Reject duplicate world-class artifact refs

reports/architecture_maintainability.json

@@ -87,7 +87,7 @@
     },
     {
       "path": "scripts/world_class_evidence_contract.py",
-      "lines": 620,
+      "lines": 627,
       "kind": "internal-module",
       "severity": "pass",
       "recommendation": "Watch this file before adding new responsibilities; extract a helper module when one concern dominates."

reports/architecture_maintainability.md

@@ -42,7 +42,7 @@ No near-threshold files found.
 | `scripts/review_studio_gates.py` | `643` | `internal-module` | `pass` |
 | `scripts/cross_packager.py` | `638` | `cli-script` | `pass` |
 | `scripts/build_skill_atlas.py` | `637` | `cli-script` | `pass` |
-| `scripts/world_class_evidence_contract.py` | `620` | `internal-module` | `pass` |
+| `scripts/world_class_evidence_contract.py` | `627` | `internal-module` | `pass` |
 | `scripts/render_benchmark_reproducibility.py` | `595` | `cli-script` | `pass` |
 | `scripts/optimize_description.py` | `585` | `cli-script` | `pass` |
 

reports/context_budget.json

@@ -6,15 +6,15 @@
     "context_budget_tier": "production",
     "context_budget_limit": 1000,
     "skill_body_tokens": 797,
-    "other_text_tokens": 1063452,
+    "other_text_tokens": 1063691,
     "estimated_initial_load_tokens": 990,
-    "estimated_total_text_tokens": 1064249,
-    "deferred_resource_tokens": 492676,
+    "estimated_total_text_tokens": 1064488,
+    "deferred_resource_tokens": 492741,
     "deferred_resource_warn_threshold": 120000,
     "deferred_resource_dirs": [
       {
         "path": "scripts",
-        "estimated_tokens": 432578,
+        "estimated_tokens": 432643,
         "file_count": 137
       },
       {
@@ -36,7 +36,7 @@
     "large_deferred_resource_dirs": [
       {
         "path": "scripts",
-        "estimated_tokens": 432578,
+        "estimated_tokens": 432643,
         "file_count": 137
       }
     ],
@@ -59,7 +59,7 @@
           ],
           "missing": [],
           "path": "scripts",
-          "estimated_tokens": 432578,
+          "estimated_tokens": 432643,
           "file_count": 137,
           "rationale": "Script resources are deterministic deferred tools, not initial-load prompt context."
         }

reports/context_budget.md

@@ -2,7 +2,7 @@
 
 | Target | Path | Tier | Limit | Initial | SKILL | Deferred | Resource Governance | Large Deferred Dirs | Quality Density | Unused Dirs | Status |
 | --- | --- | --- | ---: | ---: | ---: | ---: | --- | --- | ---: | --- | --- |
-| root | `.` | `production` | 1000 | 990 | 797 | 492676 | `governed` | scripts:432578 | 131.3 | - | ok |
+| root | `.` | `production` | 1000 | 990 | 797 | 492741 | `governed` | scripts:432643 | 131.3 | - | ok |
 | complex-release-orchestrator | `examples/complex-release-orchestrator/generated-skill` | `production` | 1000 | 790 | 718 | 1657 | `not-required` | - | 164.6 | - | ok |
 | governed-incident-command | `examples/governed-incident-command/generated-skill` | `production` | 1000 | 760 | 658 | 1030 | `not-required` | - | 171.1 | - | ok |
 

reports/context_budget_summary.json

@@ -8,11 +8,11 @@
       "budget_limit": 1000,
       "initial_tokens": 990,
       "skill_body_tokens": 797,
-      "deferred_resource_tokens": 492676,
+      "deferred_resource_tokens": 492741,
       "large_deferred_resource_dirs": [
         {
           "path": "scripts",
-          "estimated_tokens": 432578,
+          "estimated_tokens": 432643,
           "file_count": 137
         }
       ],
@@ -35,7 +35,7 @@
             ],
             "missing": [],
             "path": "scripts",
-            "estimated_tokens": 432578,
+            "estimated_tokens": 432643,
             "file_count": 137,
             "rationale": "Script resources are deterministic deferred tools, not initial-load prompt context."
           }

reports/security_trust_report.json

@@ -23,7 +23,7 @@
     "interactive_script_count": 0,
     "package_hash_scope": "source-contract-without-generated-reports",
     "package_hash_file_count": 228,
-    "package_sha256": "c2ad60de7b1e3d70021ec9e0169a8f8c8c860ff830a434baba2ce44e2530069e"
+    "package_sha256": "2646b8f6692f6f51b8cb8dcc3007f05348033c6de1aa1d850e85199489e3c336"
   },
   "failures": [],
   "warnings": [],

reports/security_trust_report.md

@@ -16,7 +16,7 @@
 - Interactive scripts: `0`
 - Package hash scope: `source-contract-without-generated-reports`
 - Package hash files: `228`
-- Package SHA256: `c2ad60de7b1e3d70021ec9e0169a8f8c8c860ff830a434baba2ce44e2530069e`
+- Package SHA256: `2646b8f6692f6f51b8cb8dcc3007f05348033c6de1aa1d850e85199489e3c336`
 
 ## Failures
 

scripts/world_class_evidence_contract.py

@@ -258,6 +258,7 @@ def validate_artifact_refs(
     add_error(errors, isinstance(refs, list) and len(refs) > 0, "artifact_refs must contain at least one reference")
     required_paths = REQUIRED_REAL_ARTIFACT_PATHS.get(str(payload.get("evidence_key", "")), set())
     observed_paths: set[str] = set()
+    seen_artifact_paths: set[str] = set()
     stats = {
         "artifact_ref_count": len(refs) if isinstance(refs, list) else 0,
         "artifact_existing_count": 0,
@@ -287,6 +288,12 @@ def validate_artifact_refs(
             errors.append(f"artifact_refs[{index}].path {path_error}")
             continue
         rel = rel_path(resolved, root)
+        add_error(
+            errors,
+            rel not in seen_artifact_paths,
+            f"artifact_refs[{index}].path must not duplicate another artifact reference",
+        )
+        seen_artifact_paths.add(rel)
         if rel in DISALLOWED_REAL_ARTIFACTS:
             errors.append(f"artifact_refs[{index}].path must not reference raw local telemetry logs")
         if not resolved.exists() or not resolved.is_file():

tests/verify_world_class_evidence_intake.py

@@ -301,6 +301,19 @@ def assert_external_contract_artifact_validation() -> None:
         template_expected=False,
     )
     assert provider_valid["status"] == "pass", provider_valid
+    provider_duplicate_ref = provider_artifact_submission(skill_root)
+    provider_duplicate_ref["artifact_refs"].append(dict(provider_duplicate_ref["artifact_refs"][0]))
+    provider_duplicate_result = validate_payload(
+        provider_duplicate_ref,
+        provider_entry,
+        path=skill_root / "evidence" / "world_class" / "submissions" / "provider-holdout.json",
+        root=skill_root,
+        template_expected=False,
+    )
+    assert provider_duplicate_result["status"] == "fail", provider_duplicate_result
+    assert any("must not duplicate another artifact reference" in error for error in provider_duplicate_result["errors"]), (
+        provider_duplicate_result["errors"]
+    )
     provider_wrong_filename = validate_payload(
         provider_artifact_submission(skill_root),
         provider_entry,