kobold-json 0.1.0

# kobold-json

**Forensic JSON evidence packets for COBOL record migration.** Export a raw COBOL record + its copybook
into a deterministic JSON packet that preserves **both the semantic value AND the storage truth** —
`offset` / `length` / `pic` / `raw_hex` / `encoding` / `copybook_hash` / `record_hash` / `findings` /
`roundtrip` — and import it back to the exact original bytes. **Fail-closed.**

> [!IMPORTANT]
> **kobold-json is clean-room and zero-libcob.** It links no COBOL runtime, contains no libcob-derived or
> GnuCOBOL-derived code, and depends on no `gnucobol-rs*` crate. It is **not a generic JSON library** and
> **not a GnuCOBOL 3.2 parity claim.** It answers *"what should a forensic JSON evidence packet for a COBOL
> record migration look like?"* Evidence here is the `KOBOLD.JSON.*` court namespace.

## Why

A migration must be **auditable**: when a COBOL record becomes JSON, you need to prove (a) what each field
*means* and (b) that no byte was silently lost, coerced, or truncated on the way out — or on the way back.
kobold-json carries the raw bytes alongside the decoded value and **emits a `Finding` instead of silently
coercing** when a numeric field is not valid digits, when a value overflows its PIC, etc.

## Packet modes (`KOBOLD.JSON.EXPORT.1`)

| Mode       | Contents                                                                                   |
|------------|--------------------------------------------------------------------------------------------|
| `Compact`  | `{record, fields:{NAME:value}}` — decoded values only.                                      |
| `Audit`    | adds per field `{value, pic, offset, length, raw_hex, findings}`.                          |
| `Evidence` | adds `copybook_hash`, `record_hash`, `roundtrip:{byte_reconstructable, requires_raw_hex}`. |

Numeric rendering: leading zeros stripped, decimal point at the implied `scale`, leading `-` if negative.
`raw_hex` is lowercase hex of the exact field bytes.

## Courts

- `KOBOLD.JSON.EXPORT.1` — record + copybook → audit packet.
- `KOBOLD.JSON.PARSE.1` — packet + copybook → reconstructed bytes, **fail-closed** (no silent truncation /
  coercion; overflow or a non-numeric value into a numeric field yields a `Finding`, not bytes).
- `KOBOLD.JSON.ROUNDTRIP.1` — bytes → Evidence packet → `parse_into` → **identical** bytes.
- `KOBOLD.JSON.REDACTION.1` — mask / hash / remove named fields while preserving packet structure.
- `KOBOLD.JSON.DIFF.1` — per-path differences between two packets.

## Dependency-free

No crate dependencies. SHA-256 (for `copybook_hash` / `record_hash`) is a small pure-Rust implementation in
`src/sha256.rs`, tested against published vectors. `#![forbid(unsafe_code)]`.

License: Apache-2.0.