refactor: replace OpenSpec with lightweight .agent/contracts/

Author: NathanFlurry

.agent/contracts/README.md

@@ -0,0 +1,26 @@
+# Contracts
+
+Behavioral contracts for secure-exec. These are the source of truth for runtime, bridge, permissions, stdlib, and governance requirements.
+
+## How contracts work
+
+- Contracts define **what the system must do** using Requirement/Scenario/WHEN/THEN format
+- Agents MUST read relevant contracts before implementing changes in contracted areas
+- When a change modifies contracted behavior, the relevant contract MUST be updated in the same PR
+- Any intentional deviation from Node.js behavior MUST be documented in the relevant contract
+- Contracts are reviewed as part of normal PR review — contract changes are code changes
+
+## Contract index
+
+| Contract | Scope |
+|----------|-------|
+| [node-runtime](node-runtime.md) | Runtime execution, module loading, async completion, dynamic imports, CPU limits, timing mitigation, payload limits, logging |
+| [node-bridge](node-bridge.md) | Bridge boundary policy, built-in scope, capability expansion, immutable globals, crypto randomness |
+| [node-stdlib](node-stdlib.md) | Module support tiers, builtin resolution, polyfill patches, deterministic errors |
+| [node-permissions](node-permissions.md) | Deny-by-default permissions, permission helpers, projected node_modules read-only |
+| [compatibility-governance](compatibility-governance.md) | Documentation maintenance, compatibility matrix, friction log, test coverage obligations |
+| [typescript-tools](typescript-tools.md) | Companion TypeScript tooling package contracts |
+| [documentation-site](documentation-site.md) | Docs site page requirements and content contracts |
+| [isolate-runtime-source-architecture](isolate-runtime-source-architecture.md) | Isolate runtime source layout and compilation contracts |
+| [runtime-driver-integration-testing](runtime-driver-integration-testing.md) | Runtime-agnostic test suites, TestContext, target enumeration |
+| [runtime-driver-test-suite-structure](runtime-driver-test-suite-structure.md) | Canonical test layout, shared suite execution |

…c/specs/compatibility-governance/spec.md …nt/contracts/compatibility-governance.mdopenspec/specs/compatibility-governance/spec.md renamed to .agent/contracts/compatibility-governance.md openspec/specs/compatibility-governance/spec.md renamed to .agent/contracts/compatibility-governance.md

@@ -45,15 +45,15 @@ The runtime compatibility target MUST align with the `@types/node` package major
 - **THEN** the declared target MUST match the active `@types/node` major version used by secure-exec validation workflows
 
 ### Requirement: Maintain Secure-Exec Follow-Up Backlog
-Work touching secure-exec behavior SHALL keep follow-up work tracked in OpenSpec change artifacts, including checking off completed tasks and adding newly discovered actionable items as new tasks or follow-up changes.
+Work touching secure-exec behavior SHALL keep follow-up work tracked in GitHub issues, including checking off completed items and filing newly discovered actionable items.
 
 #### Scenario: Implementation resolves tracked backlog work
-- **WHEN** a change completes an item already tracked in OpenSpec tasks
+- **WHEN** a change completes a tracked follow-up item
 - **THEN** the item MUST be marked complete with scope-consistent notes
 
 #### Scenario: Implementation uncovers new follow-up work
 - **WHEN** development reveals a new actionable gap not currently tracked
-- **THEN** a new OpenSpec task or follow-up change MUST be added immediately with enough detail to guide follow-up work
+- **THEN** a new issue or task MUST be filed immediately with enough detail to guide follow-up work
 
 ### Requirement: Maintain Friction Log for Development Issues
 Unexpected issues, workarounds, and integration friction encountered during secure-exec development MUST be recorded in `docs-internal/friction.md`, and resolved items MUST be marked as resolved with fix notes.
@@ -126,7 +126,7 @@ Any runtime timing-hardening behavior that intentionally diverges from default N
 
 #### Scenario: Research and implementation guidance stays aligned
 - **WHEN** timing-side-channel mitigations are proposed or revised
-- **THEN** `docs-internal/research/comparison/cloudflare-workers-isolates.md` MUST be updated so its recommendations match the current OpenSpec change scope
+- **THEN** `docs-internal/research/comparison/cloudflare-workers-isolates.md` MUST be updated so its recommendations match the current contract scope
 
 ### Requirement: CPU Limit Compatibility and Friction Documentation Stays Aligned
 Any change that introduces or modifies the secure-exec CPU time limit contract MUST update compatibility/friction documentation in the same change.
@@ -137,7 +137,7 @@ Any change that introduces or modifies the secure-exec CPU time limit contract M
 
 #### Scenario: Research guidance reflects current CPU limit design
 - **WHEN** CPU limit implementation guidance is revised
-- **THEN** `docs-internal/research/comparison/cloudflare-workers-isolates.md` MUST be updated so recommendations match the active runtime contract and OpenSpec deltas
+- **THEN** `docs-internal/research/comparison/cloudflare-workers-isolates.md` MUST be updated so recommendations match the active runtime contract
 
 ### Requirement: Maintain Canonical Secure-Exec Security Model Documentation
 The project MUST maintain `docs/security-model.mdx` as the canonical security model for secure-exec runtime behavior and deployment assumptions.