feat: enforce commercial rectification evidence contracts

* feat: enforce precise timing output contract

* fix: recognize package imports in fragment audit

* test: make workflow stream contract formatting-independent

* fix: preserve VedAstro evidence across async workflows

* feat: enforce commercial technique truth contract

* feat: add rectification technique receipt

* feat: extend rectification event evidence

* feat: score rectification arudha evidence

* feat: gate high rigor rectification confirmation

* feat: add controlled transit to rectification

* feat: include d11 in rectification finance scoring

* feat: add ashtakavarga rectification auxiliary

* feat: show rectification technique receipt

* feat: use verified shadbala components in rectification

* fix: trace transitive script references in fragment audit

* feat: run request-level rectification parity packet

tests/test_api_async_job_contract.py

@@ -103,3 +103,12 @@ def test_sqlite_async_job_backend_preserves_token_and_ttl(monkeypatch, tmp_path)
     assert api._load_async_job_record("test_scope", "job_sqlite", access_token="secret")["job_id"] == "job_sqlite"
     with pytest.raises(api.JobAccessDenied):
         api._load_async_job_record("test_scope", "job_sqlite", access_token="wrong")
+
+
+def test_async_high_rigor_vedastro_timeout_is_bounded(monkeypatch):
+    monkeypatch.setenv("JYOTISH_ASYNC_HIGH_RIGOR_VEDASTRO_TIMEOUT_SECONDS", "10")
+    assert api._async_high_rigor_vedastro_timeout_seconds() == 30.0
+    monkeypatch.setenv("JYOTISH_ASYNC_HIGH_RIGOR_VEDASTRO_TIMEOUT_SECONDS", "999")
+    assert api._async_high_rigor_vedastro_timeout_seconds() == 180.0
+    monkeypatch.setenv("JYOTISH_ASYNC_HIGH_RIGOR_VEDASTRO_TIMEOUT_SECONDS", "invalid")
+    assert api._async_high_rigor_vedastro_timeout_seconds() == 90.0

tests/test_api_server_security.py

@@ -3317,6 +3317,15 @@ def test_api_chart_cache_key_tracks_vedastro_runtime_state(monkeypatch: pytest.M
     )
 
     assert key_disabled != key_enabled
+    monkeypatch.setenv("VEDASTRO_TIMEOUT_SECONDS", "20")
+    key_timeout_20 = jyotish_api_server._api_chart_cache_key(
+        jyotish_api_server._build_api_chart_cache_payload(payload)
+    )
+    monkeypatch.setenv("VEDASTRO_TIMEOUT_SECONDS", "90")
+    key_timeout_90 = jyotish_api_server._api_chart_cache_key(
+        jyotish_api_server._build_api_chart_cache_payload(payload)
+    )
+    assert key_timeout_20 != key_timeout_90
 
 
 def test_high_rigor_plan_only_surfaces_chart_cache_and_queue_strategy() -> None:

tests/test_commercial_skill_truth_contract.py

@@ -0,0 +1,51 @@
+"""Commercial-only claim boundaries for techniques not cleared for deterministic use."""
+
+from __future__ import annotations
+
+from scripts.commercial_skill_truth import (
+    TECHNIQUE_TRUTH_IDS,
+    apply_commercial_skill_truth,
+    load_commercial_skill_truth,
+)
+
+
+def test_truth_overlay_has_all_restricted_techniques_and_no_research_paths() -> None:
+    overlay = load_commercial_skill_truth()
+    techniques = {item["technique_id"]: item for item in overlay["techniques"]}
+
+    assert set(TECHNIQUE_TRUTH_IDS) == set(techniques)
+    assert {item["status"] for item in techniques.values()} == {
+        "reference_only",
+        "partial",
+        "blocked",
+        "research_only_blocked",
+        "partial_registry_only",
+    }
+    assert "/Users/" not in str(overlay)
+    assert "research truth overlay" not in str(overlay).lower()
+
+
+def test_truth_overlay_cannot_bypass_server_answer_contract() -> None:
+    result = apply_commercial_skill_truth(
+        {
+            "route": "career",
+            "answer_policy": {
+                "can_answer_direction": True,
+                "can_answer_precise_timing": True,
+            },
+        }
+    )
+
+    truth = result["technique_truth"]
+    policy = result["answer_policy"]
+    assert truth["status"] == "restricted"
+    assert set(truth["blocked_techniques"]) == {
+        "sahams",
+        "sphuta_trisphuta_family",
+        "conception_chart",
+    }
+    assert set(policy["deterministic_claims_forbidden_for"]) == set(TECHNIQUE_TRUTH_IDS)
+    assert policy["can_answer_precise_timing"] is True
+    evidence = result["commercial_evidence_status"]
+    assert evidence["claim_audit"]["status"] == "contract_enforced"
+    assert evidence["three_engine_mismatch"]["truth_policy"] == "no_majority_vote"

tests/test_rectification_technique_contract.py

@@ -0,0 +1,31 @@
+from scripts.rectification_technique_contract import build_rectification_technique_contract
+
+
+def test_zero_events_are_not_a_completed_rectification() -> None:
+    contract = build_rectification_technique_contract(event_count=0, domain_count=0)
+    assert contract["calculation_status"] == "not_started"
+    assert contract["can_narrow_to_minute"] is False
+    assert "insufficient_events" in contract["hard_blockers"]
+
+
+def test_contract_discloses_used_and_missing_layers() -> None:
+    contract = build_rectification_technique_contract(event_count=4, domain_count=3)
+    assert {"D4", "D9", "D10", "D24", "D30"} <= set(contract["used_divisional_charts"])
+    assert contract["dasha_tracks"] == ["vimshottari_md_ad_pd", "narayana_md_ad"]
+    assert contract["used_arudha"] == ["A7", "UL", "A10"]
+    assert contract["missing_layers"] == ["shadbala_kala_dig_chesta_total"]
+    assert "D2" in contract["partial_layers"]
+    assert "D11" in contract["partial_layers"]
+    assert "functional_benefic_malefic" in contract["auxiliary_layers"]
+    assert "controlled_transit" in contract["auxiliary_layers"]
+    assert "ashtakavarga" in contract["auxiliary_layers"]
+    assert "shadbala_verified_components" in contract["auxiliary_layers"]
+    assert "shadbala_sthana_drik_naisargika" in contract["partial_layers"]
+    assert contract["external_engines"]["status"] == "not_run"
+
+
+def test_high_rigor_requires_real_three_engine_evidence() -> None:
+    contract = build_rectification_technique_contract(event_count=4, domain_count=3, high_rigor=True)
+    assert contract["external_engines"]["status"] == "required_not_run"
+    assert "three_engine_parity_not_passed" in contract["hard_blockers"]
+    assert contract["can_narrow_to_minute"] is False

tests/test_rectification_three_engine_packet.py

@@ -0,0 +1,15 @@
+from scripts.rectification_three_engine_packet import build_packet, case_hash
+
+
+CASE = {"year": 1990, "month": 1, "day": 1, "hour": 12, "minute": 0, "lat": 0.0, "lon": 0.0, "tz": 0.0}
+
+
+def test_packet_is_private_and_never_confirms(monkeypatch) -> None:
+    monkeypatch.setattr("scripts.rectification_three_engine_packet._local_d1", lambda _: {"Sun": "Aries"})
+    monkeypatch.setattr("scripts.rectification_three_engine_packet._pyjhora_d1", lambda _: {"Sun": "Aries"})
+    monkeypatch.setattr("scripts.rectification_three_engine_packet._jyotishganit_d1", lambda _: {"Sun": "Aries"})
+    packet = build_packet(CASE)
+    assert packet["case_hash"] == case_hash(CASE)
+    assert "year" not in str(packet)
+    assert packet["can_confirm"] is False
+    assert packet["vedastro"]["status"] == "requires_gateway_raw_archive"

tests/test_vedastro_gateway.py

@@ -257,6 +257,7 @@ def test_gateway_completion_archives_official_raw_response(monkeypatch, tmp_path
     assert archive["official_raw_response_available"] is True
     path = tmp_path / archive["official_raw_response_path"]
     assert path.exists()
+    assert path.stat().st_mode & 0o777 == 0o600
     assert '"vedastro_official"' in path.read_text(encoding="utf-8")
 
 

tests/test_vedastro_service_adapter_executor.py

@@ -87,6 +87,18 @@ def test_vedastro_official_subprocesses_use_adapter_timeout(monkeypatch) -> None
     assert catalog["status"] == "official_full_capability_catalog_runtime_error"
 
 
+def test_temporary_timeout_is_scoped_to_the_current_execution(monkeypatch) -> None:
+    from scripts import vedastro_service_adapter as adapter
+    from scripts.vedastro_runtime_context import temporary_timeout_seconds
+
+    monkeypatch.setenv("VEDASTRO_TIMEOUT_SECONDS", "7")
+
+    assert adapter._timeout_seconds() == 7.0
+    with temporary_timeout_seconds(90):
+        assert adapter._timeout_seconds() == 90.0
+    assert adapter._timeout_seconds() == 7.0
+
+
 def test_vedastro_official_subprocess_timeouts_are_controlled(monkeypatch) -> None:
     from scripts import vedastro_service_adapter as adapter