Prepare governed S1 offsite upload

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02994-7685-7940-bf34-3555b8256018

scripts/s1_backup_contract.py

@@ -95,6 +95,19 @@ def validate_spec(payload: Any, *, policy_path: Path) -> dict[str, Any]:
             if not isinstance(value, int) or isinstance(value, bool) or not low <= value <= high:
                 errors.append(f"retention.{key} must be an integer from {low} to {high}")
 
+    offsite = payload.get("offsite")
+    if not isinstance(offsite, dict) or not isinstance(
+        offsite.get("required_before_prune"), bool
+    ):
+        errors.append("offsite must declare boolean required_before_prune and receipt_root")
+    else:
+        try:
+            receipt_root = _absolute_path(offsite.get("receipt_root"), "offsite.receipt_root")
+            if backup_root and receipt_root != backup_root + "/offsite-receipts":
+                errors.append("offsite.receipt_root must be the bounded backup-root receipt directory")
+        except BackupContractError as exc:
+            errors.append(str(exc))
+
     exclusions = payload.get("excluded_prefixes")
     normalized_exclusions: list[str] = []
     if not isinstance(exclusions, list):