feat: implement dcy-007 contract governance and ci gates

docs/project-structure.md

@@ -5,7 +5,7 @@
 - Status: draft
 - Owner: Jarca / project maintainer
 - Last Updated (KST): 2026-06-30
-- Source Discovery / Batch: bootstrap-baseline, BAT-006
+- Source Discovery / Batch: bootstrap-baseline, BAT-006, BAT-007
 
 ## Project Summary
 - Jarca 가계부 전용 MCP 서버와 Streamlit 대시보드로 계좌/카드 거래, 예산, 분류 규칙, import, 현금흐름 분석을 SQLite에 저장하고 운영한다.
@@ -21,6 +21,7 @@
 - pandas / plotly dashboard dependencies
 - PyMuPDF, openpyxl, msoffcrypto-tool
 - pytest
+- ruff
 
 ## Primary Runtime
 - Type: mixed
@@ -60,6 +61,9 @@ jarca-ledger-mcp/
 │   ├── toss_securities_pdf.py
 │   └── seoulpay_xlsx.py
 ├── tests/
+│   ├── contract_snapshots/
+│   │   └── response_contract_v1_0.json
+│   ├── test_contract_regression.py
 │   ├── test_service.py
 │   ├── test_categorization.py
 │   ├── test_category_rule_filters.py
@@ -106,9 +110,11 @@ jarca-ledger-mcp/
 - `dashboard/app.py`
   - Streamlit operator UI for the operations hub summary, transaction filtering, uncategorized triage, rule management, review queues, categories, accounts/liquidity bucket editing, and import operations.
 - `tests/`
-  - Regression tests for service behavior, parser behavior, categorization, category rules, cross-account transfer matching, ledger category semantics, and Streamlit AppTest dashboard smoke.
+  - Regression tests for service behavior, parser behavior, categorization, category rules, cross-account transfer matching, ledger category semantics, MCP response contract compatibility, and Streamlit AppTest dashboard smoke.
+- `tests/contract_snapshots/`
+  - Representative MCP response contract metadata/schemas. Version `1.0` is used by `tests/test_contract_regression.py` and intentionally asserts required subset/types so optional additive fields remain compatible.
 - `.github/workflows/ci.yml`
-  - GitHub Actions workflow for `pull_request`, `push` to `main`, and `workflow_dispatch`; stable required gate jobs are `pytest-regression`, `dashboard-app-test`, `dashboard-http-smoke`, and `db-safety-smoke`.
+  - GitHub Actions workflow for `pull_request`, `push` to `main`, and `workflow_dispatch`; stable required gate jobs are `pytest-regression`, `dashboard-app-test`, `dashboard-http-smoke`, `db-safety-smoke`, `contract-regression`, and `lint`.
 - `scripts/ci_fixture_db.py`
   - Synthetic fixture DB builder for CI/AppTest/smoke checks. Refuses the default operating DB path and seeds only synthetic ledger data.
 - `scripts/ci_dashboard_http_smoke.py`
@@ -133,10 +139,12 @@ jarca-ledger-mcp/
 - Manual reconciliation is represented through memo tags and narrow transaction updates, not broad rewrites.
 - Browser evidence artifacts are generated from synthetic/validation DBs and should not embed real financial identifiers or raw source payloads.
 - CI gate fixtures are generated at runtime under temp space by `scripts/ci_fixture_db.py`; CI and AppTest must not read the default operating DB path.
+- MCP contract regression fixtures use pytest `tmp_path` synthetic DBs and committed schema metadata only; they must not read the operating DB or expose runtime `contract_version` fields.
+- Branch protection required-check contract is documented in `docs/interface-contract.md` and represented by stable workflow job names. Applying branch protection remains an external GitHub repository setting.
 
 ## Current Gaps / Planned Changes
 - Local browser evidence capture exists for core Streamlit pages; browser screenshot/visual regression remains local evidence rather than a required CI gate.
-- CI workflow now covers pytest/AppTest/HTTP smoke/DB safety smoke; branch protection required-check enforcement is a repository setting outside this codebase.
+- CI workflow now covers pytest/AppTest/HTTP smoke/DB safety smoke plus BAT-007 contract-regression/lint required-check jobs; branch protection enforcement remains a repository setting outside this codebase.
 - Long-term policy for accounts without downloadable statements remains partially operational/documentation work.
 - Separate automatic asset snapshots/manual asset tables are not present; BAT-005 uses account rows as the manual asset/liability source.
 
@@ -150,3 +158,4 @@ jarca-ledger-mcp/
 - 2026-06-29 KST: REQ-004/BAT-004 기준으로 `scripts/streamlit_browser_evidence.py` 및 browser evidence artifact 구조 추가.
 - 2026-06-29 KST: REQ-005/BAT-005 기준으로 dashboard operations hub와 service asset liquidity aggregation 책임 추가.
 - 2026-06-30 KST: REQ-006/BAT-006 기준으로 GitHub Actions CI workflow, synthetic fixture DB builder, AppTest/HTTP/DB safety smoke wrappers, CI-vs-local-browser evidence 경계 추가.
+- 2026-06-30 KST: REQ-007/REQ-008/BAT-007 기준으로 MCP response contract snapshot/test 위치와 `contract-regression`/`lint` required-check job 계약 추가.