Module safety 

Fail-closed safety invariants (INTERFACES.md Part 2 “Safety Invariants on Order”). The pipeline checks these after every transform; a violation rolls that transform back (pre-transform bytes restored) rather than shipping a corrupted or unsafe output.

Functions

json_key_order_preserved

Invariant 2: after any JSON transform, every object’s key order must be unchanged. Compares the depth-first sequence of object keys (not values, not array lengths — a transform may legitimately shorten an array while leaving every object’s key order alone).

json_still_valid

Invariant 1: after any JSON transform, the output must still parse as JSON.

no_redaction_bypass

Invariant 4: secret_redaction output must not contain any pattern that matched in the original. Re-running redaction over its own output and confirming no further match is found is equivalent to a fresh scan, without needing a separate “scan only” API.

protected_segments_present

Invariant 3: every protected-content segment (system turns, latest user message, diff headers) must still be present, byte-for-byte, somewhere in the output. Segments are checked individually (see budget::protected_segments) because concatenating them into one blob would rarely be contiguous in the real document.