fix(tmproto): accept optional $schema/format_kind, relax wire-ID charset, fix verifier error envelope

[ohalushchak-exadel]

Summary

Three related Trusted Match Protocol conformance fixes, shipped together as one tmproto module change so both agents pick them up via a single pin bump.

Accept schema-valid $schema and format_kind. The context-match and identity-match request schemas declare an optional top-level $schema, and Artifact declares format_kind with additionalProperties: true. The generator previously skipped $schema, and the hand-written Artifact struct had no FormatKind, so any schema-legal request carrying either was 400'd by DisallowUnknownFields() in the verifier middleware. Both are now known fields on the Go structs. DisallowUnknownFields stays on — the verifier reconstructs the signing input from the parsed struct, so silently dropping unknown fields would let a future extension produce a signature the verifier could never reproduce.

Relax the wire-ID charset to match the schema. validateSafeID had rejected : / \ on request_id, placement_id, package_id, and property_id. The TMP schemas place no charset constraint on those, and real callers use them: urn:uuid:… request ids, homepage/atf placement slugs, tenant-prefixed package ids like acme:q1. Split into a new validateEchoID (length + C0/DEL rejection only) for the four wire IDs. validateSafeID stays on property_rid — that one flows into store keys and is UUID-shaped by spec anyway. SafeRequestIDForEcho now uses the relaxed rule too, so a urn:uuid: request_id can be echoed on error responses and structured logs (control bytes still stripped).

Fix the verifier error envelope. writeVerifierError was emitting {"type":"","request_id":"","code":…}, violating error.json which requires type == "error" and echoes request_id. It now emits the correct discriminator and echoes the request_id through SafeRequestIDForEcho. Pre-parse failures still pass an empty request_id (nothing to echo yet); post-parse failures echo the parsed one.

The second commit is an unrelated go fix ./... autofix (slices.Backward loop migration) that the tooling gate surfaced. Kept in-PR so the working tree stays clean.

Release order

After merge:

1. Cut a new tmproto submodule tag.
2. Bump the pin in cmd/context-agent, cmd/identity-agent, cmd/router, e2e, and targeting.

Two router-side follow-ups (no-follow-redirect on fan-out clients; complete asset-credential stripping for the unknown-asset variant and signed-URL fields) will stack on this branch as a separate PR.

Test plan

• go test ./... in tmproto, targeting, and root (router) — all green
• CI matrix green after push
• Manual sanity: a request carrying $schema at the top level no longer 400s
• Manual sanity: a request with request_id: "urn:uuid:..." no longer 400s
• Manual sanity: a verifier-rejected response body includes "type":"error" and echoes request_id

[aao-secretariat]

Ladon verdict: Approve

Approve — TMP conformance fixes with two non-blocking test-coverage gaps.

What I checked:

• Charset relaxation via validateEchoID is safe: relaxed wire IDs never reach a separator-interpreting sink (context cache uses NUL, property_rid stays strict), and control-byte/log-injection protection plus signing semantics are preserved.
• Accepting optional $schema/format_kind and the verifier error-envelope fix preserve wire-shape fidelity and TMP signing/verification semantics — no signature/replay/nonce/canonicalization weakening.
• No hand-edits to generated types requiring regen; tmproto/types_gen.go change is consistent with the schema source.

Medium findings (non-blocking):

• Missing test coverage for $schema/format_kind acceptance (headline behavior; manual test-plan checkbox unchecked).
• Missing test coverage for the corrected error-envelope shape.

Two medium findings fall through to approve (row 9). high_risk is true only via (modified) test/impl files, but with no medium finding on a specific modified sensitive file tied to a risk (findings list is empty), row 5 does not fire. gated_paths is false; no author-team gate; no deletions.

[aao-secretariat]

Re-approval: no reviewable delta since the prior approval; re-submitting after stale-review dismissal.