Normalize verified citation IDs in accepted report copies

[Wenjie Fan (gggdttt)]

Context

Tracks AB#652973. Fresh follow-up to merged #218, based on verified main at 02e7ab15b040be712ff8b694f65ae82257aac0db (including #218 squash 7726d5d8d8dbcb146489f0e65e76e9cc9b976db0). Combined smoke run 37310924454 returned four synthetic__privacy-015 findings with valid primary citations but scenario-style IDs and non-aligned optional ranges. Strict rejection was correct; this adds a narrowly bounded accepted-copy path, not a producer exemption.

Contract and schema

• Preserve exact raw Task/report bytes as immutable private audit evidence. Validate strict JSON and the complete structural schema before constructing any candidate: required fields, types, enums, conditional requirements, positive integer locations, range structure, and additional-property restrictions remain enforced.
• Require every primary and supporting citation to pass safe-path, live existence, and recorded full-body retrieval checks. Only on a deep copy of the entire report, replace a cited non-agent finding's ID with the exact references[0].path using ordinal equality. Preserve private {findingIndex, originalId, canonicalId} records in normalizedIds.
• In that same copy, preserve the existing optional-range operation: all three numbers are positive integers, start <= line <= end, start != line, and no suggested-code field. Validate original source bounds before removing a range; record its finding index and original endpoints in removedRanges. Valid uncited agents retain range-only eligibility, but their IDs and severity/confidence are never rewritten.
• Run the complete schema and semantic/role/composition consumer gate on the entire candidate. Any other defect fails the entire report; there is no individual-finding salvage. Never rewrite messages, reference paths/order, location.line, or any other field. Accepted nested leaf reports remain immutable.
• Replace Harden findings-report producer constraints #218's global no-# ID pattern with conditional uncited-agent syntax: agent:<slug> or <leaf-id>:agent:<slug>, retaining medium/low confidence and minor/info severity caps. A cited ID remains a required non-empty string structurally; exact primary-path equality is semantic, so an eligible raw fragment/scenario ID can reach candidate construction. Without bounded normalization it still fails. Role/producer ownership is checked semantically, and cited explicit agent encodings fail closed.

Updates DO, its executable validator, the AL coordinator and standalone-runner instructions, and contributor test guidance together. No new tooling, model invocation, product pin change, or merge.

Regression evidence

Extended tools/Test-ReviewContract.ps1 with minimal fixtures copied from all four raw privacy findings, preserving every finding value. Independently verified the fixture values against the source leaf and verified SHA256 provenance:

• Raw leaf: 26aead0958e6ffe60c947f740b95ecf016783116a88d1254e87cea5c54c10107
• Final handoff: c313a4ad40d270f4f77821ac36e375baaf107b8944fb8673e1d27d42c1e8b054

Covers combined ID+range normalization, canonical no-op/idempotence, ID-only and range-only behavior, multiple citations and citation order/SHA, fragments/scenario IDs, invalid/unknown/unretrieved primary or supporting references, agent IDs/roles/caps, suggested-code ranges, original source bounds, unrelated structural/semantic defects, immutable nested reports, and exact raw byte preservation including BOM/CRLF/escapes on acceptance and rejection.

Validation

• pwsh -NoProfile -File .\tools\Test-ReviewFixtures.ps1 -Root .: passed, including executable contract; 244 cases, 122/342 paired articles across 20 leaf domains.
• pwsh -NoProfile -File .\tools\Test-ReviewContract.ps1 -Root .: passed; 8 predicate cases plus executable acceptance/rejection regressions.
• pwsh -NoProfile -File .\.github\scripts\Test-SkillIndex.ps1 -Root .: passed, report schemas and 19 declared review leaves.
• pwsh -NoProfile -File .\.github\scripts\Test-KnowledgeIndex.ps1 -Root .: passed; 410 articles and 707 samples round-tripped, including retrieval checks.
• python -X utf8 .\.github\scripts\validate_frontmatter.py --root .: 0 errors, 2 pre-existing keyword-count warnings.
• PowerShell parse checks and git diff --check: passed. knowledge-index.json remains untracked.

These are deterministic regressions, not a new model smoke or a 7/7 reliability claim.

[Jesper Schulz-Wedde (JesperSchulz)]

Reviewed 8c9385c16fdb1f21afa6ce957420ead73294d06d. The bounded-normalization design and regression coverage are generally sound, but one literal-integrity defect remains.

At tools/Validate-FindingsReport.ps1:745, the ID replacement decision uses PowerShell -cne, which is case-sensitive but linguistic rather than ordinal. The primary-reference equality check at line 451 uses the same comparison. A verified article path with U+200B, soft hyphen or NUL appended can therefore be treated as already canonical: replacement and normalizedIds telemetry are skipped, and full validation accepts the noncanonical ID.

Reproduced on the exact head with a valid two-finding leaf: the first ID was the verified primary path plus U+200B; the second was the same path plus #scenario. Without normalization the head rejects the report. With normalization it accepts it with normalized=true and only one normalizedIds entry: the fragment ID is canonicalized, but the first accepted ID still is not ordinal-equal to its primary reference. Combined ID/range probes reproduce this for all three characters. This violates the PR's explicit accepted-copy literal-equality guarantee.

Please use [string]::Equals(..., [StringComparison]::Ordinal) for both the replacement decision and primary-reference equality check, and add regressions asserting every accepted cited ID is ordinal-equal to its primary path and every changed ID appears in telemetry. The existing acceptance harness passed 417 assertions; 115 independent boundary probes isolated this specific remaining defect. All GitHub checks are green, but they do not cover this case yet.