Keep raw invocation provenance separate from the validated proposal digest. Advance the semantic evidence contract to v2 and Copilot suite to 8; preserve denial and attached-operation invariants.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Keep bridge call identity separate from canonical result item identity. Require one complete shell-read lifecycle tied to the started command and reject extra or partial reads.
Co-Authored-By: Paperclip <noreply@paperclip.ing>