Minimize D&D NPC extraction contracts

internal/modules/dnd/npcs/identity/identity.go

@@ -29,24 +29,17 @@ const idPrefix = "npc:sha256:"
 type IssueCode string
 
 const (
-	IssueEmptyCanonicalName      IssueCode = "empty_canonical_name"
-	IssueEmptyAlias              IssueCode = "empty_alias"
-	IssueInvalidID               IssueCode = "invalid_id"
-	IssueIDMismatch              IssueCode = "id_mismatch"
-	IssueDuplicateCanonical      IssueCode = "duplicate_canonical_identity"
-	IssueDuplicateID             IssueCode = "duplicate_id"
-	IssueDuplicateAlias          IssueCode = "duplicate_alias"
-	IssueOwnCanonicalAlias       IssueCode = "alias_matches_canonical_name"
-	IssueAliasCanonicalCollision IssueCode = "alias_canonical_collision"
-	IssueAliasOwnershipCollision IssueCode = "alias_owned_by_multiple_records"
+	IssueEmptyCanonicalName IssueCode = "empty_canonical_name"
+	IssueInvalidID          IssueCode = "invalid_id"
+	IssueIDMismatch         IssueCode = "id_mismatch"
+	IssueDuplicateCanonical IssueCode = "duplicate_canonical_identity"
+	IssueDuplicateID        IssueCode = "duplicate_id"
 )
 
-// Issue is an inspectable identity validation problem. AliasIndex is -1 when
-// the issue applies to an NPC as a whole rather than a particular alias.
+// Issue is an inspectable identity validation problem.
 type Issue struct {
 	Code        IssueCode
 	RecordIndex int
-	AliasIndex  int
 	Value       string
 }
 
@@ -107,88 +100,35 @@ func ValidID(value string) bool { return IsValidID(value) }
 // It accepts the NPC slice used by typed pipeline artifacts. Use ValidateList
 // when the enclosing NPCList is more convenient at the call site.
 func ValidateRegistry(npcs []dnd.NPC) []Issue {
-	type record struct {
-		canonical string
-		aliases   []string
-	}
-
-	records := make([]record, len(npcs))
 	issues := make([]Issue, 0)
 	canonicalOwners := make(map[string][]int)
 	idOwners := make(map[string][]int)
-	aliasOwners := make(map[string][]int)
 
 	for recordIndex, npc := range npcs {
 		canonical := ComparisonKey(npc.Name)
-		records[recordIndex].canonical = canonical
 		if canonical == "" {
-			issues = append(issues, Issue{Code: IssueEmptyCanonicalName, RecordIndex: recordIndex, AliasIndex: -1, Value: npc.Name})
+			issues = append(issues, Issue{Code: IssueEmptyCanonicalName, RecordIndex: recordIndex, Value: npc.Name})
 		} else {
 			canonicalOwners[canonical] = append(canonicalOwners[canonical], recordIndex)
 		}
 
 		if !IsValidID(npc.ID) {
-			issues = append(issues, Issue{Code: IssueInvalidID, RecordIndex: recordIndex, AliasIndex: -1, Value: npc.ID})
+			issues = append(issues, Issue{Code: IssueInvalidID, RecordIndex: recordIndex, Value: npc.ID})
 		} else if expected := DeriveID(npc.Name); npc.ID != expected {
-			issues = append(issues, Issue{Code: IssueIDMismatch, RecordIndex: recordIndex, AliasIndex: -1, Value: npc.ID})
+			issues = append(issues, Issue{Code: IssueIDMismatch, RecordIndex: recordIndex, Value: npc.ID})
 		}
 		if npc.ID != "" {
 			idOwners[npc.ID] = append(idOwners[npc.ID], recordIndex)
 		}
-
-		seenAliases := make(map[string]int, len(npc.Aliases))
-		for aliasIndex, alias := range npc.Aliases {
-			key := ComparisonKey(alias)
-			records[recordIndex].aliases = append(records[recordIndex].aliases, key)
-			if key == "" {
-				issues = append(issues, Issue{Code: IssueEmptyAlias, RecordIndex: recordIndex, AliasIndex: aliasIndex, Value: alias})
-				continue
-			}
-			if _, ok := seenAliases[key]; ok {
-				issues = append(issues, Issue{Code: IssueDuplicateAlias, RecordIndex: recordIndex, AliasIndex: aliasIndex, Value: alias})
-			} else {
-				seenAliases[key] = aliasIndex
-			}
-			if key == canonical {
-				issues = append(issues, Issue{Code: IssueOwnCanonicalAlias, RecordIndex: recordIndex, AliasIndex: aliasIndex, Value: alias})
-			}
-			aliasOwners[key] = append(aliasOwners[key], recordIndex)
-		}
 	}
 
-	for recordIndex, record := range records {
-		if record.canonical != "" && len(canonicalOwners[record.canonical]) > 1 && canonicalOwners[record.canonical][0] != recordIndex {
-			issues = append(issues, Issue{Code: IssueDuplicateCanonical, RecordIndex: recordIndex, AliasIndex: -1, Value: npcs[recordIndex].Name})
+	for recordIndex, npc := range npcs {
+		canonical := ComparisonKey(npc.Name)
+		if canonical != "" && len(canonicalOwners[canonical]) > 1 && canonicalOwners[canonical][0] != recordIndex {
+			issues = append(issues, Issue{Code: IssueDuplicateCanonical, RecordIndex: recordIndex, Value: npc.Name})
 		}
-		if id := npcs[recordIndex].ID; id != "" && len(idOwners[id]) > 1 && idOwners[id][0] != recordIndex {
-			issues = append(issues, Issue{Code: IssueDuplicateID, RecordIndex: recordIndex, AliasIndex: -1, Value: id})
-		}
-	}
-
-	seenAliasKeys := make(map[string]struct{})
-	for _, record := range records {
-		for _, alias := range record.aliases {
-			if alias == "" {
-				continue
-			}
-			if _, alreadyProcessed := seenAliasKeys[alias]; alreadyProcessed {
-				continue
-			}
-			seenAliasKeys[alias] = struct{}{}
-			owners := uniqueIndexes(aliasOwners[alias])
-			if len(owners) > 1 {
-				for _, recordIndex := range owners {
-					issues = append(issues, Issue{Code: IssueAliasOwnershipCollision, RecordIndex: recordIndex, AliasIndex: aliasIndexFor(records[recordIndex].aliases, alias), Value: alias})
-				}
-			}
-			for _, recordIndex := range owners {
-				for _, canonicalOwner := range canonicalOwners[alias] {
-					if canonicalOwner != recordIndex {
-						issues = append(issues, Issue{Code: IssueAliasCanonicalCollision, RecordIndex: recordIndex, AliasIndex: aliasIndexFor(records[recordIndex].aliases, alias), Value: alias})
-						break
-					}
-				}
-			}
+		if npc.ID != "" && len(idOwners[npc.ID]) > 1 && idOwners[npc.ID][0] != recordIndex {
+			issues = append(issues, Issue{Code: IssueDuplicateID, RecordIndex: recordIndex, Value: npc.ID})
 		}
 	}
 
@@ -201,28 +141,6 @@ func ValidateList(list dnd.NPCList) []Issue { return ValidateRegistry(list.NPCs)
 // Validate is a convenience alias for ValidateList.
 func Validate(list dnd.NPCList) []Issue { return ValidateList(list) }
 
-func uniqueIndexes(values []int) []int {
-	seen := make(map[int]struct{}, len(values))
-	unique := make([]int, 0, len(values))
-	for _, value := range values {
-		if _, ok := seen[value]; ok {
-			continue
-		}
-		seen[value] = struct{}{}
-		unique = append(unique, value)
-	}
-	return unique
-}
-
-func aliasIndexFor(aliases []string, key string) int {
-	for index, alias := range aliases {
-		if alias == key {
-			return index
-		}
-	}
-	return -1
-}
-
 // Error makes an issue useful in simple callers while preserving its
 // structured fields for aggregate diagnostics.
 func (i Issue) Error() string {

internal/modules/dnd/npcs/identity/identity_test.go

@@ -77,18 +77,13 @@ func TestIdentityFunctionsAreSafeForConcurrentUse(t *testing.T) {
 func TestValidateRegistryReportsIdentityCollisionCategories(t *testing.T) {
 	validID := DeriveID("Mira Thorn")
 	npcs := []dnd.NPC{
-		{ID: validID, Name: "Mira Thorn", Aliases: []string{"The Greencloak", "the greencloak", "Mira Thorn"}},
-		{ID: validID, Name: "Mira Thorn", Aliases: []string{"The Greencloak"}},
-		{ID: DeriveID("Captain Vale"), Name: "Captain Vale", Aliases: []string{"Mira Thorn"}},
+		{ID: validID, Name: "Mira Thorn"},
+		{ID: validID, Name: "Mira Thorn"},
 	}
 	issues := ValidateRegistry(npcs)
 	want := map[IssueCode]bool{
-		IssueDuplicateAlias:          false,
-		IssueOwnCanonicalAlias:       false,
-		IssueDuplicateCanonical:      false,
-		IssueDuplicateID:             false,
-		IssueAliasOwnershipCollision: false,
-		IssueAliasCanonicalCollision: false,
+		IssueDuplicateCanonical: false,
+		IssueDuplicateID:        false,
 	}
 	for _, issue := range issues {
 		if _, ok := want[issue.Code]; ok {

internal/modules/dnd/npcs/registry/registry.go

@@ -5,6 +5,7 @@ package registry
 import (
 	"crypto/sha256"
 	"encoding/hex"
+	"encoding/json"
 	"fmt"
 	"mime"
 	"strings"
@@ -27,12 +28,13 @@ const (
 // Registry is an immutable, validated NPC registry prepared for prompt
 // grounding. All accessors return defensive copies.
 type Registry struct {
-	bound       bool
-	list        dnd.NPCList
-	canonical   []byte
-	digest      string
-	promptInput contracts.LLMInputMaterial
-	lookupByKey map[string]int
+	bound            bool
+	list             dnd.NPCList
+	canonical        []byte
+	digest           string
+	projectionDigest string
+	promptInput      contracts.LLMInputMaterial
+	lookupByKey      map[string]int
 }
 
 // Resolver retains only the validated construction-time registry and immutable
@@ -141,11 +143,13 @@ func Resolve(references contracts.ReferenceSet) (*Registry, error) {
 	slot, ok := references.Slots[ReferenceSlot]
 	if !ok {
 		content := []byte(emptyPrompt)
+		projectionDigest := semanticDigest(content)
 		return &Registry{
-			list:        dnd.NPCList{NPCs: []dnd.NPC{}},
-			canonical:   append([]byte(nil), content...),
-			promptInput: contracts.NewLLMInputMaterial(ReferenceSlot, npccodec.MediaType, content, "", ""),
-			lookupByKey: map[string]int{},
+			list:             dnd.NPCList{NPCs: []dnd.NPC{}},
+			canonical:        append([]byte(nil), content...),
+			projectionDigest: projectionDigest,
+			promptInput:      contracts.NewLLMInputMaterial(ReferenceSlot, npccodec.MediaType, content, projectionDigest, ""),
+			lookupByKey:      map[string]int{},
 		}, nil
 	}
 	if len(slot.Items) != 1 {
@@ -178,21 +182,24 @@ func Resolve(references contracts.ReferenceSet) (*Registry, error) {
 	}
 
 	list := cloneNPCList(value)
-	lookupByKey := make(map[string]int, len(list.NPCs)*2)
+	lookupByKey := make(map[string]int, len(list.NPCs))
 	for index, npc := range list.NPCs {
 		lookupByKey[identity.ComparisonKey(npc.Name)] = index
-		for _, alias := range npc.Aliases {
-			lookupByKey[identity.ComparisonKey(alias)] = index
-		}
 	}
 	digest := semanticDigest(content)
+	projection, err := nameProjection(list)
+	if err != nil {
+		return nil, fmt.Errorf("encode NPC name projection: %w", err)
+	}
+	projectionDigest := semanticDigest(projection)
 	return &Registry{
-		bound:       true,
-		list:        list,
-		canonical:   append([]byte(nil), content...),
-		digest:      digest,
-		promptInput: contracts.NewLLMInputMaterial(ReferenceSlot, npccodec.MediaType, content, digest, ""),
-		lookupByKey: lookupByKey,
+		bound:            true,
+		list:             list,
+		canonical:        append([]byte(nil), content...),
+		digest:           digest,
+		projectionDigest: projectionDigest,
+		promptInput:      contracts.NewLLMInputMaterial(ReferenceSlot, npccodec.MediaType, projection, projectionDigest, ""),
+		lookupByKey:      lookupByKey,
 	}, nil
 }
 
@@ -235,6 +242,15 @@ func (r *Registry) Digest() string {
 	return r.digest
 }
 
+// ProjectionDigest returns the SHA-256 digest of the exact names-only prompt
+// projection, including for an unbound or empty registry.
+func (r *Registry) ProjectionDigest() string {
+	if r == nil {
+		return ""
+	}
+	return r.projectionDigest
+}
+
 // Count returns the number of validated NPC records.
 func (r *Registry) Count() int {
 	if r == nil {
@@ -243,8 +259,8 @@ func (r *Registry) Count() int {
 	return len(r.list.NPCs)
 }
 
-// PromptInput returns the canonical registry as a content-safe prompt input.
-// Reference provenance is deliberately omitted.
+// PromptInput returns the names-only registry projection as a content-safe
+// prompt input. Durable IDs, evidence, and reference provenance are omitted.
 func (r *Registry) PromptInput() contracts.LLMInputMaterial {
 	if r == nil {
 		return contracts.LLMInputMaterial{}
@@ -252,8 +268,8 @@ func (r *Registry) PromptInput() contracts.LLMInputMaterial {
 	return r.promptInput.Clone()
 }
 
-// Lookup returns the canonical NPC for an exact canonical-name or alias match
-// under the NPC identity comparison policy.
+// Lookup returns the canonical NPC for an exact canonical-name match under the
+// NPC identity comparison policy.
 func (r *Registry) Lookup(value string) (dnd.NPC, bool) {
 	if r == nil {
 		return dnd.NPC{}, false
@@ -270,13 +286,26 @@ func semanticDigest(content []byte) string {
 	return "sha256:" + hex.EncodeToString(sum[:])
 }
 
+type projectedNPC struct {
+	Name string `json:"name"`
+}
+
+type projectedNPCList struct {
+	NPCs []projectedNPC `json:"npcs"`
+}
+
+func nameProjection(list dnd.NPCList) ([]byte, error) {
+	projection := projectedNPCList{NPCs: make([]projectedNPC, len(list.NPCs))}
+	for index, npc := range list.NPCs {
+		projection.NPCs[index] = projectedNPC{Name: npc.Name}
+	}
+	return json.Marshal(projection)
+}
+
 func formatIdentityIssues(issues []identity.Issue) string {
 	parts := make([]string, len(issues))
 	for index, issue := range issues {
 		location := fmt.Sprintf("record %d", issue.RecordIndex)
-		if issue.AliasIndex >= 0 {
-			location += fmt.Sprintf(" alias %d", issue.AliasIndex)
-		}
 		parts[index] = fmt.Sprintf("%s at %s", issue.Code, location)
 	}
 	return diagnostics.Aggregate("validate NPC registry identity", parts)
@@ -298,8 +327,6 @@ func cloneNPCs(values []dnd.NPC) []dnd.NPC {
 }
 
 func cloneNPC(value dnd.NPC) dnd.NPC {
-	value.Aliases = append([]string(nil), value.Aliases...)
-	value.Relationships = append([]dnd.NPCRelationship(nil), value.Relationships...)
 	value.SourceRefs = append([]source.SourceRef(nil), value.SourceRefs...)
 	return value
 }

internal/modules/dnd/npcs/registry/registry_test.go

@@ -2,313 +2,162 @@ package registry
 
 import (
 	"bytes"
-	"encoding/json"
-	"fmt"
+	"reflect"
 	"strings"
-	"sync"
 	"testing"
-	"unicode/utf8"
 
 	"gitea.maximumdirect.net/eric/notarius/internal/core/source"
 	"gitea.maximumdirect.net/eric/notarius/internal/framework/contracts"
 	"gitea.maximumdirect.net/eric/notarius/internal/modules/dnd"
 	npccodec "gitea.maximumdirect.net/eric/notarius/internal/modules/dnd/codec/npcs"
 	"gitea.maximumdirect.net/eric/notarius/internal/modules/dnd/npcs/identity"
-	"gitea.maximumdirect.net/eric/notarius/internal/modules/dnd/shared/diagnostics"
 )
 
-func TestResolveAbsentRegistryUsesExactEmptyPrompt(t *testing.T) {
-	resolved, err := Resolve(contracts.ReferenceSet{})
+func TestResolveUnboundRegistryHasExactEmptyProjection(t *testing.T) {
+	registry, err := Resolve(contracts.ReferenceSet{})
 	if err != nil {
-		t.Fatalf("Resolve() error = %v, want nil", err)
+		t.Fatalf("Resolve() error = %v", err)
 	}
-	if resolved.Bound() || resolved.Digest() != "" || resolved.Count() != 0 {
-		t.Fatalf("resolved unbound registry = %#v, want no semantic metadata", resolved)
+	input := registry.PromptInput()
+	if registry.Bound() || registry.Digest() != "" || registry.Count() != 0 || string(input.Content) != emptyPrompt {
+		t.Fatalf("registry = %#v input = %#v, want unbound empty registry", registry, input)
 	}
-	input := resolved.PromptInput()
-	if input.Name != ReferenceSlot || input.MediaType != npccodec.MediaType || input.Digest != "" || input.OriginURI != "" {
-		t.Fatalf("unbound prompt input metadata = %#v, want name/media type only", input)
-	}
-	if got := string(input.Content); got != emptyPrompt {
-		t.Fatalf("unbound prompt input = %q, want exact empty registry", got)
-	}
-	if got := string(resolved.CanonicalBytes()); got != emptyPrompt {
-		t.Fatalf("unbound canonical bytes = %q, want exact empty registry", got)
+	if registry.ProjectionDigest() == "" || input.Digest != registry.ProjectionDigest() || input.OriginURI != "" {
+		t.Fatalf("projection digest/input = %q/%#v", registry.ProjectionDigest(), input)
 	}
 }
 
-func TestResolveCanonicalizesAndProvidesSemanticIdentity(t *testing.T) {
-	value := validRegistryList()
-	canonical := encodeRegistry(t, value)
-	raw := append([]byte(" \n"), canonical...)
-	raw = append(raw, []byte("\n ")...)
-
-	resolved, err := Resolve(registryReference(raw, "file:///another-session/npcs.json"))
-	if err != nil {
-		t.Fatalf("Resolve() error = %v, want nil", err)
+func TestResolveKeepsDurableProvenanceAndProjectsOnlyOrderedNames(t *testing.T) {
+	list := registryFixture()
+	registry := resolveList(t, list)
+	if !registry.Bound() || registry.Digest() == "" || registry.Count() != 2 {
+		t.Fatalf("registry identity = bound %t digest %q count %d", registry.Bound(), registry.Digest(), registry.Count())
 	}
-	if !resolved.Bound() || resolved.Count() != len(value.NPCs) {
-		t.Fatalf("resolved registry = %#v, want bound registry with %d NPC", resolved, len(value.NPCs))
+	if got := string(registry.PromptInput().Content); got != `{"npcs":[{"name":"Mira Thorn"},{"name":"Captain Vale"}]}` {
+		t.Fatalf("prompt projection = %s", got)
 	}
-	if !bytes.Equal(resolved.CanonicalBytes(), canonical) || !bytes.Equal(resolved.PromptInput().Content, canonical) {
-		t.Fatalf("canonical content = %s, want %s", resolved.CanonicalBytes(), canonical)
-	}
-	if resolved.PromptInput().Digest != resolved.Digest() || !strings.HasPrefix(resolved.Digest(), "sha256:") {
-		t.Fatalf("semantic digest = %q, want SHA-256 digest", resolved.Digest())
-	}
-	if resolved.PromptInput().OriginURI != "" {
-		t.Fatalf("prompt input origin = %q, want no provenance path", resolved.PromptInput().OriginURI)
-	}
-}
-
-func TestResolveRejectsInvalidBoundaryValuesWithoutContent(t *testing.T) {
-	valid := validRegistryList()
-	second := valid.NPCs[0]
-	second.ID = identity.DeriveID("Captain Vale")
-	second.Name = "Captain Vale"
-	second.Aliases = []string{"The Greencloak"}
-	valueWithAliasCollision := dnd.NPCList{NPCs: []dnd.NPC{valid.NPCs[0], second}}
-	invalidID := valid
-	invalidID.NPCs[0].ID = "not-an-npc-id"
-
-	tests := []struct {
-		name      string
-		reference contracts.ReferenceSet
-		wantError string
-		forbidden []string
-	}{
-		{name: "zero items", reference: contracts.ReferenceSet{Slots: map[string]contracts.ResolvedReferenceSlot{ReferenceSlot: {Items: []contracts.ReferenceItem{}}}}, wantError: "exactly one"},
-		{name: "multiple", reference: contracts.ReferenceSet{Slots: map[string]contracts.ResolvedReferenceSlot{ReferenceSlot: {Items: []contracts.ReferenceItem{{Content: []byte(emptyPrompt)}, {Content: []byte(emptyPrompt)}}}}}, wantError: "exactly one"},
-		{name: "wrong media type", reference: registryReferenceWithMedia([]byte(emptyPrompt), "text/plain"), wantError: "must be application/json"},
-		{name: "malformed JSON", reference: registryReference([]byte(`{"npcs":[],"MALFORMED_REGISTRY_SECRET":`), "file:///private.json"), wantError: "invalid approved NPC JSON", forbidden: []string{"MALFORMED_REGISTRY_SECRET"}},
-		{name: "unknown field", reference: registryReference([]byte(`{"npcs":[],"UNKNOWN_FIELD_SECRET":true}`), "file:///private.json"), wantError: "invalid approved NPC JSON", forbidden: []string{"UNKNOWN_FIELD_SECRET"}},
-		{name: "invalid ID", reference: registryReference(marshalRegistry(t, invalidID), "file:///private.json"), wantError: "decode NPC registry"},
-		{name: "alias collision", reference: registryReference(encodeRegistry(t, valueWithAliasCollision), "file:///private.json"), wantError: string(identity.IssueAliasOwnershipCollision)},
-		{name: "byte limit", reference: registryReference(bytes.Repeat([]byte("x"), MaxBytes+1), "file:///private.json"), wantError: "limit"},
-	}
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			_, err := Resolve(test.reference)
-			if err == nil || !strings.Contains(err.Error(), test.wantError) {
-				t.Fatalf("Resolve() error = %v, want %q", err, test.wantError)
-			}
-			for _, forbidden := range append(test.forbidden, "Mira Thorn", "The Greencloak", "private.json") {
-				if strings.Contains(err.Error(), forbidden) {
-					t.Fatalf("error leaked registry content or provenance %q: %v", forbidden, err)
-				}
-			}
-		})
-	}
-}
-
-func TestResolveBoundsIdentityDiagnosticsWithoutContent(t *testing.T) {
-	const recordCount = 30
-	value := dnd.NPCList{NPCs: make([]dnd.NPC, recordCount)}
-	for index := range value.NPCs {
-		value.NPCs[index] = dnd.NPC{
-			ID:            "npc:sha256:0000000000000000000000000000000000000000000000000000000000000000",
-			Name:          fmt.Sprintf("PRIVATE NPC %d", index),
-			Aliases:       []string{"PRIVATE SHARED ALIAS"},
-			Description:   "PRIVATE DESCRIPTION",
-			Relationships: []dnd.NPCRelationship{},
-			SourceRefs:    []source.SourceRef{{SourceID: "private-source", StartUnitID: 1, EndUnitID: 1}},
+	for _, forbidden := range []string{"npc:sha256:", "source_refs", "source_id", "session-alpha"} {
+		if strings.Contains(string(registry.PromptInput().Content), forbidden) {
+			t.Fatalf("projection leaked %q: %s", forbidden, registry.PromptInput().Content)
 		}
 	}
-	issues := identity.ValidateList(value)
-	if len(issues) <= diagnostics.MaxIssues {
-		t.Fatalf("identity issues = %d, want more than display limit", len(issues))
-	}
-
-	_, err := Resolve(registryReference(marshalRegistry(t, value), "file:///private-registry.json"))
-	if err == nil {
-		t.Fatal("Resolve() error = nil, want bounded identity rejection")
-	}
-	message := err.Error()
-	if !utf8.ValidString(message) || len([]byte(message)) > diagnostics.MaxMessageBytes {
-		t.Fatalf("identity error has invalid encoding or size: bytes=%d message=%q", len([]byte(message)), message)
-	}
-	wantOmitted := fmt.Sprintf("%d additional issue(s) omitted", len(issues)-diagnostics.MaxIssues)
-	if !strings.Contains(message, wantOmitted) {
-		t.Fatalf("identity error = %q, want %q", message, wantOmitted)
-	}
-	for _, forbidden := range []string{"PRIVATE NPC", "PRIVATE SHARED ALIAS", "PRIVATE DESCRIPTION", "private-source", "private-registry.json"} {
-		if strings.Contains(message, forbidden) {
-			t.Fatalf("identity error leaked %q: %s", forbidden, message)
-		}
+	if registry.PromptInput().Digest != registry.ProjectionDigest() || registry.Digest() == registry.ProjectionDigest() {
+		t.Fatalf("full/projection digests = %q/%q", registry.Digest(), registry.ProjectionDigest())
 	}
 }
 
-func TestRegistryAccessorsAndLookupAreDefensive(t *testing.T) {
-	resolved, err := Resolve(registryReference(encodeRegistry(t, validRegistryList()), "file:///npc-registry.json"))
+func TestNameProjectionDigestTracksOnlyNamesAndOrder(t *testing.T) {
+	base := registryFixture()
+	evidenceChanged := registryFixture()
+	evidenceChanged.NPCs[0].ID = "different application id"
+	evidenceChanged.NPCs[0].SourceRefs = []source.SourceRef{{SourceID: "other", StartUnitID: 40, EndUnitID: 41}}
+	baseBytes, err := nameProjection(base)
 	if err != nil {
-		t.Fatalf("Resolve() error = %v, want nil", err)
+		t.Fatal(err)
+	}
+	changedBytes, err := nameProjection(evidenceChanged)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(baseBytes, changedBytes) || semanticDigest(baseBytes) != semanticDigest(changedBytes) {
+		t.Fatalf("equivalent name projections differ: %s / %s", baseBytes, changedBytes)
 	}
 
-	npcs := resolved.NPCs()
+	nameChanged := registryFixture()
+	nameChanged.NPCs[0].Name = "The Greencloak"
+	nameBytes, _ := nameProjection(nameChanged)
+	orderChanged := registryFixture()
+	orderChanged.NPCs[0], orderChanged.NPCs[1] = orderChanged.NPCs[1], orderChanged.NPCs[0]
+	orderBytes, _ := nameProjection(orderChanged)
+	if bytes.Equal(baseBytes, nameBytes) || bytes.Equal(baseBytes, orderBytes) {
+		t.Fatalf("name/order changes did not change projection: %s %s %s", baseBytes, nameBytes, orderBytes)
+	}
+}
+
+func TestRegistryLookupAndAccessorsAreImmutable(t *testing.T) {
+	registry := resolveList(t, registryFixture())
+	if npc, ok := registry.Lookup("  mIRA\u2003thorn "); !ok || npc.Name != "Mira Thorn" {
+		t.Fatalf("Lookup() = %#v, %t", npc, ok)
+	}
+	if _, ok := registry.Lookup("The Greencloak"); ok {
+		t.Fatal("Lookup() accepted a non-canonical name")
+	}
+
+	npcs := registry.NPCs()
 	npcs[0].Name = "changed"
-	npcs[0].Aliases[0] = "changed alias"
-	npcs[0].Relationships[0].Target = "changed target"
-	npcs[0].SourceRefs[0].SourceID = "changed source"
-	if got, ok := resolved.Lookup("The Greencloak"); !ok || got.Name != "Mira Thorn" {
-		t.Fatalf("Lookup() after NPC mutation = %#v, %v, want original NPC", got, ok)
+	npcs[0].SourceRefs[0].SourceID = "changed"
+	content := registry.CanonicalBytes()
+	content[0] = '['
+	input := registry.PromptInput()
+	input.Content[0] = '['
+	if next := registry.NPCs()[0]; next.Name != "Mira Thorn" || next.SourceRefs[0].SourceID != "session-alpha" {
+		t.Fatalf("registry mutated through accessor: %#v", next)
 	}
-
-	wantCanonical := string(resolved.CanonicalBytes())
-	content := resolved.CanonicalBytes()
-	content[0] = 'X'
-	input := resolved.PromptInput()
-	input.Content[0] = 'X'
-	if string(resolved.CanonicalBytes()) != wantCanonical || string(resolved.PromptInput().Content) != wantCanonical {
-		t.Fatal("registry content accessors share mutable state")
-	}
-	if got, ok := resolved.Lookup("  MIRA\u00a0THORN "); !ok || got.Name != "Mira Thorn" {
-		t.Fatalf("Lookup() canonical identity = %#v, %v, want Mira Thorn", got, ok)
-	}
-	if _, ok := resolved.Lookup("unknown NPC"); ok {
-		t.Fatal("Lookup() found unknown NPC")
+	if registry.CanonicalBytes()[0] != '{' || registry.PromptInput().Content[0] != '{' {
+		t.Fatal("registry bytes mutated through accessor")
 	}
 }
 
-func TestResolverUsesSeededFallbackAndCachesGeneratedCanonicalRegistry(t *testing.T) {
-	staticContent := encodeRegistry(t, validRegistryList())
-	resolver, err := NewResolver(registryReference(staticContent, "file:///static.json"))
-	if err != nil {
-		t.Fatalf("NewResolver() error = %v", err)
-	}
-	if got, err := resolver.Resolve(contracts.ReferenceSet{}); err != nil || got != resolver.Seeded() {
-		t.Fatalf("Resolve(absent) = %p, %v, want seeded %p", got, err, resolver.Seeded())
-	}
-
-	generated := registryReference(append([]byte("\n"), staticContent...), "file:///generated.json")
-	first, err := resolver.Resolve(generated)
-	if err != nil {
-		t.Fatalf("Resolve(generated) error = %v", err)
-	}
-	second, err := resolver.Resolve(generated)
-	if err != nil {
-		t.Fatalf("Resolve(generated second) error = %v", err)
-	}
-	if first != resolver.Seeded() || second != first {
-		t.Fatalf("resolved registries = %p, %p, seeded %p; want seeded reuse", first, second, resolver.Seeded())
-	}
-
-	changed := validRegistryList()
-	changed.NPCs[0].Description = "A changed generated description."
-	changedContent := encodeRegistry(t, changed)
-	changedReferences := registryReference(changedContent, "file:///changed.json")
-	resolved, err := resolver.Resolve(changedReferences)
-	if err != nil {
-		t.Fatalf("Resolve(changed) error = %v", err)
-	}
-	changedReferences.Slots[ReferenceSlot].Items[0].Content[0] = 'X'
-	if resolved == first || string(resolved.CanonicalBytes()) != string(changedContent) {
-		t.Fatalf("changed registry = %p/%s, want independent canonical cache entry", resolved, resolved.CanonicalBytes())
-	}
-}
-
-func TestResolverSharesOneCachedRegistryAcrossConcurrentOperations(t *testing.T) {
-	content := encodeRegistry(t, validRegistryList())
-	resolver, err := NewResolver(contracts.ReferenceSet{})
-	if err != nil {
-		t.Fatalf("NewResolver() error = %v", err)
-	}
-	references := registryReference(content, "file:///generated.json")
-	const callers = 32
-	results := make(chan *Registry, callers)
-	errors := make(chan error, callers)
-	var wait sync.WaitGroup
-	for index := 0; index < callers; index++ {
-		wait.Add(1)
-		go func() {
-			defer wait.Done()
-			resolved, resolveErr := resolver.Resolve(references)
-			if resolveErr != nil {
-				errors <- resolveErr
-				return
-			}
-			results <- resolved
-		}()
-	}
-	wait.Wait()
-	close(results)
-	close(errors)
-	for err := range errors {
-		t.Fatalf("concurrent Resolve() error = %v", err)
-	}
-	var first *Registry
-	for resolved := range results {
-		if first == nil {
-			first = resolved
-		} else if resolved != first {
-			t.Fatalf("concurrent resolved registry %p differs from cached %p", resolved, first)
+func TestResolveRejectsRichOrInvalidRegistryJSON(t *testing.T) {
+	rich := []byte(`{"npcs":[{"id":"npc:sha256:99a16589618a04f535a7d21fdcc71a0b1c05d22f752cd492065b1086d97bc3d7","name":"Mira Thorn","aliases":[],"source_refs":[{"source_id":"session-alpha","start_unit_id":1,"end_unit_id":1}]}]}`)
+	for _, item := range []contracts.ReferenceItem{
+		{MediaType: "application/json", Content: rich},
+		{MediaType: "text/plain", Content: []byte(`{"npcs":[]}`)},
+	} {
+		_, err := Resolve(referenceSet(item))
+		if err == nil {
+			t.Fatalf("Resolve(%s) error = nil", item.Content)
 		}
 	}
 }
 
-func TestNewResolverAllowsGeneratedDeclarationButRejectsMalformedStaticItem(t *testing.T) {
-	placeholder := contracts.ReferenceSet{Slots: map[string]contracts.ResolvedReferenceSlot{
-		ReferenceSlot: {Slot: contracts.ReferenceSlot{Name: ReferenceSlot, AcceptedArtifactKinds: []contracts.ArtifactKind{dnd.NPCListKind}}},
-	}}
-	if _, err := NewResolver(placeholder); err != nil {
-		t.Fatalf("NewResolver(generated declaration) error = %v, want nil", err)
-	}
-	malformed := registryReference([]byte(`{"npcs":[`), "file:///runtime.json")
-	if _, err := NewResolver(malformed); err == nil || !strings.Contains(err.Error(), "invalid approved NPC JSON") {
-		t.Fatalf("NewResolver(malformed) error = %v, want bounded decode failure", err)
-	}
-}
-
-func validRegistryList() dnd.NPCList {
-	return dnd.NPCList{NPCs: []dnd.NPC{{
-		ID:          identity.DeriveID("Mira Thorn"),
-		Name:        "Mira Thorn",
-		Aliases:     []string{"The Greencloak"},
-		Description: "A guarded ranger who watches the northern road.",
-		Relationships: []dnd.NPCRelationship{{
-			Target: "Captain Vale", Relationship: "reports to",
-		}},
-		SourceRefs: []source.SourceRef{{SourceID: "npc-session", StartUnitID: 41, EndUnitID: 43}},
-	}}}
-}
-
-func encodeRegistry(t *testing.T, value dnd.NPCList) []byte {
-	t.Helper()
-	content, err := npccodec.New().Encode(value)
+func TestResolverReusesEquivalentCanonicalRegistries(t *testing.T) {
+	set := listReferenceSet(t, registryFixture())
+	resolver, err := NewResolver(set)
 	if err != nil {
-		t.Fatalf("encode NPC registry: %v", err)
+		t.Fatal(err)
 	}
-	return content
-}
-
-func marshalRegistry(t *testing.T, value dnd.NPCList) []byte {
-	t.Helper()
-	content, err := json.Marshal(value)
-	if err != nil {
-		t.Fatalf("marshal NPC registry: %v", err)
+	resolved, err := resolver.Resolve(set)
+	if err != nil || resolved != resolver.Seeded() {
+		t.Fatalf("Resolve() = %p, %v; seeded %p", resolved, err, resolver.Seeded())
 	}
-	return content
 }
 
-func registryReference(content []byte, origin string) contracts.ReferenceSet {
-	references := registryReferenceWithMedia(content, "application/json; charset=utf-8")
-	item := references.Slots[ReferenceSlot].Items[0]
-	item.Origin.URI = origin
-	slot := references.Slots[ReferenceSlot]
-	slot.Items[0] = item
-	references.Slots[ReferenceSlot] = slot
-	return references
-}
-
-func registryReferenceWithMedia(content []byte, mediaType string) contracts.ReferenceSet {
-	return contracts.ReferenceSet{Slots: map[string]contracts.ResolvedReferenceSlot{
-		ReferenceSlot: {
-			Slot: contracts.ReferenceSlot{Name: ReferenceSlot, AcceptedMediaTypes: []string{npccodec.MediaType}, MaxBytes: MaxBytes},
-			Items: []contracts.ReferenceItem{{
-				SlotName:  ReferenceSlot,
-				MediaType: mediaType,
-				Content:   append([]byte(nil), content...),
-				Origin:    contracts.ReferenceOrigin{Type: "file", URI: "file:///npc-registry.json"},
-			}},
-		},
+func registryFixture() dnd.NPCList {
+	return dnd.NPCList{NPCs: []dnd.NPC{
+		{ID: identity.DeriveID("Mira Thorn"), Name: "Mira Thorn", SourceRefs: []source.SourceRef{{SourceID: "session-alpha", StartUnitID: 1, EndUnitID: 2}}},
+		{ID: identity.DeriveID("Captain Vale"), Name: "Captain Vale", SourceRefs: []source.SourceRef{{SourceID: "session-alpha", StartUnitID: 3, EndUnitID: 3}}},
 	}}
 }
+
+func resolveList(t *testing.T, list dnd.NPCList) *Registry {
+	t.Helper()
+	registry, err := Resolve(listReferenceSet(t, list))
+	if err != nil {
+		t.Fatalf("Resolve() error = %v", err)
+	}
+	return registry
+}
+
+func listReferenceSet(t *testing.T, list dnd.NPCList) contracts.ReferenceSet {
+	t.Helper()
+	content, err := npccodec.New().Encode(list)
+	if err != nil {
+		t.Fatalf("Encode() error = %v", err)
+	}
+	return referenceSet(contracts.ReferenceItem{SlotName: ReferenceSlot, MediaType: npccodec.MediaType, Content: content})
+}
+
+func referenceSet(item contracts.ReferenceItem) contracts.ReferenceSet {
+	return contracts.ReferenceSet{Slots: map[string]contracts.ResolvedReferenceSlot{ReferenceSlot: {Items: []contracts.ReferenceItem{item}}}}
+}
+
+func TestProjectionIsStableForEquivalentNormalizedRegistries(t *testing.T) {
+	first := resolveList(t, registryFixture())
+	secondList := registryFixture()
+	secondList.NPCs[0].SourceRefs = append(secondList.NPCs[0].SourceRefs, source.SourceRef{SourceID: "session-beta", StartUnitID: 8, EndUnitID: 8})
+	second := resolveList(t, secondList)
+	if !reflect.DeepEqual(first.PromptInput().Content, second.PromptInput().Content) || first.ProjectionDigest() != second.ProjectionDigest() || first.Digest() == second.Digest() {
+		t.Fatalf("projection/full identity mismatch: %#v %#v", first, second)
+	}
+}