 key order rather than changing digest encodings. Deferred the pre-existing UnitTestsImageDecodeGuard catalog gap instead of inventing a fake ownership lane.

Security and rollback

• Untrusted input validated at the trust boundary; no new unsafe construct without an inline justification
• Rollback: revert d8741c4373a82fbf4b455367aac2ed917a61031b. No persistence format or public ABI changes.

Docs

• Docs updated in this PR (docs/adr/adr-011-architecture-contracts-d1-d5.md, docs/CANONICAL_JSON.md, docs/GOVERNED_EXECUTION.md)

Self-review (BSP-002 §4.3)

• Reviewed in the diff view, not the editor, at least 30 minutes after the final commit; overnight if the change touches security-sensitive code, data handling, or public API surface

Refs #675. Refs #638 (architecture gate). Refs #656 (D5 disposition only).

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}