remove independent egress pool configuration and authorization

scripts/validate-local-contracts.py

@@ -85,7 +85,7 @@ for index, match in enumerate(re.finditer(r"```json\s*(.*?)\s*```", doc, re.DOTA
     positive_counts[name] += 1
 
 for path in sorted(EXAMPLES.glob("config-read-*.json")):
-    if "invalid" in path.name or path == STATUS_FIXTURE or path.name.endswith("-v0.2.json"):
+    if "invalid" in path.name or path == STATUS_FIXTURE or path.name.endswith(("-v0.2.json", "-v0.3.json")):
         continue
     validators["config-read"].validate(load_json(path))
     positive_counts["config-read"] += 1
@@ -162,7 +162,7 @@ invalid_prefixes = {
 negative_counts = {name: 0 for name in SCHEMA_PATHS}
 for path in sorted(EXAMPLES.glob("*-invalid-*.json")):
     name = next((schema for prefix, schema in invalid_prefixes.items() if path.name.startswith(prefix)), None)
-    if name is None or (name == "task-discovery" and not path.name.endswith("-v0.1.json")):
+    if name is None or (name == "task-discovery" and not path.name.endswith("-v0.1.json")) or (name == "config-read" and path.name.endswith(("-v0.2.json", "-v0.3.json"))):
         continue
     sample = load_json(path)
     try:
@@ -199,7 +199,7 @@ def validate_manifest():
         path.relative_to(ROOT).as_posix()
         for path in EXAMPLES.glob("*.json")
         if (path.name.startswith(("config-read-", "command-next-", "call-result-"))
-            and not path.name.endswith("-v0.2.json"))
+            and not path.name.endswith(("-v0.2.json", "-v0.3.json")))
         or (path.name.startswith("task-discovery-") and path.name.endswith("-v0.1.json"))
     )
     artifact_paths = [entry.get("path") for entry in artifacts if isinstance(entry, dict)]
@@ -275,8 +275,9 @@ for example in ("snapshot", "changes"):
         raise SystemExit(f"v0.2 {field} accepted more than 256 items")
 
 proposal_doc = ROOT / "docs/thirds/v0.2.md"
-proposal_versions = {**versions, "config-read.v0.2": "config-read-sip-v0.2", "task-discovery.v0.2-proposal": "task-discovery-v0.2"}
+proposal_versions = {**versions, "config-read.v0.2": "config-read-sip-v0.2", "config-read.v0.3": "config-read-sip-v0.3", "task-discovery.v0.2-proposal": "task-discovery-v0.2"}
 validators["config-read-sip-v0.2"] = Draft202012Validator(load_json(ROOT / "docs/contracts/config-read-v0.2.schema.json"), registry=registry, format_checker=FormatChecker())
+validators["config-read-sip-v0.3"] = Draft202012Validator(load_json(ROOT / "docs/contracts/config-read-v0.3.schema.json"), registry=registry, format_checker=FormatChecker())
 for match in re.finditer(r"```json\s*(.*?)\s*```", proposal_doc.read_text(encoding="utf-8"), re.DOTALL):
     sample = json.loads(match.group(1))
     if isinstance(sample, dict) and sample.get("schema_version") in proposal_versions:
@@ -344,6 +345,48 @@ for entry in sip_entries:
         raise SystemExit(f"SIP v0.2 manifest SHA-256 mismatch: {entry['path']}")
 print("SIP config-read v0.2: positive=1, negative=1, manifest files=5")
 
+# Independent egress-pool fields are absent from all three current project-local inputs.
+new_contracts = [
+    ("config-read-v0.3", "config-read-sip-v0.3", "config-read-sip-invalid-egress-v0.3"),
+    ("ai-authorization-v0.2", "ai-authorization-v0.2", "ai-authorization-invalid-egress-v0.2"),
+    ("static-cell-artifact-v0.2", "static-cell-artifact-v0.2", "static-cell-artifact-invalid-egress-v0.2"),
+]
+new_artifacts = set()
+for schema_name, positive_name, negative_name in new_contracts:
+    schema_path = ROOT / f"docs/contracts/{schema_name}.schema.json"
+    embedded_path = ROOT / f"contracts/local/v0.3/{schema_name}.schema.json"
+    if embedded_path.read_bytes() != schema_path.read_bytes():
+        raise SystemExit(f"embedded schema differs from source: {schema_name}")
+    schema = load_json(schema_path)
+    Draft202012Validator.check_schema(schema)
+    validator = Draft202012Validator(schema, registry=registry, format_checker=FormatChecker())
+    positive_path = EXAMPLES / f"{positive_name}.json"
+    negative_path = EXAMPLES / f"{negative_name}.json"
+    validator.validate(load_json(positive_path))
+    embedded_example = ROOT / f"contracts/local/v0.3/examples/{positive_name}.json"
+    if embedded_example.read_bytes() != positive_path.read_bytes():
+        raise SystemExit(f"embedded example differs from source: {positive_name}")
+    try:
+        validator.validate(load_json(negative_path))
+    except ValidationError:
+        pass
+    else:
+        raise SystemExit(f"removed egress-pool field unexpectedly valid: {negative_name}")
+    new_artifacts.update(path.relative_to(ROOT).as_posix() for path in (schema_path, positive_path, negative_path))
+new_manifest = load_json(ROOT / "docs/contracts/local-contract-manifest-v0.6.json")
+if (new_manifest.get("manifest_version") != "local-contract-manifest.v0.6"
+        or new_manifest.get("hash_algorithm") != "SHA-256"
+        or new_manifest.get("source", {}).get("path") != "docs/contracts/config-read-fields-v0.3-proposal.md"):
+    raise SystemExit("invalid egress-pool removal manifest header")
+new_entries = [new_manifest["source"], *new_manifest.get("artifacts", [])]
+if len(new_entries) != 10 or {entry.get("path") for entry in new_entries[1:]} != new_artifacts:
+    raise SystemExit("egress-pool removal manifest artifact set mismatch")
+for entry in new_entries:
+    path = ROOT / entry["path"]
+    if hashlib.sha256(path.read_bytes()).hexdigest() != entry.get("sha256"):
+        raise SystemExit(f"egress-pool removal manifest SHA-256 mismatch: {entry['path']}")
+print("No-egress-pool contracts: positive=3, negative=3, manifest files=10")
+
 # v0.3 replaces the v0.2 runtime path; v0.2 files above remain historical evidence.
 event_doc = ROOT / "docs/thirds/v0.3.md"
 event_schema_path = ROOT / "docs/contracts/task-discovery-v0.3-proposal.schema.json"