[contracts] Define ArtifactRegistry canonicalization and resolver policy

[FlowmemoryAI]

Objective

Define ArtifactRegistry canonicalization and resolver policy before relying on artifact commitments as verified protocol truth.

Context

Live V0 stores compact artifact commitments and emits advisory URI strings. It does not define artifact serialization, CID policy, hash algorithm policy, resolver allowlists, or sensitive-data handling beyond caller responsibility.

Allowed folders

• contracts/
• tests/
• docs/DECISIONS/
• docs/SECURITY_MODEL.md
• contracts/FLOWPULSE_SCHEMA.md

Forbidden folders

• apps/
• services/
• hardware/
• research/
• crypto/ except references
• Tokenomics, dynamic fees, production hook deployment, production network config, or L1/appchain implementation

Acceptance Criteria

• Define artifact hash/canonicalization expectations or explicitly defer them.
• Decide whether URI strings remain advisory or move to CID/hash-only fields.
• If contract behavior changes, add focused tests.

Risk Level

Medium

Recommended Agent

FlowMemory Contracts Agent with verifier/indexer input.