fix(v2): enforce hardened M0 contracts

contracts/repository/v1/fixtures/valid-manifest.json

@@ -1 +1 @@
-{"aggregates":{"entry_count":2,"logical_bytes":5,"stored_bytes":5},"backup_id":"0198c57f-0000-7000-8000-000000000006","created_at":"2026-07-27T00:00:00Z","effective_mode":"full","encryption_key_id":null,"entries":[{"blob_digest":null,"link_target":null,"metadata_support":["mode","mtime_ns"],"mode":493,"mtime_ns":0,"path":"data","size":0,"type":"directory"},{"blob_digest":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","link_target":null,"metadata_support":["mode","mtime_ns"],"mode":420,"mtime_ns":0,"path":"data/hello.txt","size":5,"type":"file"}],"exclusion_policy":{"matcher":"gitignore","patterns":[],"version":1},"execution_id":"0198c57f-0000-7000-8000-000000000005","format_version":1,"job_id":"0198c57f-0000-7000-8000-000000000004","manifest_digest":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","repository_id":"0198c57f-0000-7000-8000-000000000001","requested_mode":"full","source_consistency":{"adapter":"local","captured_at":"2026-07-27T00:00:00Z"},"source_id":"0198c57f-0000-7000-8000-000000000003"}
+{"aggregates":{"entry_count":2,"logical_bytes":5,"stored_bytes":5},"backup_id":"0198c57f-0000-7000-8000-000000000006","created_at":"2026-07-27T00:00:00Z","effective_mode":"full","encryption_key_id":null,"entries":[{"blob_digest":null,"link_target":null,"metadata_support":["mode","mtime_ns"],"mode":493,"mtime_ns":0,"path":"data","size":0,"type":"directory"},{"blob_digest":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","link_target":null,"metadata_support":["mode","mtime_ns"],"mode":420,"mtime_ns":0,"path":"data/hello.txt","size":5,"type":"file"}],"exclusion_policy":{"matcher":"gitignore","patterns":[],"version":1},"execution_id":"0198c57f-0000-7000-8000-000000000005","format_version":1,"job_id":"0198c57f-0000-7000-8000-000000000004","manifest_digest":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","manifest_signature":{"algorithm":"ed25519","key_id":"manifest-signing-key-1","value":"cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"},"repository_id":"0198c57f-0000-7000-8000-000000000001","requested_mode":"full","source_consistency":{"adapter":"local","captured_at":"2026-07-27T00:00:00Z","evidence":{"snapshot":"stable"}},"source_id":"0198c57f-0000-7000-8000-000000000003"}

contracts/repository/v1/manifest.schema.json

@@ -7,19 +7,28 @@
   "required": [
     "format_version", "backup_id", "repository_id", "source_id", "job_id", "execution_id",
     "requested_mode", "effective_mode", "created_at", "source_consistency", "exclusion_policy",
-    "entries", "aggregates", "encryption_key_id", "manifest_digest"
+    "entries", "aggregates", "encryption_key_id", "manifest_digest", "manifest_signature"
   ],
   "properties": {
     "format_version": {"const": 1},
-    "backup_id": {"type": "string", "format": "uuid"},
-    "repository_id": {"type": "string", "format": "uuid"},
-    "source_id": {"type": "string", "format": "uuid"},
-    "job_id": {"type": "string", "format": "uuid"},
-    "execution_id": {"type": "string", "format": "uuid"},
+    "backup_id": {"$ref": "#/$defs/uuidv7"},
+    "repository_id": {"$ref": "#/$defs/uuidv7"},
+    "source_id": {"$ref": "#/$defs/uuidv7"},
+    "job_id": {"$ref": "#/$defs/uuidv7"},
+    "execution_id": {"$ref": "#/$defs/uuidv7"},
     "requested_mode": {"enum": ["full", "incremental"]},
     "effective_mode": {"enum": ["full", "incremental"]},
-    "created_at": {"type": "string", "format": "date-time"},
-    "source_consistency": {"type": "object"},
+    "created_at": {"type": "string", "format": "date-time", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]+)?Z$"},
+    "source_consistency": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["adapter", "captured_at", "evidence"],
+      "properties": {
+        "adapter": {"enum": ["local", "ssh", "postgresql", "mysql"]},
+        "captured_at": {"type": "string", "format": "date-time", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]+)?Z$"},
+        "evidence": {"type": "object"}
+      }
+    },
     "exclusion_policy": {
       "type": "object",
       "additionalProperties": false,
@@ -45,9 +54,24 @@
       }
     },
     "encryption_key_id": {"type": ["string", "null"]},
-    "manifest_digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"}
+    "manifest_digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+    "manifest_signature": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["algorithm", "key_id", "value"],
+      "properties": {
+        "algorithm": {"const": "ed25519"},
+        "key_id": {"type": "string", "minLength": 1},
+        "value": {"type": "string", "pattern": "^[0-9a-f]{128}$"}
+      }
+    }
   },
   "$defs": {
+    "uuidv7": {
+      "type": "string",
+      "format": "uuid",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
+    },
     "entry": {
       "type": "object",
       "additionalProperties": false,
@@ -61,7 +85,42 @@
         "mtime_ns": {"type": ["integer", "null"], "minimum": 0},
         "link_target": {"type": ["string", "null"]},
         "metadata_support": {"type": "array", "items": {"type": "string"}, "uniqueItems": true}
-      }
+      },
+      "allOf": [
+        {
+          "if": {"properties": {"type": {"const": "file"}}},
+          "then": {
+            "properties": {
+              "blob_digest": {"type": "string", "pattern": "^[0-9a-f]{64}$"},
+              "link_target": {"type": "null"}
+            }
+          }
+        },
+        {
+          "if": {"properties": {"type": {"const": "directory"}}},
+          "then": {
+            "properties": {
+              "blob_digest": {"type": "null"},
+              "link_target": {"type": "null"},
+              "size": {"const": 0}
+            }
+          }
+        },
+        {
+          "if": {"properties": {"type": {"const": "symlink"}}},
+          "then": {
+            "properties": {
+              "blob_digest": {"type": "null"},
+              "link_target": {
+                "type": "string",
+                "minLength": 1,
+                "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!.*\\\\).+$"
+              },
+              "size": {"const": 0}
+            }
+          }
+        }
+      ]
     }
   }
 }

contracts/repository/v1/repository.schema.json

@@ -6,7 +6,11 @@
   "additionalProperties": false,
   "required": ["repository_id", "format_version", "digest_algorithm", "compression", "encryption", "created_at"],
   "properties": {
-    "repository_id": {"type": "string", "format": "uuid"},
+    "repository_id": {
+      "type": "string",
+      "format": "uuid",
+      "pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
+    },
     "format_version": {"const": 1},
     "digest_algorithm": {"const": "sha256"},
     "compression": {"enum": ["none", "zstd"]},
@@ -19,6 +23,6 @@
         "key_id": {"type": ["string", "null"], "minLength": 1}
       }
     },
-    "created_at": {"type": "string", "format": "date-time"}
+    "created_at": {"type": "string", "format": "date-time", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(?:\\.[0-9]+)?Z$"}
   }
 }