Timmy companion: fail-closed hostile JSON, structured deltas, source_issue validation, bytecode cleanup

Addresses the four release-critical blockers from Timmy's review of PR #42:
1. Guard enum/allowlist membership against unhashable JSON (lists/dicts) in
   form.state, receipt.signed_by, and validate_transition target.
2. Require audience_choice.source_issue to be a positive non-bool integer.
3. Make power/scar/cost deltas structured (before -> after), not prose.
4. Remove tracked .pyc bytecode; prove clean checkout stays clean after tests.

Adds 21 new negative tests across HostileJsonFailClosedTests,
SourceIssueValidationTests, and StructuredDeltaTests.

Based on PR #42 head (0b74302). Vincent retains full authorship of the
canon validator, lifecycle model, and r2 review response; this branch
contains only the integration fixes needed to make the stated security
contract true at hostile-input boundaries.

Refs: #19, PR #42

tests/test_canon_validator.py

@@ -39,9 +39,9 @@ def _valid_receipt():
         "episode_id": "01-pilot",
         "form_id": "wizard",
         "action": "mutation",
-        "power_delta": "Added lifecycle state tracking",
-        "scar_delta": "Receipts now enforce structured provenance",
-        "cost_delta": "Every drop requires a signed, bound receipt",
+        "power_delta": "0 -> 1",
+        "scar_delta": "0 -> 1",
+        "cost_delta": "0 -> 1",
         "provenance": {"source_issue": 19, "pull": 27},
         "signed_by": "agent:vincent",
     }
@@ -381,6 +381,137 @@ class TransitionTests(unittest.TestCase):
         self.assertFalse(result["valid"])
 
 
+class HostileJsonFailClosedTests(unittest.TestCase):
+    """Hostile but JSON-valid values must return errors, never raise."""
+
+    def test_form_state_list_fails_closed(self):
+        data = _valid_canon()
+        data["forms"][0]["state"] = []
+        result = cv.validate_canon(data)  # must not raise
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("invalid state" in e for e in result["errors"]))
+
+    def test_form_state_dict_fails_closed(self):
+        data = _valid_canon()
+        data["forms"][0]["state"] = {}
+        result = cv.validate_canon(data)  # must not raise
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("invalid state" in e for e in result["errors"]))
+
+    def test_transition_target_list_fails_closed(self):
+        result = cv.validate_transition({"id": "wizard", "state": "candidate"}, [])
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("invalid target state" in e for e in result["errors"]))
+
+    def test_transition_target_dict_fails_closed(self):
+        result = cv.validate_transition({"id": "wizard", "state": "candidate"}, {})
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("invalid target state" in e for e in result["errors"]))
+
+    def test_receipt_signed_by_list_fails_closed(self):
+        data = _valid_canon()
+        r = _valid_receipt()
+        r["signed_by"] = []
+        data["receipts"] = [r]
+        result = cv.validate_canon(data)  # must not raise
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("'signed_by' must be a non-empty string" in e for e in result["errors"]))
+
+    def test_receipt_signed_by_dict_fails_closed(self):
+        data = _valid_canon()
+        r = _valid_receipt()
+        r["signed_by"] = {}
+        data["receipts"] = [r]
+        result = cv.validate_canon(data)  # must not raise
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("'signed_by' must be a non-empty string" in e for e in result["errors"]))
+
+
+class SourceIssueValidationTests(unittest.TestCase):
+    """audience_choice.source_issue must be a positive non-bool integer."""
+
+    def _committed_with(self, si):
+        data = _committed_canon()
+        data["audience_choice"]["source_issue"] = si
+        return data
+
+    def test_valid_positive_int_passes(self):
+        result = cv.validate_canon(self._committed_with(19))
+        self.assertTrue(result["valid"], result["errors"])
+
+    def test_empty_string_fails(self):
+        result = cv.validate_canon(self._committed_with(""))
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("source_issue must be a positive integer" in e for e in result["errors"]))
+
+    def test_none_fails(self):
+        result = cv.validate_canon(self._committed_with(None))
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("source_issue must be a positive integer" in e for e in result["errors"]))
+
+    def test_zero_fails(self):
+        result = cv.validate_canon(self._committed_with(0))
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("source_issue must be a positive integer" in e for e in result["errors"]))
+
+    def test_false_fails(self):
+        result = cv.validate_canon(self._committed_with(False))
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("source_issue must be a positive integer" in e for e in result["errors"]))
+
+    def test_list_fails(self):
+        result = cv.validate_canon(self._committed_with([]))
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("source_issue must be a positive integer" in e for e in result["errors"]))
+
+    def test_negative_fails(self):
+        result = cv.validate_canon(self._committed_with(-5))
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("source_issue must be a positive integer" in e for e in result["errors"]))
+
+    def test_true_fails(self):
+        result = cv.validate_canon(self._committed_with(True))
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("source_issue must be a positive integer" in e for e in result["errors"]))
+
+
+class StructuredDeltaTests(unittest.TestCase):
+    """power/scar/cost deltas must bind before/after, not just prose."""
+
+    def test_structured_delta_passes(self):
+        data = _valid_canon()
+        data["receipts"] = [_valid_receipt()]
+        result = cv.validate_canon(data)
+        self.assertTrue(result["valid"], result["errors"])
+
+    def test_prose_only_delta_fails(self):
+        data = _valid_canon()
+        r = _valid_receipt()
+        r["power_delta"] = "Added lifecycle state tracking"
+        data["receipts"] = [r]
+        result = cv.validate_canon(data)
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("must bind before/after" in e for e in result["errors"]))
+
+    def test_empty_arrow_delta_fails(self):
+        data = _valid_canon()
+        r = _valid_receipt()
+        r["power_delta"] = "->"
+        data["receipts"] = [r]
+        result = cv.validate_canon(data)
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("must bind before/after" in e for e in result["errors"]))
+
+    def test_missing_before_fails(self):
+        data = _valid_canon()
+        r = _valid_receipt()
+        r["scar_delta"] = " -> 1"
+        data["receipts"] = [r]
+        result = cv.validate_canon(data)
+        self.assertFalse(result["valid"])
+        self.assertTrue(any("must bind before/after" in e for e in result["errors"]))
+
+
 class DailyReceiptFixtureTests(unittest.TestCase):
     """Daily Lab receipt fixtures with structured provenance binding."""