Define Comic Manifest v1 contracts and fixtures (Studio #89)

.github/workflows/contracts.yml

@@ -0,0 +1,22 @@
+name: Contract conformance
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions:
+  contents: read
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      matrix:
+        node: [22, 24]
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - run: npm ci --ignore-scripts
+      - run: npm test

.gitignore

@@ -19,3 +19,6 @@ dist/
 build/
 tmp/
 .cache/
+
+# Local conformance dependencies
+node_modules/

CHANGELOG.md

@@ -11,6 +11,12 @@ compatible, or editorial.
 
 ## Unreleased
 
+- Added Comic Manifest 1.0.0 (new additive, unreleased family) for Studio #89:
+  RFC 0007, three closed record schemas, detached approval bindings, normative
+  identity/privacy/compatibility semantics and offline synthetic conformance.
+  Added pinned development test dependencies and CI for contract conformance.
+  Released Prompt SDK, Context Package and Context Builder bytes are unchanged.
+
 - Added Context Builder 1.0.0 (new additive, unreleased contract family) for
   Studio #76: RFC 0006, closed producer schemas, deterministic selection/assembly
   semantics, protected lineage/public receipts and synthetic conformance cases.

README.md

@@ -2,6 +2,10 @@
 
 Stable specifications and contracts for Definitely Secure Studio systems.
 
+The proposed [Comic Manifest v1](specs/manifests/comic-manifest-v1.md) separates
+production, build-result and public release payloads with exact detached approvals.
+See its [conformance fixtures](fixtures/comic-manifest-v1.md) for validation commands.
+
 The unreleased [Context Builder v1 candidate](specs/context-builder/context-builder-v1.md)
 defines explicit preparation requests, source evidence, prepared results and
 public-safe receipt boundaries. It preserves released Context Package v1 bytes.