V40 Promotion: Harden staging URL evidence checks

Replace substring-based Supabase REST URL evidence checks with parsed exact URL matching so canonical V40 reports validate the staging endpoint without admitting arbitrary host prefixes or suffixes.\n\nProof: generate-v40-ledger-storage-sync --check; generate-v40-local-staging-rehearsal-automation --check; focused V40 ledger/local staging protocol tests; check-v40-gate11 promoted mode; protocol typecheck; git diff --check.

Author: geraldarthurdavis

packages/protocol/src/canonical/v40-ledger-storage-sync.js

@@ -89,6 +89,12 @@ const SOURCE_ROOTS = Object.freeze({
   canonWorkflow: '.github/workflows/bitcode-canon-quality.yml',
 });
 
+const STAGING_SUPABASE_PROJECT_REF = 'tkpyosihuouusyaxtbau';
+const STAGING_SUPABASE_REST_URL = new URL(
+  `https://${STAGING_SUPABASE_PROJECT_REF}.supabase.co/rest/v1/`,
+);
+const HTTPS_URL_LITERAL_PATTERN = /https:\/\/[^\s'"`<>)]*/g;
+
 function digest(value) {
   return crypto.createHash('sha256').update(value).digest('hex').slice(0, 24);
 }
@@ -110,6 +116,26 @@ function predicateResult(id, sourcePath, passed) {
   return { id, sourcePath, passed: Boolean(passed) };
 }
 
+function sourceContainsExactHttpsUrl(source, expectedUrl) {
+  return Array.from(source.matchAll(HTTPS_URL_LITERAL_PATTERN)).some((match) => {
+    try {
+      const parsed = new URL(match[0]);
+      return (
+        parsed.protocol === expectedUrl.protocol &&
+        parsed.username === '' &&
+        parsed.password === '' &&
+        parsed.hostname === expectedUrl.hostname &&
+        parsed.port === expectedUrl.port &&
+        parsed.pathname === expectedUrl.pathname &&
+        parsed.search === expectedUrl.search &&
+        parsed.hash === expectedUrl.hash
+      );
+    } catch {
+      return false;
+    }
+  });
+}
+
 function row(input) {
   return {
     ...input,
@@ -324,8 +350,8 @@ function buildPredicateResults(repoRoot) {
       'local-staging-sync-readback-covered',
       SOURCE_ROOTS.localStagingRehearsal,
       sources.localStagingRehearsal.includes('ledgerDatabaseStorageSynchronized') &&
-        sources.localStagingRehearsal.includes('tkpyosihuouusyaxtbau') &&
-        sources.localStagingRehearsal.includes('https://tkpyosihuouusyaxtbau.supabase.co/rest/v1/'),
+        sources.localStagingRehearsal.includes(STAGING_SUPABASE_PROJECT_REF) &&
+        sourceContainsExactHttpsUrl(sources.localStagingRehearsal, STAGING_SUPABASE_REST_URL),
     ),
     predicateResult(
       'uapi-contract-covers-ledger-storage-sync',

packages/protocol/src/canonical/v40-local-staging-rehearsal-automation.js

@@ -88,6 +88,12 @@ const SOURCE_ROOTS = Object.freeze({
   canonWorkflow: '.github/workflows/bitcode-canon-quality.yml',
 });
 
+const STAGING_SUPABASE_PROJECT_REF = 'tkpyosihuouusyaxtbau';
+const STAGING_SUPABASE_REST_URL = new URL(
+  `https://${STAGING_SUPABASE_PROJECT_REF}.supabase.co/rest/v1/`,
+);
+const HTTPS_URL_LITERAL_PATTERN = /https:\/\/[^\s'"`<>)]*/g;
+
 function digest(value) {
   return crypto.createHash('sha256').update(value).digest('hex').slice(0, 24);
 }
@@ -109,6 +115,26 @@ function predicateResult(id, sourcePath, passed) {
   return { id, sourcePath, passed: Boolean(passed) };
 }
 
+function sourceContainsExactHttpsUrl(source, expectedUrl) {
+  return Array.from(source.matchAll(HTTPS_URL_LITERAL_PATTERN)).some((match) => {
+    try {
+      const parsed = new URL(match[0]);
+      return (
+        parsed.protocol === expectedUrl.protocol &&
+        parsed.username === '' &&
+        parsed.password === '' &&
+        parsed.hostname === expectedUrl.hostname &&
+        parsed.port === expectedUrl.port &&
+        parsed.pathname === expectedUrl.pathname &&
+        parsed.search === expectedUrl.search &&
+        parsed.hash === expectedUrl.hash
+      );
+    } catch {
+      return false;
+    }
+  });
+}
+
 function row(input) {
   return {
     ...input,
@@ -283,8 +309,8 @@ function buildPredicateResults(repoRoot) {
     predicateResult(
       'operator-script-binds-staging-project',
       SOURCE_ROOTS.operatorScript,
-      sources.operatorScript.includes('tkpyosihuouusyaxtbau') &&
-        sources.operatorScript.includes('https://tkpyosihuouusyaxtbau.supabase.co/rest/v1/') &&
+      sources.operatorScript.includes(STAGING_SUPABASE_PROJECT_REF) &&
+        sourceContainsExactHttpsUrl(sources.operatorScript, STAGING_SUPABASE_REST_URL) &&
         sources.operatorScript.includes('staging-testnet-real-inference'),
     ),
     predicateResult(