Schema and validator defects can weaken downstream enforcement. Report security-sensitive contract issues using GitHub private vulnerability reporting for this repository. Do not include real credentials or private data in reports.

A schema being valid does not imply that an artifact or agent behavior is safe; schemas define wire-format constraints, not trust decisions.