Enforce bounded output repair contracts

internal/domain/output_contract.go

@@ -6,6 +6,8 @@ import (
 	"strings"
 )
 
+const maxOutputRepairAttempts = 3
+
 // ValidateOutputContract validates source-neutral output-contract invariants.
 func ValidateOutputContract(contract OutputContract) error {
 	switch contract.Format {
@@ -26,5 +28,11 @@ func ValidateOutputContract(contract OutputContract) error {
 	if contract.RepairAttempts < 0 {
 		return errors.New("repair_attempts must be greater than or equal to 0")
 	}
+	if contract.RepairAttempts > maxOutputRepairAttempts {
+		return fmt.Errorf("repair_attempts must be less than or equal to %d", maxOutputRepairAttempts)
+	}
+	if contract.ValidationMode == ValidationNone && contract.RepairAttempts > 0 {
+		return errors.New("repair_attempts requires basic, json, or json_schema validation")
+	}
 	return nil
 }