BUG: Contract correctness, serialization, and payload hygiene

[echel0nn]

Labels: bug, contracts
Severity: S2.

Finding (path:line)	Issue
platform/contracts/platform.py:110-118	RegisteredSystem inherits ConfigDict(extra='forbid') from SSHIntegrationInput -> constructing it from an ORM row with a column not on the contract raises ValidationError (a latent 500 identical to the documented MalwareTargetSummary.capability_profile bug, waiting on the next systems-table migration)
platform/contracts/reasoning.py:168,222	observables: dict[str, Any] has no JSON-serializability guard -> a datetime/bytes/custom object passes Pydantic validation then crashes at json.dumps/model_dump(mode='json') on task enqueue or DB write
platform/contracts/obligations.py:184	adjudicate() is called only by nday_researcher.py; the platform never integrates the obligation system into the runtime/workflow -> evidence obligations are unenforced for 5/6 modules
platform/contracts/persist.py:62-70	upsert_many is an N+1 serial loop (one awaited INSERT...ON CONFLICT per record) -> 200-record bulk import is 200 roundtrips; also session.exec() on a raw Insert violates the typed API
platform/contracts/runtime.py	ModulePayload union relies on Pydantic first-match with no discriminator on PlatformRegistryPayload/PlatformCommandPayload -> a dict with unexpected fields silently matches the wrong member
modules/malware/services/observation_store.py:201-230 + agents/tool_executor.py:442	list_for_target has no limit (unbounded DB fetch feeding the prompt) and no insert dedup (same (target,kind,payload_hash) written N times, propagation fans out per sibling with no cap); dict-typed observation values stored with no size cap (a 50MB MCP dict persists verbatim)
modules/malware/services/playbook_proposer.py:288-300	Family attach uses substring fam.name in summary with no ORDER BY -> a short family name matches everything and the first DB-order hit wins (non-deterministic)

Acceptance: contracts constructed from ORM rows tolerate extra columns (or are built from explicit field maps); observables validated JSON-serializable at construction; obligations enforced by the platform or scoped honestly to nday; upsert_many batched; the payload union uses a real discriminator; observation reads paginated + inserts deduped + value sizes capped; family match deterministic and bounded.

[echel0nn]

Implementation-ready design (2026-07-19). Wave 1b. Full design on disk: .run/designs/DESIGN_storage_contracts.md (8-heading template: grounded problem, design with signatures+DDL+Alembic, reworked concerns, test plan, rollout).

Key moves:

• RegisteredSystem extra=forbid latent-500 fix; observables JSON-serializability guard; obligations enforced platform-side; upsert_many batched.
• ModulePayload real discriminator; observation_store pagination + dedup + size cap; deterministic bounded family match.