feat: add versioned game identity contracts

docs/phase-0/source-inventory.toml

@@ -10,6 +10,39 @@ owner = "project maintainers"
 update_policy = "explicit pull request after release and security review"
 release_profile = false
 
+[[components]]
+name = "serde"
+kind = "runtime-library"
+source = "https://crates.io/crates/serde"
+version = "1.0.228"
+license = "MIT OR Apache-2.0"
+owner = "project maintainers"
+update_policy = "explicit contract change after changelog, license, and audit review"
+release_profile = true
+
+[[components]]
+name = "serde_json"
+kind = "runtime-library"
+source = "https://crates.io/crates/serde_json"
+version = "1.0.150"
+license = "MIT OR Apache-2.0"
+owner = "project maintainers"
+update_policy = "explicit contract change after changelog, license, and audit review"
+release_profile = true
+
+[[components]]
+name = "uuid"
+kind = "runtime-library"
+source = "https://crates.io/crates/uuid"
+version = "1.24.0"
+license = "MIT OR Apache-2.0"
+owner = "project maintainers"
+update_policy = "explicit identity-contract change after changelog, license, and audit review"
+release_profile = true
+
+# Transitive crate versions, sources, and checksums are pinned in Cargo.lock. Their
+# licenses and sources are enforced by cargo-deny before release.
+
 [[components]]
 name = "cargo-deny"
 kind = "development-audit-tool"

docs/phase-0/traceability.csv

@@ -7,10 +7,10 @@ R-005,7,provider contract and acceptance tests,planned
 R-006,2,CLI integration tests,planned
 R-007,8,gaming-tool integration tests,planned
 R-008,8,session lifecycle acceptance test,planned
-R-009,1,core contract tests,planned
+R-009,1,Phase 1A normalized-record contract tests,in-progress
 R-010,5,TTY recovery acceptance test,planned
 R-011,0,development workflow record,active
-R-012,1,shared-backend architecture tests,planned
+R-012,1,Phase 1A role-separation contract tests,in-progress
 R-013,8,profile policy acceptance tests,planned
 R-014,12,Pegasus adapter tests,post-v1
 R-015,8,Lean and Ready policy tests,planned
@@ -22,10 +22,9 @@ R-020,6,Bluetooth CLI and TUI tests,planned
 R-021,11,installer destructive VM tests,planned
 R-022,10,optional recovery profile tests,optional
 R-023,14,OpenGamepadUI evaluation,post-v1
-R-024,1,adversarial contract tests,planned
+R-024,1,Phase 1A identifier and path adversarial tests,in-progress
 R-025,0,source inventory and release review,active
 R-026,0,supported-platform record,active
 R-027,0,path and identity architecture review,active
 R-028,8,release GPU matrix,planned
-R-029,1,TOML and JSON contract tests,planned
-
+R-029,1,Phase 1A versioned JSON contract tests,in-progress