feat(isolation): support backend-supplied provider roots - #522

AI-assisted adversarial review by OpenCode (usai/gpt-6-astra) of #522 at d547ce1.

One medium-priority regression needs correction: the new version dispatch inspects unvalidated JSON before the schema can reject its type. See the inline finding. This is an error-contract regression, not an acceptance bypass: the CLI still exits 1.

Verification on the reviewed head, in an isolated Python 3.13.16 environment with the repository's exact PyYAML, jsonschema, pytest, and Ruff pins:

• Provider contract suite: 168 passed.
• Full scripts/tests suite: 652 passed.
• make validate-provider-input-contract: validated 3 bundles.
• Ruff lint and format checks on both changed Python files: pass.
• git diff --check: pass.
• Released v1 bundle schema: byte-identical to the pre-PR base.
• Additional execution probes: 10 unsafe/mismatched v2 paths rejected cleanly; mixed-provider and mixed-v1/v2 explicit batches accepted; intermediate artifact symlinks and non-executable normalizers rejected for both versions.
• All seven malformed-input cases in the inline finding raised ContractError in the pre-PR validator; the reviewed head raises AttributeError or TypeError instead.

Integration notes (not additional blockers):

• Pass every candidate using repeated --bundle flags in ONE invocation to get set-wide duplicate-provider checks. Separate per-provider invocations reset the uniqueness set.
• Zero --bundle flags select repository discovery and report the shipped fixtures/kit as valid. This must not be treated as validation of an empty external provider set. The consumer-facing example would benefit from stating both CLI rules.
• The two-distinct-backend-root acceptance criterion from #521 is not demonstrated here. The PR explicitly delegates mount/root enforcement to the backend layer; the unit tests establish the package contract, not live MSB/SBX enforcement. Keep that acceptance evidence with GSA-TTS/agentic-coding-quickstart#600 and GSA-TTS/agentic-coding-quickstart#606.

No live backend mount or consumer execution was performed. The source worktree remains clean.

AI-assisted adversarial re-review by OpenCode (usai/gpt-6-astra) of #522 at 7c99212.

The P2 finding from my previous review is resolved. I inspected the complete three-file delta from d547ce1 and re-ran the original malformed-input probes independently of the new tests. Non-object JSON roots and array/object schema versions now raise path-qualified ContractError; the CLI returns 1 without a traceback. Missing/null versions also reject cleanly. The guards run before either .get on the root or the schema-map lookup, which fixes both failure mechanisms.

The 20 new parameterized API/CLI cases cover the requested regression and additional non-string version values. The consumer documentation also now explains set-wide repeated --bundle validation and the zero-flag repository-discovery behavior.

Verification on this exact head in the existing isolated Python 3.13.16 environment with repository-pinned direct dependencies:

• Provider contract suite: 188 passed.
• Host validator: validated 3 shipped bundles.
• Original malformed-input probes: all reject with ContractError, exit 1, no traceback.
• Ten unsafe/mismatched v2 paths reject; mixed-provider and mixed-v1/v2 batches pass; intermediate artifact symlinks and non-executable normalizers reject for both versions.
• Ruff lint/format and diff whitespace checks pass; review worktree is clean.
• All seven current-head GitHub checks report success, including Python 3.12 compatibility.

No new blockers. This approval supersedes my changes-requested verdict on d547ce1. Backend mount/root enforcement remains the separately tracked integration acceptance; no live MSB/SBX execution is claimed.