What should a pilot package manifest and loader contract specify?

A pilot package is easier to adopt when its contract is written down and machine-checkable.

**Manifest (`manifest.json`):** - `schema_version` and `release_label` - `files`: name, format (JSONL or Parquet), row count and checksum for each - `seed` and `generator_config` identifiers - `domain` and `authority_structure` descriptors

**Tool specification (`tools.json`):** each action with name, argument schema, return shape and typed errors, for example `escalate` returning `AUTHORITY_TARGET_INVALID` for an illegal target role. Align names with your environment before delivery.

**Loader contract:** primary keys are unique per table, foreign keys resolve, enumerations match the dictionary, and timestamps are ISO 8601. Your loader should fail fast on any breach and report the table and row.

**Reset contract:** the snapshot is the loaded tables only. Task overrides are applied after reset and are listed in the task file. Audit events and agent-created rows are cleared.

**Grader interface:** `grade(snapshot, final_state, audit_log, task) -> {components, failure_modes, passed}` returning JSON, so results from different agents can be compared.

**Versioning:** any change to a field name or enumeration increments `schema_version` and appears in the change log.

Validate the manifest on arrival before running any agent. Checksum or schema failures at that stage are far cheaper to fix than inconsistent results later.