fix(jcs): enforce fail-closed RFC 8785 canonicalization

.aegis/experiments/pr-253-rfc8785-fail-closed-v1.json

@@ -0,0 +1,86 @@
+{
+  "admission_executable": {
+    "blob_id": "b9c998ddc85b9beeefec30121e88e828b15a8405",
+    "path": "sovereign-omega-v2/scripts/validate-experiment-plan.ts"
+  },
+  "admission_workflow": {
+    "blob_id": "01a59d129b0431c9ccb92b1227a0e46992b1562f",
+    "path": ".github/workflows/experiment-admission.yml"
+  },
+  "budget": {
+    "max_cost_microunits": 0,
+    "max_duration_seconds": 3600,
+    "max_mutations": 0
+  },
+  "claims_ledger": {
+    "path": ".aegis/claims-ledger.json",
+    "root": "495a01d7a942d5f90b39f2d2b178b074aee60c5e6460e1622f1917982ac59652"
+  },
+  "constitution": {
+    "blob_id": "d0c210443e03313113e43da46c4d98269494baeb",
+    "path": "CONSTITUTIONAL_DECLARATION.md"
+  },
+  "evidence_tier": "T2",
+  "execution_class": "EXPERIMENT",
+  "expected_outputs": [
+    "ADMISSION_RECEIPT.json",
+    "EVIDENCE_MANIFEST.json",
+    "EXPERIMENT_PLAN.json",
+    "INTEGRATION_LEDGER.json",
+    "INTEGRATION_LEDGER.md",
+    "SHA256SUMS"
+  ],
+  "expected_parent_sha": "0bdffe75b56e5cd27c0632e1ba166620da327494",
+  "expected_parent_state_root": "7cc0329e312dfd309133e237dad6095cafbc881a3e934051df1f03303f507859",
+  "experiment_id": "pr-253-rfc8785-fail-closed-v1",
+  "integration_ledger_generator": {
+    "blob_id": "28823ae5b630be273b78210f0addf9c0a86aad05",
+    "path": "scripts/integration_ledger.py"
+  },
+  "observability": {
+    "cancellation_mechanism": "github-actions-cancel-run",
+    "durable_execution_required": true,
+    "emergency_stop_reference": "github-actions:cancel-run",
+    "heartbeat_max_seconds": 300,
+    "provider": "github-actions"
+  },
+  "operator_approval": {
+    "approval_record_hash": "65f85da29b8019f657f5e44bb5f08fd99a434ff8b1fa413325478bd0b9eeca56",
+    "authorization_basis": "user-explicit-kreni-rfc8785-canonicalization-hardening",
+    "decided_at": "2026-08-01T01:53:00+02:00",
+    "operator_actor_id": "tarikskalic",
+    "operator_session_id": "chatgpt-session-2026-08-01-pr-253-jcs-hardening",
+    "required": true,
+    "signature_mode": "GITHUB_OIDC_ATTESTATION",
+    "state": "APPROVED"
+  },
+  "policy": {
+    "blob_id": "5937cf4d9fc59f224faabfb7865bba7aa5da90dc",
+    "path": "docs/rfcs/0001-operator-sovereign-control-plane.md"
+  },
+  "replay_package": {
+    "include_admission_receipt": true,
+    "include_evidence_manifest": true,
+    "include_integration_ledger": true,
+    "include_plan": true,
+    "required": true
+  },
+  "repository": "Aegis-Omega/AEGIS-OMEGA",
+  "requested_authority_domains": [
+    "github:artifact-metadata-write",
+    "github:attestation-write",
+    "github:oidc-token-mint",
+    "github:workflow-artifact-write"
+  ],
+  "schema_version": "0.1.0",
+  "sovereignty_contracts": {
+    "blob_id": "d53860f1340293cf08955ebb8729a853432551eb",
+    "path": "sovereign-omega-v2/src/sovereignty/contracts.ts"
+  },
+  "termination_conditions": [
+    "budget_exhausted",
+    "observability_expired",
+    "operator_emergency_stop"
+  ],
+  "title": "Enforce fail-closed RFC 8785 canonicalization and adversarial boundary tests"
+}

.claude.json

@@ -9,8 +9,8 @@
   "provenance": {
     "generator": "scripts/build-cognitive-manifest.py",
     "repository": "Aegis-Omega/AEGIS-OMEGA",
-    "source_ref": "claude/blissful-rubin-mt9jS",
-    "parent_state_hash": "410bcd49c721e65050382ae759db7af2f41fa9f572e625174252c72a8748ea93",
+    "source_ref": "fix/rfc8785-fail-closed-canonicalization",
+    "parent_state_hash": "e9f0ec153b0b320a1e791092f73209442ec43a982e503203d9c101ec40949cba",
     "signature_mode": "GITHUB_OIDC_ATTESTATION"
   },
   "hashing": {
@@ -488,5 +488,5 @@
       "on_success": "broadcast-attested-verified-event-stream"
     }
   },
-  "state_hash": "e9f0ec153b0b320a1e791092f73209442ec43a982e503203d9c101ec40949cba"
+  "state_hash": "d24e6c9c6d8a2791ab4595ecd800b8e23c58338e8a51ab8cf68aab98ce026b69"
 }

sovereign-omega-v2/package.json

@@ -9,7 +9,7 @@
     "preview": "vite preview",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:coverage": "vitest run --coverage",
+    "test:coverage": "vitest run --coverage --no-file-parallelism",
     "test:determinism": "node --experimental-vm-modules scripts/verify-canonicalization.ts",
     "lint": "eslint src --ext ts,tsx --report-unused-disable-directives --max-warnings 0",
     "typecheck": "tsc --noEmit",