feat: add checked-in API contract conformance

[kevinnguy]

Summary

• Vendor the REST, prediction-markets, and WebSocket contracts under specs/ with SHA-256 verification and an explicit refresh command.
• Make TypeScript and Go generation offline and add reproducible generated-output drift gates.
• Move Go numeric policy into a reviewed overlay and document intentional wire-level exceptions.
• Add 35 language-neutral conformance fixtures with TypeScript and Go runners for HMAC, unsigned requests, errors, JSON exactness, WebSocket subscriptions, and WebSocket events.
• Fix terms-required and missing-role error classification plus padded WebSocket symbol normalization.
• Update CI path filters, CODEOWNERS, and Go release smoke staging for the new contract and fixture trees.

Verification

• node specs/refresh.mjs: all vendored specs unchanged.
• TypeScript full suite: 679 passing; typecheck, build, package verification, and runtime verification passed. Node, Bun, and Miniflare passed; Deno was skipped because it is not installed.
• TypeScript conformance suite: 39 passing.
• Go SDK tests, generator tests, conformance tests, go vet, nested Gorilla tests, and release smoke passed with GOWORK=off CGO_ENABLED=0.
• Linux 386 generated-clearing compilation passed; execution is unavailable on the Darwin host.
• Contract tampering fails both loaders with the expected digest mismatch.
• Removing a fixture from the manifest fails both language manifest tests; the manifest was restored afterward.
• Cross-language HMAC payload comparison confirms matching normalized request/body semantics, with only the declared nonce-type and key-order exceptions.

Environment note

The repository make targets were blocked locally by the Xcode license prompt; equivalent direct verification commands passed.

[nostradamus-bot]

Nostradamus Risk Rating — Medium

The only production-code changes are additive bug fixes in packages/sdk-go/transport/errors.go and packages/sdk-typescript/src/errors.ts — both High-sensitivity auth-adjacent components — that add missing reason-code aliases for terms-acceptance errors and a secondary JSON error-field fallback; no signing logic, auth flow, or validation logic is modified. The bulk of the PR (conformance fixtures with synthetic credentials, vendored API specs, generator script updates, CI config) is build/test infrastructure with no production security impact.

[sdlc-pr-bot]

Change Control Evidence Check

Authorization — ❌ Fail

Evidence:

• Linear ticket: ⚠️ No ticket linked
• Change owner: Kevin Nguy
• Type of change: Normal

Testing — ⚠️ Incomplete

Evidence:

• Tests from CI checks: ➖ No tests ran
• Security scans: ⏳ Pending — re-run Clarissa once CI checks complete
• Testing summary: ✅ Found in PR description
  • Summary: TypeScript and Go SDK testing suites passed with 679 and 39 passing tests respectively, including conformance, build, and runtime verification across Node, Bun, and Miniflare environments; vendored specs remained unchanged and Linux 386 compilation succeeded. Deno testing was skipped due to missing installation.
• Evidence link: View run

Approval — ⏳ Awaiting approval

Evidence:
(no approvers yet)

Segregation of Duties — ⏳ Awaiting approval

Validated:

• PR author: Kevin Nguy

---

Last checked: 2026-09-17 21:11 UTC

↩ Re-run Clarissa if tickets, CI, or approvals have changed.