SYNC-01: define save-bundle identity and conflict contract #647

Work package

SYNC-01 from the repository-owned v3 autonomous work program.

Scope

Define the transport-independent, versioned contract for immutable save bundles before any sync engine, transport, or UI exists.

Acceptance criteria

• A bounded schema covers bundle ID, canonical Bloom GameID, normalized content identity, system, save/state kind and compatibility group, exact backend/component identity when required, source device, lineage, generation, parent payload hash, payload hash/size, optional advisory wall timestamp, and authentication metadata.
• The contract fixes the canonical signed representation and algorithm, paired-device/key identity, deauthorization, rotation, cloned-device, and replay behavior.
• Conflict outcomes are deterministic from identity, compatibility, lineage, generation, parent hash, and payload hash. Wall time never silently selects a winner.
• Invalid, unauthenticated, incompatible, forked, gapped, replay-collision, or unknown-version input fails closed or requires explicit review; it never writes live save directories.
• A checked-in authority, validator, negative fixtures/tests, normative architecture/security documentation, test-matrix entry, release preflight, and risk-scoped CI mapping prevent contract drift.
• This package has no transport, network, device mutation, runtime import/export, live-save access, or UI scope. Those remain SYNC-02 through SYNC-04.

Evidence required

Focused contract tests, Python 3.8 compatibility, CI-scope tests, release preflight, and the repository's risk-3 host gates. No device claim is expected.