feat: add versioned game identity contracts

docs/phase-0/source-inventory.toml

@@ -10,6 +10,39 @@ owner = "project maintainers"
 update_policy = "explicit pull request after release and security review"
 release_profile = false
 
+[[components]]
+name = "serde"
+kind = "runtime-library"
+source = "https://crates.io/crates/serde"
+version = "1.0.228"
+license = "MIT OR Apache-2.0"
+owner = "project maintainers"
+update_policy = "explicit contract change after changelog, license, and audit review"
+release_profile = true
+
+[[components]]
+name = "serde_json"
+kind = "runtime-library"
+source = "https://crates.io/crates/serde_json"
+version = "1.0.150"
+license = "MIT OR Apache-2.0"
+owner = "project maintainers"
+update_policy = "explicit contract change after changelog, license, and audit review"
+release_profile = true
+
+[[components]]
+name = "uuid"
+kind = "runtime-library"
+source = "https://crates.io/crates/uuid"
+version = "1.24.0"
+license = "MIT OR Apache-2.0"
+owner = "project maintainers"
+update_policy = "explicit identity-contract change after changelog, license, and audit review"
+release_profile = true
+
+# Transitive crate versions, sources, and checksums are pinned in Cargo.lock. Their
+# licenses and sources are enforced by cargo-deny before release.
+
 [[components]]
 name = "cargo-deny"
 kind = "development-audit-tool"

docs/phase-0/traceability.csv

@@ -7,10 +7,10 @@ R-005,7,provider contract and acceptance tests,planned
 R-006,2,CLI integration tests,planned
 R-007,8,gaming-tool integration tests,planned
 R-008,8,session lifecycle acceptance test,planned
-R-009,1,core contract tests,planned
+R-009,1,Phase 1A normalized-record contract tests,in-progress
 R-010,5,TTY recovery acceptance test,planned
 R-011,0,development workflow record,active
-R-012,1,shared-backend architecture tests,planned
+R-012,1,Phase 1A role-separation contract tests,in-progress
 R-013,8,profile policy acceptance tests,planned
 R-014,12,Pegasus adapter tests,post-v1
 R-015,8,Lean and Ready policy tests,planned
@@ -22,10 +22,9 @@ R-020,6,Bluetooth CLI and TUI tests,planned
 R-021,11,installer destructive VM tests,planned
 R-022,10,optional recovery profile tests,optional
 R-023,14,OpenGamepadUI evaluation,post-v1
-R-024,1,adversarial contract tests,planned
+R-024,1,Phase 1A identifier and path adversarial tests,in-progress
 R-025,0,source inventory and release review,active
 R-026,0,supported-platform record,active
 R-027,0,path and identity architecture review,active
 R-028,8,release GPU matrix,planned
-R-029,1,TOML and JSON contract tests,planned
-
+R-029,1,Phase 1A versioned JSON contract tests,in-progress

docs/phase-1/evidence-contracts-2026-07-18.md

@@ -0,0 +1,16 @@
+# Phase 1A contract evidence
+
+- Date: 2026-07-18
+- Requirement IDs: R-009, R-012, R-024, R-029
+- Phase/gate: phase 1 / identity and normalized-record contracts
+- Scope: provider-independent game identity, installation identity, role separation,
+  versioned JSON records, and lexical installation-path validation
+- Exclusions: persistence, adapters, launch plans, configuration precedence, providers,
+  and process execution
+- Commands: `make verify`; `make audit`; human and JSON `kiln doctor` smoke paths
+- Expected result: contract and adversarial tests pass; unsupported schemas and malformed
+  input are rejected; existing smoke behavior remains unchanged
+- Observed result: 10 contract and adversarial tests passed; Rustfmt, workspace/all-target
+  compilation, Clippy with warnings denied, cargo-deny advisories/bans/licenses/sources,
+  and both doctor smoke paths passed
+- Result: pass