feat(02-01): lock the one-route tide record and replay contract

- Reject unknown YAML fields, empty names, duplicate steps and unsafe sidecars
- Treat JSON key order as insignificant and fail missing keys and token types at $.path
- Bound request bodies and refuse oversized or malformed input before writing a fixture

Co-authored-by: Cursor <cursoragent@cursor.com>

cmd/summer/parity_test.go

@@ -74,6 +74,31 @@ func TestParityCommands(t *testing.T) {
 	if !strings.Contains(err.Error(), "1") {
 		t.Fatalf("byte mismatch missing offset: %v", err)
 	}
+
+	badSpec := filepath.Join(outDir, "bad.yaml")
+	if err := os.WriteFile(badSpec, []byte("version: [\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	leftover := filepath.Join(outDir, "should-not-exist.yaml")
+	err = runParity("parity:record", "--spec", badSpec, "--target", origJSON.URL, "--output", leftover)
+	if err == nil {
+		t.Fatal("malformed YAML must fail")
+	}
+	if _, statErr := os.Stat(leftover); !os.IsNotExist(statErr) {
+		t.Fatalf("malformed spec committed a fixture: %v", statErr)
+	}
+
+	keyOrder := httptest.NewServer(jsonHandler(`{"a":"x","z":1}`))
+	t.Cleanup(keyOrder.Close)
+	origKeys := httptest.NewServer(jsonHandler(`{"z":1,"a":"x"}`))
+	t.Cleanup(origKeys.Close)
+	keyFixture := filepath.Join(outDir, "keys.yaml")
+	if err := runParity("parity:record", "--spec", spec, "--target", origKeys.URL, "--output", keyFixture); err != nil {
+		t.Fatalf("record key order: %v", err)
+	}
+	if err := runParity("parity:replay", "--fixtures", keyFixture, "--target", keyOrder.URL); err != nil {
+		t.Fatalf("reordered JSON keys must pass: %v", err)
+	}
 }
 
 func commandNames() []string {