doc_class: reference owner: platform

@layers/onboarding-contracts

Runtime-neutral schemas, hashing rules, version constants, and the executable collection policy for the one-paste onboarding protocol.

The canonical authoring files remain under packages/shared-types/src/http/onboard-agent. pnpm sync copies the exact approved subset into this independently publishable package; pnpm sync:check fails on any byte drift. Consumers must pin an exact package version and load manifest.json before source inspection.

Every SHA-256 in the manifest covers the exact emitted file bytes. Consumers must verify those bytes before parsing rather than reserializing JSON locally. The exported collector target and private-output descriptors are inert data; this package does not spawn a process, open a pipe, or read a workspace. A host must verify the package, manifest, integrity record, and binary checksums before it permits the collector to inspect source.

The V1 policy deliberately permits no follow-up file reads. A later bounded second-pass implementation must publish a new collection-policy version rather than silently widening V1.

The package contains no service credentials, application runtime code, private database schema, or source content. Generated Go policy input consumes the exported collection-policy-v1.json; Go and npm consumers do not restate its constants.