protocol

ci → green (protected run 29359483436: canonical type contract, Rust, CLI, live integration, and both mandatory coverage ratchets)

Closed: PROTO-12

Commit a12565a makes seven shared public types a checked Protocol-owned manifest. The checker extracts structs, fields, enum variants, and source order directly from frauthy-core; a mutation test proves an unreflected Rust field rename fails CI.

sdk

ci → green (protected run 29359853291: four language producers, four mandatory coverage ratchets, and Protocol type contract)

Commit fecf7be vendors the exact Protocol a12565a manifest with commit and SHA-256 provenance, verifies TypeScript, Rust, Go, and Python mirrors offline, and compares byte-for-byte with a sibling Protocol checkout when present.

CanonicalClaims.raw is now aligned across all four SDKs. Each OIDC adapter preserves the original verified token payload, and each language suite asserts the behavior rather than merely compiling the added field.

Program-wide

Wave 9 stayed within root/specs/08-CONCURRENT-PROGRAM-HANDOFF.md. Protocol and core SDK are wholly Gap Closure-owned; no Brand, packages/ui, frontend composition, Portal, product UI, registry publication, or tag path changed.