Prepare governed Australian source-pack adapters

[edithatogo]

Summary

• Add a hash-pinned restricted-local candidate manifest for six official Australian legislation artifacts.
• Preserve explicit cross-repository provenance references for approved Commonwealth and NSW evidence.
• Add shared fail-closed source validation for HTTPS hosts, version identity, byte counts, formats and SHA-256 pins.
• Add gated Tasmania XML metadata parsing and common gated PDF metadata mapping for ACT, NT, SA, Victoria and WA.
• Make release-submission and install-smoke gates work directly with pnpm when Corepack is unavailable.

Validation

• Full test suite: 159 passed, 10 skipped
• Typecheck: passed
• Provider capability, jurisdiction-mainstreaming, no-placeholder and Conductor gates: passed
• Aggregate release-submission gate: passed, including package install smoke

Boundaries

• Runtime support remains gated; non-Commonwealth Australian providers remain planned/unsupported.
• Source bytes remain restricted-local.
• No publication, redistribution, training, legal certification, profile promotion or release is included.
• This PR is intentionally draft and is not authorized for merge.

[github-actions]

📦 Bundle Size Analysis

Bundle	Size
CLI	12KB
MCP Server	4KB
Total	52KB

Bundle size budget: <5MB (current: 52KB ✅)

[amazon-q-developer]

Review Summary

This PR adds well-structured Australian legislation source adapters with comprehensive security validation. The implementation demonstrates strong security practices including HTTPS-only enforcement, SHA-256 hash validation, byte count verification, and host allowlisting.

Critical Issue Found

One logic error was identified in the Tasmania XML parser that hardcodes a specific act ID, preventing the function from working with other Tasmania legislation. This needs to be fixed before merge.

Testing

The test suite shows excellent coverage with 159 passing tests and proper validation of security constraints. The fail-closed validation approach is appropriate for handling official government sources.

Notes

As stated in the PR description, this remains a draft PR with runtime support gated and is intentionally not authorized for merge. The one critical issue should be addressed before considering any future activation.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[amazon-q-developer]

🛑 Logic Error: Hardcoded act ID check prevents function from working with any other Tasmania legislation. Replace the hardcoded 'act-2009-070' check with validation that the extracted ID matches the artifact's expected ID from metadata or remove this restriction to allow the parser to handle other Tasmania acts.

Suggested change

	if (id !== 'act-2009-070' || title !== source.title) {
	throw new Error('Tasmania XML identity does not match the pinned source artifact');
	}
	if (title !== source.title) {
	throw new Error('Tasmania XML identity does not match the pinned source artifact');
	}

[codecov]

Codecov Report

❌ Patch coverage is 87.80488% with 10 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/providers/official-source-contract.ts	83.3%	7 Missing ⚠️
src/providers/tasmania.ts	91.1%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!

[github-actions]

📦 Bundle Size Analysis

Bundle	Size
CLI	12KB
MCP Server	4KB
Total	52KB

Bundle size budget: <5MB (current: 52KB ✅)

[github-actions]

📦 Bundle Size Analysis

Bundle	Size
CLI	12KB
MCP Server	4KB
Total	52KB

Bundle size budget: <5MB (current: 52KB ✅)

[github-actions]

📦 Bundle Size Analysis

Bundle	Size
CLI	12KB
MCP Server	4KB
Total	52KB

Bundle size budget: <5MB (current: 52KB ✅)