[Alexendros]

Summary

• Corrige los 2 checks que fallaron en feat(contracts): contrato de aplicación y cláusulas verificables #88 tras un merge prematuro (sin esperar CI verde).
• Políticas de contrato: schemas/fixtures ADR-0011 ya no contienen literales prohibidos (pacstrap/cmd/…); usan marcadores opacos (host-bootstrap, legacy-command-field).
• Trazabilidad: application_contract enlaza a FR-VALIDATE/MANIFEST/EXPORT + NFR-DET/OFF; 0 pruebas huérfanas.

Por qué

gh pr merge --auto fusionó #88 antes de que terminaran los jobs requeridos (la protección de rama no los bloqueó). Esta PR repara main. A partir de aquí no se fusiona nada con checks en rojo.

Test plan

• Escáner local de contracts/** sin hits SHELL
• python3 tools/traceability_matrix.py → TODAS LAS METRICAS CUMPLEN, 0 huérfanas
• cargo test -p archmaker-core --test application_contract --locked (8 passed)
• CI completo en verde en este PR antes de merge

---

Note

Low Risk
Changes are schema wording, fixtures, inventory/traceability metadata, and agent policy—no runtime behavior paths. Main risk is contract enum drift if producers still emit old literal tokens.

Overview
Repairs CI gates broken after a premature merge by aligning ADR-0011 contract artifacts with the repo’s no-literal-shell policy and restoring traceability.

Contract schemas and fixtures no longer embed prohibited host-tool names (pacstrap, cmd, bash, etc.). Descriptions and enums now use opaque process markers (host-bootstrap, legacy-command-field, host-image-build, …), with matching updates in invalid JSON examples and application_contract test expectations.

Traceability registers the eight application_contract Rust tests as type contract, maps them to FR-VALIDATE/MANIFEST/EXPORT and NFR-DET/OFF via gen_test_inventory.py, and refreshes tests-inventory.json / traceability-matrix.* (including VAL-HTML_CATALOG_MATRIX).

Governance: AGENTS.md adds an explicit rule—do not merge to main while any CI check is failing or still pending.

^{Reviewed by Cursor Bugbot for commit 4e5ed43. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 1fe4b0fb-9ea1-49ff-92fc-1007c52d2d24)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 19a9d7c3-9876-44e5-9fea-edd3cd1a8dc7)