release(contract): reject byte-noncanonical topic-lineage artifact JSON #657

Finding

TopicLineageArtifact is a digest-bound release projection and to_json() is documented as canonical serialization, but from_json() currently accepts any JSON text that deserializes to the same validated struct. Whitespace, pretty-printing, and other byte-distinct JSON representations can therefore be accepted even though the canonical artifact SHA-256 is derived from compact owner serialization.

That leaves two notions of artifact identity at the release boundary: accepted input bytes and the canonical bytes later reserialized for hashing. #654–#656 closed field-level aliases, but the outer JSON envelope itself still permits byte aliases.

Required RED

Using one otherwise valid tepp.trsl_topic_lineage.v2 artifact:

• canonical artifact.to_json() bytes must parse successfully;
• the same JSON with a trailing newline must fail closed; and
• a pretty-printed representation of the same semantic object must fail closed.

The RED must use the public parser so the consumer boundary, not a private helper, owns the invariant.

Minimal causal repair

After deserialization and semantic validation, reserialize the parsed struct with the owner serializer and require exact byte equality with the supplied payload. Do not trim, normalize, or rewrite caller bytes. Keep the existing byte limit and field-level canonicalization rules unchanged.

This is deterministic release-identity hardening only. It does not alter estimator arithmetic, scientific thresholds, Membership semantics, or the v2 schema shape.

Record the rule in CHANGELOG/release contract and #639 lineage. Exact-head hosted GREEN and qualifying independent review remain required before any release.

Refs #638 #639 #654 #655 #656.