feat(contracts): freeze frontend boundary with B05 fields, mock server, and P4 manifest

[kapustazh]

Summary

Freezes the Gate P4 frontend boundary to unblock Milestone B05:

• Adds additive sanitized fields needed by B05 to OpenAPI v1 (policy summary on IntentResponse, authorization_status on AttemptView, and token_contract + explorer_url on SettlementView).
• Regenerates @oneshot/contracts artifacts without drift (contracts.schema.json, openapi.v1.json, api-types.ts).
• Publishes 7 sanitized UI fixtures under packages/contracts/fixtures/ui/v1/ and validates them against the JSON Schema bundle via validate-fixtures.mjs.
• Implements and exports a versioned OpenAPI mock server (OPENAPI_MOCK_SERVER_VERSION = '1.0.0') in @oneshot/contracts covering all 6 frozen routes with fail-closed /retry rejection.
• Publishes docs/GATE_P4_MANIFEST.md and marks Step 4 as [COMPLETED] in docs/GATE_P4_CHECKLIST.md.

Scope and acceptance criteria

• The change is limited to the stated milestone or issue.
• Acceptance criteria are listed and satisfied.
• No unrelated cleanup is included.

Product and security invariants

• Tenant isolation remains fail-closed.
• Sponsor authorization, auditability, and daily caps remain enforced where applicable.
• Recipients cannot modify sponsor controls or access sponsor-only data.
• No secret, token, production identifier, or personal data is committed or pasted into review prompts.
• Any non-applicable invariant is explained below.

Invariant notes:

Contract additions are strictly optional and additive; no existing backend or worker behavior is changed. The mock server strictly forbids blind payment retries (rejects /retry paths). No secrets are stored or transmitted.

Validation

Commands and results:

pnpm check:generated: PASS (0 drift)
pnpm validate:fixtures: PASS (9 contracts-v1 + 7 ui-v1 fixtures validated)
pnpm format:check: PASS
pnpm lint: PASS
pnpm typecheck: PASS
pnpm test: PASS (44 test files, 585 tests)
npx markdownlint-cli2 "**/*.md" "#node_modules": PASS (96 files, 0 issues)

Independent review evidence

Gate A — exact candidate tree before push

• Base commit SHA: 4afd70916a84946aa3230cd29ccd3b68a2b2da58

• Candidate tree SHA: 408976302803470862aacf47338e002bf6ffa797

• Candidate commit SHA (if already committed but unpushed): 0ce3a8974f3ba926bfba5ff15dcd7c85f4f81fa1

• Reviewer tool: free-pi-cli

• Reviewer model: glm-5.3-flash

• Verdict: VERDICT: PASS

• Findings or residual risks: Non-blocking note on mock reconcile gating for non-terminal states; no invariant, security, or idempotency violation.

• The reviewed tree equals the committed tree.

Gate B — exact remote PR head

• Pull request URL/number: #34

• Remote head commit SHA: 0ce3a8974f3ba926bfba5ff15dcd7c85f4f81fa1

• Remote head tree SHA: 408976302803470862aacf47338e002bf6ffa797

• Reviewer tool: free-pi-cli

• Reviewer model: glm-5.3-flash

• Verdict: VERDICT: PASS

• Findings or residual risks: Non-blocking notes on mock-server synthesis semantics for non-seeded intents, allowed_recipients lack of maxItems, and context file pending gate tags. All invariants and acceptance criteria verified.

• Gate B reviewed the current remote head and matches Gate A's approved tree, or a fresh Gate A was run for the changed tree.

• Agent policy / repository-policy and all applicable CI checks pass.

CI check evidence:

• repository-policy: SUCCESS (run 34236609974)
• Markdown and Mermaid: SUCCESS (run 34236609980)
• ESLint and TypeScript: SUCCESS (run 34236609980)
• Workers Builds (oneshot): SUCCESS (build a35b1eae)

Risk and rollback

• Residual risks: Low. All schema additions are optional. UI fixtures and mock server are additive development aids for B05.
• Rollback or recovery plan: Revert commit 0ce3a8974f3ba926bfba5ff15dcd7c85f4f81fa1.

Human merge

• A human owner has reviewed the evidence and will perform the merge.