fix(contract): align reviewed beta API provenance

contracts/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "MorphIQ API",
     "description": "Native HTTP API for MorphIQ Labs pricing, risk and regime analysis",
-    "version": "3.0.0"
+    "version": "0.1.0"
   },
   "paths": {
     "/health": {

contracts/provenance.json

@@ -1,10 +1,10 @@
 {
   "repository": "https://gitlab.com/prophetizo/morphiq-labs/sites/morphiq-api",
-  "source_commit": "b2cb8d72b049d61c062f787724c1c02c15dd12be",
+  "source_commit": "d2eb8d4d05d9c84dc8e9ac4d7b3016d1133d8d4f",
   "source_path": "services/api/openapi.json",
-  "contract_version": "3.0.0",
-  "sha256": "09527006497b4f23bbf174f4a5b8bd9d02f75d02554b3d489eaba953ec5a18f1",
-  "import_method": "Reviewed main snapshot copied byte-for-byte from the immutable Git commit; automated artifact publication remains SDK #2.",
+  "contract_version": "0.1.0",
+  "sha256": "d9a746af609cba68d768c4b743061fd3e91cbe04cd4242c954e48c01f286031d",
+  "import_method": "Reviewed immutable API source snapshot from MR !183, copied byte-for-byte; native synthetic fixture responses verified with a --locked build.",
   "covered_operations": [
     "POST /v1/price",
     "POST /v1/regime",

docs/CONTRACT.md

@@ -9,9 +9,10 @@ coordinates the producer/import workflow with
 [API #106](https://gitlab.com/prophetizo/morphiq-labs/sites/morphiq-api/-/work_items/106).
 contracts/openapi.json now contains the reviewed snapshot byte-for-byte.
 contracts/provenance.json records its digest, API source commit and contract
-version. It was copied from immutable reviewed main source; automated published
-artifact delivery remains #2. SDK tests and builds use the offline snapshot
-without private repository or numerical engine access.
+version. It was copied from the immutable API source commit reviewed in
+[API MR !183](https://gitlab.com/prophetizo/morphiq-labs/sites/morphiq-api/-/merge_requests/183);
+automated published artifact delivery remains #2. SDK tests and builds use the
+offline snapshot without private repository or numerical engine access.
 
 The SDK covers POST /v1/price, POST /v1/greeks, POST /v1/implied-volatility,
 POST /v1/analytics, their four `:batch` routes, and POST /v1/regime. Hand-written model field sets and serialized
@@ -36,8 +37,7 @@ needs a production key here or establishes a public deployment.
 
 Regime tests use a hand-authored synthetic wire fixture, not a recorded model
 prediction. They cover the three head statuses, ordered scores, consumed-range
-metadata, model provenance and service errors. The reviewed OpenAPI bytes and
-source identity are unchanged. Optional controlled-service integration checks
+metadata, model provenance and service errors. Optional controlled-service integration checks
 SDK results against native JSON; it does not expect synthetic fixture scores.
 
 Greeks, implied-volatility and analytics fixtures contain synthetic inputs evaluated by the

tests/fixtures/analytics.json

@@ -1,6 +1,6 @@
 {
-  "source_commit": "b2cb8d72b049d61c062f787724c1c02c15dd12be",
-  "contract_sha256": "09527006497b4f23bbf174f4a5b8bd9d02f75d02554b3d489eaba953ec5a18f1",
+  "source_commit": "d2eb8d4d05d9c84dc8e9ac4d7b3016d1133d8d4f",
+  "contract_sha256": "d9a746af609cba68d768c4b743061fd3e91cbe04cd4242c954e48c01f286031d",
   "admission": "open",
   "note": "Synthetic inputs evaluated by the native API built with --locked from the pinned source commit. Served OpenAPI digest verified. Request IDs normalized; open mode does not report commercial CU. No Python numerical implementation.",
   "cases": [

tests/fixtures/batch.json

@@ -1,6 +1,6 @@
 {
-  "source_commit": "b2cb8d72b049d61c062f787724c1c02c15dd12be",
-  "contract_sha256": "09527006497b4f23bbf174f4a5b8bd9d02f75d02554b3d489eaba953ec5a18f1",
+  "source_commit": "d2eb8d4d05d9c84dc8e9ac4d7b3016d1133d8d4f",
+  "contract_sha256": "d9a746af609cba68d768c4b743061fd3e91cbe04cd4242c954e48c01f286031d",
   "admission": "open",
   "note": "Synthetic inputs evaluated by the native API built with --locked from the pinned source commit. Served OpenAPI digest verified. Request IDs normalized; open mode does not report commercial CU. No Python numerical implementation.",
   "cases": [

tests/fixtures/greeks.json

@@ -1,6 +1,6 @@
 {
-  "source_commit": "b2cb8d72b049d61c062f787724c1c02c15dd12be",
-  "contract_sha256": "09527006497b4f23bbf174f4a5b8bd9d02f75d02554b3d489eaba953ec5a18f1",
+  "source_commit": "d2eb8d4d05d9c84dc8e9ac4d7b3016d1133d8d4f",
+  "contract_sha256": "d9a746af609cba68d768c4b743061fd3e91cbe04cd4242c954e48c01f286031d",
   "admission": "open",
   "note": "Synthetic inputs evaluated by the native API built with --locked from the pinned source commit. Served OpenAPI digest verified. Request IDs normalized; open mode does not report commercial CU. No Python numerical implementation.",
   "cases": [

tests/fixtures/implied_volatility.json

@@ -1,6 +1,6 @@
 {
-  "source_commit": "b2cb8d72b049d61c062f787724c1c02c15dd12be",
-  "contract_sha256": "09527006497b4f23bbf174f4a5b8bd9d02f75d02554b3d489eaba953ec5a18f1",
+  "source_commit": "d2eb8d4d05d9c84dc8e9ac4d7b3016d1133d8d4f",
+  "contract_sha256": "d9a746af609cba68d768c4b743061fd3e91cbe04cd4242c954e48c01f286031d",
   "admission": "open",
   "note": "Synthetic inputs evaluated by the native API built with --locked from the pinned source commit. Served OpenAPI digest verified. Request IDs normalized; open mode does not report commercial CU. No Python numerical implementation.",
   "cases": [

tests/fixtures/pricing.json

@@ -1,6 +1,6 @@
 {
-  "source_commit": "b2cb8d72b049d61c062f787724c1c02c15dd12be",
-  "contract_sha256": "09527006497b4f23bbf174f4a5b8bd9d02f75d02554b3d489eaba953ec5a18f1",
+  "source_commit": "d2eb8d4d05d9c84dc8e9ac4d7b3016d1133d8d4f",
+  "contract_sha256": "d9a746af609cba68d768c4b743061fd3e91cbe04cd4242c954e48c01f286031d",
   "admission": "open",
   "note": "Synthetic inputs evaluated by the pinned native API. Request IDs normalized. Commercial CU metadata is absent in open mode.",
   "cases": [