fix: unblock Evidence Envelope critical chain — 7 schema violations fixed

Constraint-first (v3 methodology): identified the critical chain bottleneck
as "nobody writes valid Evidence Envelopes" and resolved it.

- Wire HCT --envelope flag (was parsed but discarded as `_`)
- Fix service-autopsy: tool value, artifact types, path field, UUID format
- Add "hardware-crash-team" to schema tool enum
- Both HCT and service-autopsy now emit schema-conformant envelopes

Coverage audit: 29/29 components audited, 12 skipped MUSTs found in
unvisited components (session-sentinel P0, 3 license violations P1).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

Cargo.lock

@@ -28,7 +28,7 @@
       "properties": {
         "tool": {
           "type": "string",
-          "enum": ["big-up", "ambient", "a-and-e", "sysobs", "psa"],
+          "enum": ["big-up", "ambient", "a-and-e", "sysobs", "psa", "hardware-crash-team"],
           "description": "Which tool produced this envelope"
         },
         "tool_version": {

contracts/schemas/evidence-envelope.schema.json

@@ -31,6 +31,7 @@ tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 reqwest = { version = "0.12", features = ["json"], optional = true }
 tokio = { version = "1", features = ["full"], optional = true }
 
+gethostname = "0.4"
 ambientops-contracts = { path = "../contracts-rust" }
 
 # TUI

hardware-crash-team/Cargo.toml

@@ -142,12 +142,26 @@ fn main() -> Result<()> {
     let cli = Cli::parse();
 
     match cli.command {
-        Commands::Scan { format, envelope: _, output } => {
+        Commands::Scan { format, envelope, output } => {
             let report = scanner::scan_system(cli.verbose)?;
-            let rendered = match format.as_str() {
-                "json" => serde_json::to_string_pretty(&report)?,
-                "sarif" => sarif::format_sarif(&report)?,
-                _ => scanner::format_report(&report, "text")?,
+
+            let rendered = if envelope {
+                // Wrap scan output in a contract-conformant EvidenceEnvelope.
+                let report_json = serde_json::to_value(&report)?;
+                let hostname = gethostname::gethostname()
+                    .to_string_lossy()
+                    .to_string();
+                let env = ambientops_contracts::conversions::system_report_to_envelope(
+                    &report_json,
+                    &hostname,
+                );
+                serde_json::to_string_pretty(&env)?
+            } else {
+                match format.as_str() {
+                    "json" => serde_json::to_string_pretty(&report)?,
+                    "sarif" => sarif::format_sarif(&report)?,
+                    _ => scanner::format_report(&report, "text")?,
+                }
             };
 
             if let Some(path) = output {

hardware-crash-team/src/main.rs

@@ -22,7 +22,7 @@ defmodule ServiceAutopsy.Collector do
 
   require Logger
 
-  @source "service-autopsy"
+  @source "psa"
   @journal_lines 50
   @envelope_version "1.0.0"
 
@@ -200,7 +200,8 @@ defmodule ServiceAutopsy.Collector do
       if results[:journal] != [] do
         [%{
           "artifact_id" => generate_artifact_id(),
-          "type" => "journal_excerpt",
+          "type" => "log",
+          "path" => "journal/#{unit_name}.log",
           "label" => "Journal entries for #{unit_name}",
           "line_count" => length(results[:journal] || [])
         } | artifacts]
@@ -212,7 +213,8 @@ defmodule ServiceAutopsy.Collector do
       if results[:coredump] != [] do
         [%{
           "artifact_id" => generate_artifact_id(),
-          "type" => "coredump_listing",
+          "type" => "report",
+          "path" => "coredumps/#{unit_name}.report",
           "label" => "Coredumps for #{unit_name}",
           "entry_count" => length(results[:coredump] || [])
         } | artifacts]
@@ -224,7 +226,8 @@ defmodule ServiceAutopsy.Collector do
       if results[:unit_file] != nil do
         [%{
           "artifact_id" => generate_artifact_id(),
-          "type" => "unit_file",
+          "type" => "config",
+          "path" => "units/#{unit_name}",
           "label" => "Unit file for #{unit_name}"
         } | artifacts]
       else
@@ -321,10 +324,22 @@ defmodule ServiceAutopsy.Collector do
   end
 
   defp generate_envelope_id do
-    "autopsy-" <> (:crypto.strong_rand_bytes(8) |> Base.url_encode64(padding: false))
+    generate_uuid()
   end
 
   defp generate_artifact_id do
-    "art-" <> (:crypto.strong_rand_bytes(6) |> Base.url_encode64(padding: false))
+    generate_uuid()
+  end
+
+  # Generate a RFC 4122 v4 UUID from random bytes.
+  defp generate_uuid do
+    <<a::48, _::4, b::12, _::2, c::62>> = :crypto.strong_rand_bytes(16)
+    <<a::48, 4::4, b::12, 2::2, c::62>>
+    |> Base.encode16(case: :lower)
+    |> format_uuid_hex()
+  end
+
+  defp format_uuid_hex(<<a::binary-8, b::binary-4, c::binary-4, d::binary-4, e::binary-12>>) do
+    "#{a}-#{b}-#{c}-#{d}-#{e}"
   end
 end