feat: implement frozen strict typed identity contract

[Pigbibi]

Summary

• implement the frozen structured_tokens.v2 R1 contract
• validate deterministic field-specific grammar before canonicalization
• enforce exact canonical wire records and stable identity digests

Scope

Generated solely from the frozen spec package. Pure R1 model and table-driven tests only; no R2 adapter, runtime, history, evidence, or workflow integration.

Validation

• focused identity tests
• tests.test_run_codex_pr_review
• full unittest discovery
• ruff, compileall, actionlint, diff-check

Frozen specification: /Users/lisiyi/Projects/.codex-output/aiauditbridge-r1d-spec/spec_handoff.v1.json.

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: blocking findings were cleared by independent Codex arbitration

⚖️ Codex Review Arbitration

✅ clear: The current source of truth explicitly defines NFC normalization of scope.file as the public contract, so this finding is not valid against the cumulative diff. In scripts/canonical_typed_identity.py, _scope() passes scope.file through _text(), and _text() returns unicodedata.normalize("NFC", value). The accompanying contract test tests/test_canonical_typed_identity_r1d.py then asserts that input "Cafe\u0301.py" is canonicalized to "Caf\u00e9.py" and that the digests are computed from that normalized value. That test is direct contract evidence that decomposed and precomposed forms are intentionally collapsed for identity generation, so the review claim that the path must instead be preserved byte-exact or rejected is contradicted by the PR’s own public interface/tests. There is no conflict with the prior repo-casing finding; that prior issue concerns scope.repo, while the current finding concerns scope.file normalization.

---

Review by Codex PR Review bot • PR

[Pigbibi]

Contract clarification for the frozen spec:

• build_identity_record() accepts a validated typed payload and canonicalizes scope.repo to lowercase.
• The canonical wire record is the builder output, not its pre-canonical payload input.
• verify_identity_record() recomputes the canonical output and requires exact record equality, so a mixed-case wire record is rejected.
• The focused test asserts lowercase builder output and exact record verification.

Therefore the reported behavior is required canonicalization, not acceptance of a non-canonical wire record. No code change is appropriate.