refactor: consolidate coercion helpers (#121366)

* refactor: consolidate coercion helpers

* fix: remove duplicate coercion imports

* fix: preserve serialized coercion guard

* chore: ratchet coercion helper carve-outs

* fix(test): keep gauntlet subprocess startup lean

* fix: preserve imported session timestamp semantics

* fix: preserve catalog timestamp string semantics

* chore: align plugin SDK surface ratchet

* fix: preserve trajectory and SDK string contracts

* fix(test): preserve QA record assertion semantics

* fix: complete standalone record guard rename

* refactor(cron): use canonical string coercion

* fix(acpx): preserve Pi timestamp parsing

* test(channels): adapt custody test harnesses

* test(telegram): classify media harness as test support

* test(acpx): split timestamp contract coverage

* test(channels): support generated custody contracts

* chore: ban the full coercion helper name set

Extends the declaration guard to all eleven consolidated helper names and
renames the cron schedule-identity readNumber wrapper to readScheduleInteger
so the banned generic name cannot regrow.

* fix(scripts): repair release-validation guard drift and lint cause

Restores the renamed isJsonRecord guard in assertTrustedWorkflowHarness after
main added isRecord call sites in parallel, and attaches the caught YAML error
as the thrown error cause (preserve-caught-error was red on main).

* fix: preserve Claude timestamp string semantics

* fix: preserve persisted timestamp string semantics

* fix: preserve date-first timestamp contracts

* fix(openai): harden delegation failure formatting

* chore: close coercion helper guard gaps

* test(openai): model non-error delegation rejection

* chore: refresh plugin SDK API contract

* fix(tasks): use canonical string field reader

* fix(ai): use canonical provider error field coercion

* fix(browser): migrate native bootstrap coercion

* docs(plugin-sdk): clarify text record export compatibility

* fix(gateway): normalize approval execution identity

* test(outbound): isolate message action poll harness

qa/convex-credential-broker/convex/http.ts

@@ -98,7 +98,7 @@ function assertMaintainerAdminAuth(token: string | null) {
   throw new BrokerHttpError(401, "AUTH_INVALID", "Credential broker secret is invalid.");
 }
 
-function asObject(value: unknown) {
+function readJsonObject(value: unknown) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return null;
   }
@@ -112,7 +112,7 @@ async function parseJsonObject(request: Request) {
   } catch {
     throw new BrokerHttpError(400, "INVALID_JSON", "Request body must be valid JSON.");
   }
-  const body = asObject(parsed);
+  const body = readJsonObject(parsed);
   if (!body) {
     throw new BrokerHttpError(400, "INVALID_BODY", "Request body must be a JSON object.");
   }
@@ -131,7 +131,7 @@ function requireString(body: Record<string, unknown>, key: string) {
   return value;
 }
 
-function optionalString(body: Record<string, unknown>, key: string) {
+function readOptionalHttpString(body: Record<string, unknown>, key: string) {
   if (!(key in body) || body[key] === undefined || body[key] === null) {
     return undefined;
   }
@@ -145,7 +145,7 @@ function optionalString(body: Record<string, unknown>, key: string) {
 
 function requireObject(body: Record<string, unknown>, key: string) {
   const raw = body[key];
-  const parsed = asObject(raw);
+  const parsed = readJsonObject(raw);
   if (!parsed) {
     throw new BrokerHttpError(400, "INVALID_BODY", `Expected "${key}" to be a JSON object.`);
   }
@@ -189,7 +189,7 @@ function optionalBoolean(body: Record<string, unknown>, key: string) {
 }
 
 function optionalCredentialStatus(body: Record<string, unknown>, key: string) {
-  const value = optionalString(body, key);
+  const value = readOptionalHttpString(body, key);
   if (!value) {
     return undefined;
   }
@@ -204,7 +204,7 @@ function optionalCredentialStatus(body: Record<string, unknown>, key: string) {
 }
 
 function optionalListStatus(body: Record<string, unknown>, key: string) {
-  const value = optionalString(body, key);
+  const value = readOptionalHttpString(body, key);
   if (!value) {
     return undefined;
   }
@@ -406,8 +406,8 @@ http.route({
       const result = await ctx.runMutation(internal.credentials.addCredentialSet, {
         kind,
         payload,
-        note: optionalString(body, "note"),
-        actorId: optionalString(body, "actorId"),
+        note: readOptionalHttpString(body, "note"),
+        actorId: readOptionalHttpString(body, "actorId"),
         status: optionalCredentialStatus(body, "status"),
       });
       return jsonResponse(200, result);
@@ -429,7 +429,7 @@ http.route({
         credentialId: normalizeCredentialId(
           requireString(body, "credentialId"),
         ) as Id<"credential_sets">,
-        actorId: optionalString(body, "actorId"),
+        actorId: readOptionalHttpString(body, "actorId"),
       });
       return jsonResponse(200, result);
     } catch (error) {
@@ -447,7 +447,7 @@ http.route({
       assertMaintainerAdminAuth(parseBearerToken(request));
       const body = await parseJsonObject(request);
       const result = await ctx.runQuery(internal.credentials.listCredentialSets, {
-        kind: optionalString(body, "kind"),
+        kind: readOptionalHttpString(body, "kind"),
         status: optionalListStatus(body, "status"),
         includePayload: optionalBoolean(body, "includePayload"),
         limit: optionalPositiveInteger(body, "limit"),

qa/convex-credential-broker/convex/payload_validation.ts

@@ -163,14 +163,14 @@ function normalizeBuzzCredentialPayload(
       'Credential payload for kind "buzz" must use distinct driver and SUT identities.',
     );
   }
-  const optionalString = (key: "driverAuthTag" | "sutAuthTag") => {
+  const readOptionalBuzzAuthTag = (key: "driverAuthTag" | "sutAuthTag") => {
     if (payload[key] === undefined) {
       return undefined;
     }
     return requireBuzzAuthTag(payload, key, createFailure);
   };
-  const driverAuthTag = optionalString("driverAuthTag");
-  const sutAuthTag = optionalString("sutAuthTag");
+  const driverAuthTag = readOptionalBuzzAuthTag("driverAuthTag");
+  const sutAuthTag = readOptionalBuzzAuthTag("sutAuthTag");
 
   return {
     relayUrl,