[NOD-003] Node/Core contract parity and package gate

[mrnicholasbcarter-code]

User story

Make cross-language contract drift a CI failure.

Problem and target state

The current audit identifies a gap that blocks the policy-first, ecosystem-neutral Verdict control plane. Implement the smallest coherent slice described here; preserve existing behavior outside this boundary.

Scope and likely files

tests/, scripts/verify-package.mjs, package.json, .github/workflows/

Acceptance criteria

• Node validates Core fixtures; unknown fields, secret rejection, error categories, envelope hashes, and verification receipts match; clean consumer install/typecheck/pack tests pass; CI matrix reports schema diffs.

Dependencies and references

Depends on VER-001, VER-003, and NOD-002; relates to verdict-node#9.

Verification plan

• Add or update fixtures at the contract boundary.
• Test success, denial, degraded, unavailable, timeout, and malformed-input paths where applicable.
• Demonstrate that advisory learning/retrieval/provider data cannot weaken hard policy.

Required implementation evidence

• Targeted unit tests and negative-path tests
• Integration/conformance test at the relevant repository boundary
• Security/privacy review for any boundary, persistence, provider, or execution change
• Documentation and migration notes updated
• git diff --check and repository verification commands pass
• Evidence receipt or reproducible test artifact linked in the implementation PR

Definition of done

• Contract and implementation are versioned and backwards-compatibility impact is documented
• Failure, timeout, stale-provider, unknown, and denial states are explicit
• No learning, retrieval, UI, or external provider can bypass Core eligibility or envelope enforcement
• Reviewers can reproduce the acceptance evidence from a clean checkout

[mrnicholasbcarter-code]

Implemented in PR #24; merged after Analyze, clean-install, and lint passed.

[mrnicholasbcarter-code]

Completed via PR #24 (merge ). Added clean-consumer canonical contract strictness guard: required routing shape accepted, unknown top-level fields rejected. CI passed.

[mrnicholasbcarter-code]

Evidence correction: PR #24 merged as bdc964d. Added clean-consumer canonical contract strictness guard: required routing shape accepted, unknown top-level fields rejected. CI passed.