[alibek-seksenali]

Restore reproducible generated TypeScript SDK output and enforce the authored TypeScript/profile-D quality standard for 1MSG-156. The public contract and generated documentation now track API producer 929c4526d3c914984be5a9bab561890a5c610433; all 113 generated runtime files remain byte-identical after actual isolated regeneration.

Quality and contract coverage

• OpenAPI Generator 7.22.0 and its JAR, public contract and compatibility postprocessor are checksum-pinned. Strict indexed/exact-optional compilation includes generated and authored code. Real regeneration rejects edits, deletions and untracked generated additions.
• Enforce independent static/typed lint, dependency-cruiser, production/full Knip, clone/complexity ratchets, documented methods, frozen workspace/tool dependencies and an unconditional required aggregate. Authored JS/TS extensions are covered by actual pre-commit execution and program-membership checks. The sealed shared preset is 1.0.12 with 57 passing regression tests.
• Offline wire tests cover instance/token placement, form fields, omission and non-success responses. Package smoke tests install/import the actual packed public entrypoint.
• Producer synchronization in API PR #122 now consumes a same-run checksummed artifact, preserves consumer tests/configuration/lockfile resolutions and runs all consumer gates before commit/push. This PR records an offline validation artifact, not an npm release.

Validation

The current contract checkpoint is 36620d8c08591a448876f780ebdd65a4d44e1dd9.

• Frozen root/tooling installs and all 57 preset tests passed in a disposable clone of the actual consumer.
• All 17 source/contract/package gates passed on the transferred artifact: source guards, formatting, static/typed lint, strict types, architecture, both Knip graphs, both clone checks, complexity, exception inventory, actual generator/drift checks, real hook/coverage fixtures, 11 behavioral/wire tests, build and installed-package smoke.
• The four transferred files match the verified clone byte-for-byte. Only the root agent guide additionally updates preset/provenance instructions. Final source guards, full formatting and the real commit hook pass without modifying staged bytes.
• Knip, production clone and complexity gates have zero historical allowances. Hosted Quality and its required aggregate both passed on this exact head.

Addressed exceptions and remaining external requirement

Java, Kotlin, Scala, C#, Python, Rust and Ruby generation/build/native tests remain unverified in this multi-language repository. Their 1,576 paths have individually inventoried, owned exceptions expiring 2026-12-11 under 1MSG-156. CI rejects additions, deletions, edits, expiry and exception renewal. A passing inventory guard is not a passing native build; a reviewed native profile is required before changing a frozen tree.

GitHub rejected required-check branch protection with HTTP 403 due to the repository plan. The aggregate runs, but server-side merge enforcement remains an external requirement. Draft PR only; no merge, release, publication or deployment was performed.