Harden Bombadil artifact delivery for v0.7.9

.github/workflows/npm-publish.yml

@@ -273,9 +273,9 @@ jobs:
           const minimumFiles = 50;
           const maximumFiles = 60;
           const minimumPackedBytes = 140_000;
-          const maximumPackedBytes = 180_000;
+          const maximumPackedBytes = 220_000;
           const minimumUnpackedBytes = 650_000;
-          const maximumUnpackedBytes = 810_000;
+          const maximumUnpackedBytes = 1_010_000;
           const maximumMetadataBytes = 250_000;
           const expectedName = "@hraness/direct";
           const expectedVersion = process.env.EXPECTED_VERSION;

AGENTS.md

@@ -26,6 +26,7 @@
 - Keep core code product-, platform-, and framework-neutral. Put React, browser globals, and Node-only tooling behind explicit subpaths.
 - Build Bun host `@hraness/direct/tooling/*` entries separately. Keep every development-only export out of the default, core, React, testing, and web graphs, and prove the separation through the packed-consumer boundary gate. Ship the Bombadil campaign subpath as TypeScript source because 0.7.2 resolves no package export conditions, and keep it free of filesystem and process APIs because its compiler loads that subpath into a browser specification.
 - Pin optional browser tools exactly. The Bombadil integration supports 0.7.2 only, treats its JSONL trace as foreign bounded input, and must attest the canonical Direct manifest and probe after every run rather than trust a zero exit status.
+- Constrain every Bombadil run to exclusive UUID leaves, owned process groups, bounded files and totals, a final descriptor-bound inventory, and a sanitized receipt. Public CI may upload only the exact receipt/summary leaf; raw traces and diagnostics require explicit bounded private vetting. Give each product-owned named snapshot an exact fail-closed parser or predicate.
 - Keep React Native and Expo imports in the reference example; `@hraness/direct/react` remains the platform-neutral React binding.
 - Keep `.js` extensions on relative TypeScript import and export specifiers; the published source type surface must compile under both Bundler and NodeNext resolution.
 - Treat this repository as the complete project. Files and Git prose may use only its public names, paths, commands, and examples; do not refer to or infer any non-public source, system, product, package, path, or implementation detail.

README.md

@@ -316,7 +316,21 @@ the exact native 0.7.2 binary, attests the bounded trace with Direct's canonical
 parsers, writes pass or failure artifacts plus a compact exploration summary,
 and releases its owned processes. Use `runDirectBombadilFuzzMatrix` when a
 product owns several scenarios; it runs them serially and requires one exact
-campaign selector for replay.
+campaign selector for replay. Matrix upload plans are public-summary only and
+publish one atomic parent leaf; run a selected campaign directly for bounded
+access-controlled private diagnostics.
+
+Scheduled wrappers should precompute one lowercase UUID and pass it through
+the runner's `artifactRun` option. Resolve the exact leaf with
+`resolveDirectBombadilUploadLeaf` and upload only that leaf with `if: always()`.
+Its default
+public mode contains a bounded sanitized receipt and summary, including for
+rejected or failed runs. Raw traces, logs, screenshots, paths, labels, typed
+values, queries, and foreign errors stay local unless an access-controlled job
+explicitly selects the bounded `private-vetted` mode.
+Parse retained JSON from `unknown` with the four exported
+`parseDirectBombadil*Receipt` and `parseDirectBombadil*Summary` functions;
+never cast `JSON.parse` output to an evidence type.
 
 Startup is the only repairable contract phase. It must reach one exact Direct
 observation within ten seconds. From that sample onward, activation identity,
@@ -329,6 +343,12 @@ snapshots that expose semantic state without retaining page content. Run short
 12–30 second campaigns while editing and longer 60–300 second matrices in a
 scheduled diagnostic lane. Inspect and replay a retained failing trace, then
 promote the smallest readable failure to a deterministic product regression.
+Give every product-owned named snapshot an exact fail-closed parser or type
+predicate. A local random walk discovers reachable surprises; an Antithesis
+environment supplies deterministic simulation and reproducibility around the
+same bounded properties. Do not treat either one as a replacement for Direct's
+deterministic scenarios, semantic assertions, production-boundary checks, or
+ordinary browser gates.
 When a campaign must exercise an interaction, require a named product value to
 change after the intended action kind, as well as after a non-Wait action, so
 bootstrap, idle, prerequisite, and unrelated transitions do not satisfy the