validatord: /v1/validate + /v1/iterate HTTP surface (port 3221)

Closes the last "Go primary" backlog item in
docs/ARCHITECTURE_COMPARISON.md. Go now owns the entire validator
path end-to-end — no Rust dep for staffing safety net.

Architecture: cmd/validatord on :3221 hosts both endpoints. Calls
chatd directly for the iterate loop's LLM hop (no gateway
self-loopback like the Rust shape). Gateway proxies /v1/validate +
/v1/iterate to validatord.

What's in:
- internal/validator/playbook.go — 3rd validator kind (PRD checks:
  fill: prefix, endorsed_names ≤ target_count×2, fingerprint required)
- internal/validator/lookup_jsonl.go — JSONL roster loader (Parquet
  deferred; producer one-liner documented in package comment)
- internal/validator/iterate.go — ExtractJSON helper + Iterate
  orchestrator with ChatCaller seam for unit tests
- cmd/validatord/main.go — HTTP routes, roster load, chat client
- internal/shared/config.go — ValidatordConfig + gateway URL field
- lakehouse.toml — [validatord] section
- cmd/gateway/main.go — proxy routes for /v1/validate + /v1/iterate

Smoke: 5/5 PASS through gateway :3110:
  ✓ playbook happy path
  ✓ playbook missing fingerprint → 422 schema/fingerprint
  ✓ phantom candidate W-PHANTOM → 422 consistency
  ✓ unknown kind → 400
  ✓ roster loaded with 3 records

go test ./... green across 33 packages.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/shared/config.go

@@ -30,6 +30,7 @@ type Config struct {
 	Matrixd   MatrixdConfig   `toml:"matrixd"`
 	Observerd ObserverdConfig `toml:"observerd"`
 	Chatd     ChatdConfig     `toml:"chatd"`
+	Validatord ValidatordConfig `toml:"validatord"`
 	S3        S3Config        `toml:"s3"`
 	Models    ModelsConfig    `toml:"models"`
 	Log      LogConfig     `toml:"log"`
@@ -70,6 +71,7 @@ type GatewayConfig struct {
 	MatrixdURL   string `toml:"matrixd_url"`
 	ObserverdURL string `toml:"observerd_url"`
 	ChatdURL     string `toml:"chatd_url"`
+	ValidatordURL string `toml:"validatord_url"`
 }
 
 // EmbeddConfig drives the embed service. ProviderURL points at the
@@ -143,6 +145,28 @@ type ChatdConfig struct {
 	TimeoutSecs int `toml:"timeout_secs"`
 }
 
+// ValidatordConfig drives the validator service (cmd/validatord).
+// Hosts /validate (FillValidator + EmailValidator + PlaybookValidator)
+// and /iterate (generate→validate→correct loop). Routes to chatd via
+// ChatdURL for the iteration loop's LLM hops.
+//
+// RosterPath points at a JSONL roster (one WorkerRecord per line) that
+// FillValidator and EmailValidator use for worker-existence checks.
+// Empty disables the roster — worker-existence checks all fail
+// Consistency, which is the correct behavior when the roster isn't
+// configured. Production sets a stable path under /var/lib/lakehouse/.
+type ValidatordConfig struct {
+	Bind        string `toml:"bind"`
+	ChatdURL    string `toml:"chatd_url"`
+	RosterPath  string `toml:"roster_path"`
+	// Per-call cap on the iteration loop. 0 = 3 (Phase 43 default).
+	DefaultMaxIterations int `toml:"default_max_iterations"`
+	// Per-call cap on chat hop max_tokens. 0 = 4096.
+	DefaultMaxTokens int `toml:"default_max_tokens"`
+	// Per-call timeout for the chat hop in seconds. 0 = 240s.
+	ChatTimeoutSecs int `toml:"chat_timeout_secs"`
+}
+
 // ObserverdConfig drives the observer service (cmd/observerd).
 // PersistPath: file path to the JSONL ops log; empty = in-memory
 // only (test/dev). Production sets a stable path under
@@ -328,6 +352,7 @@ func DefaultConfig() Config {
 			MatrixdURL:   "http://127.0.0.1:3218",
 			ObserverdURL: "http://127.0.0.1:3219",
 			ChatdURL:     "http://127.0.0.1:3220",
+			ValidatordURL: "http://127.0.0.1:3221",
 		},
 		Storaged: ServiceConfig{Bind: "127.0.0.1:3211"},
 		Catalogd: CatalogConfig{Bind: "127.0.0.1:3212", StoragedURL: "http://127.0.0.1:3211"},
@@ -361,6 +386,14 @@ func DefaultConfig() Config {
 			Bind: "127.0.0.1:3219",
 			// PersistPath empty by default = in-memory only.
 		},
+		Validatord: ValidatordConfig{
+			Bind:                 "127.0.0.1:3221",
+			ChatdURL:             "http://127.0.0.1:3220",
+			RosterPath:           "", // empty = no roster; worker-existence checks fail Consistency
+			DefaultMaxIterations: 3,
+			DefaultMaxTokens:     4096,
+			ChatTimeoutSecs:      240,
+		},
 		Chatd: ChatdConfig{
 			Bind:               "127.0.0.1:3220",
 			OllamaURL:          "http://localhost:11434",

internal/validator/iterate.go

@@ -0,0 +1,237 @@
+package validator
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+// IterateRequest is the input to Iterate. Mirrors Rust's
+// IterateRequest in `crates/gateway/src/v1/iterate.rs` so JSONL
+// captured from one runtime parses on the other.
+type IterateRequest struct {
+	Kind          string         `json:"kind"`
+	Prompt        string         `json:"prompt"`
+	Provider      string         `json:"provider"`
+	Model         string         `json:"model"`
+	System        string         `json:"system,omitempty"`
+	Context       map[string]any `json:"context,omitempty"`
+	MaxIterations int            `json:"max_iterations,omitempty"`
+	Temperature   *float64       `json:"temperature,omitempty"`
+	MaxTokens     int            `json:"max_tokens,omitempty"`
+}
+
+// IterateAttempt is one row in the history. raw is capped at 2000
+// chars on the wire to keep responses bounded.
+type IterateAttempt struct {
+	Iteration int            `json:"iteration"`
+	Raw       string         `json:"raw"`
+	Status    AttemptStatus  `json:"status"`
+}
+
+// AttemptStatus is the per-attempt verdict. Tagged JSON so consumers
+// can switch on `kind` without trying to parse the optional error.
+type AttemptStatus struct {
+	Kind  string `json:"kind"` // "no_json" | "validation_failed" | "accepted"
+	Error string `json:"error,omitempty"`
+}
+
+// IterateResponse is the success payload (200 + Report + accepted artifact).
+type IterateResponse struct {
+	Artifact   map[string]any   `json:"artifact"`
+	Validation Report           `json:"validation"`
+	Iterations int              `json:"iterations"`
+	History    []IterateAttempt `json:"history"`
+}
+
+// IterateFailure is the max-iter-exhausted payload (422 + history).
+type IterateFailure struct {
+	Error      string           `json:"error"`
+	Iterations int              `json:"iterations"`
+	History    []IterateAttempt `json:"history"`
+}
+
+// ChatCaller is the seam Iterate uses to invoke an LLM. Tests inject
+// scripted callers; production wires this to the chatd /v1/chat HTTP
+// endpoint. Implementations must return the model's textual content
+// (no choices wrapper, no message envelope).
+type ChatCaller func(ctx context.Context, system, user, provider, model string, temperature *float64, maxTokens int) (string, error)
+
+// IterateConfig threads daemon-level settings into the orchestrator.
+type IterateConfig struct {
+	DefaultMaxIterations int
+	DefaultMaxTokens     int
+	DefaultTemperature   float64
+}
+
+const (
+	defaultMaxIterations = 3
+	defaultMaxTokens     = 4096
+	defaultTemperature   = 0.2
+)
+
+// Iterate runs the generate→validate→correct loop. Returns
+// IterateResponse on success (with full history) or IterateFailure
+// on max-iter exhaustion. Infrastructure errors (chat hop fails)
+// surface as Go errors so the HTTP layer can return 502.
+func Iterate(ctx context.Context, req IterateRequest, cfg IterateConfig, chat ChatCaller, validate func(string, map[string]any) (Report, error)) (*IterateResponse, *IterateFailure, error) {
+	maxIter := req.MaxIterations
+	if maxIter <= 0 {
+		maxIter = cfg.DefaultMaxIterations
+	}
+	if maxIter <= 0 {
+		maxIter = defaultMaxIterations
+	}
+	maxTokens := req.MaxTokens
+	if maxTokens <= 0 {
+		maxTokens = cfg.DefaultMaxTokens
+	}
+	if maxTokens <= 0 {
+		maxTokens = defaultMaxTokens
+	}
+	temp := req.Temperature
+	if temp == nil {
+		t := cfg.DefaultTemperature
+		if t == 0 {
+			t = defaultTemperature
+		}
+		temp = &t
+	}
+
+	currentPrompt := req.Prompt
+	history := make([]IterateAttempt, 0, maxIter)
+
+	for i := 0; i < maxIter; i++ {
+		raw, err := chat(ctx, req.System, currentPrompt, req.Provider, req.Model, temp, maxTokens)
+		if err != nil {
+			return nil, nil, fmt.Errorf("/v1/chat hop failed at iter %d: %w", i, err)
+		}
+
+		artifact := ExtractJSON(raw)
+		if artifact == nil {
+			history = append(history, IterateAttempt{
+				Iteration: i,
+				Raw:       trim(raw, 2000),
+				Status:    AttemptStatus{Kind: "no_json"},
+			})
+			currentPrompt = req.Prompt + "\n\nYour previous attempt did not contain a JSON object. Reply with ONLY a valid JSON object matching the requested artifact shape."
+			continue
+		}
+
+		report, vErr := validate(req.Kind, artifact)
+		if vErr == nil {
+			history = append(history, IterateAttempt{
+				Iteration: i,
+				Raw:       trim(raw, 2000),
+				Status:    AttemptStatus{Kind: "accepted"},
+			})
+			return &IterateResponse{
+				Artifact:   artifact,
+				Validation: report,
+				Iterations: i + 1,
+				History:    history,
+			}, nil, nil
+		}
+
+		// Validation failed — append error to prompt for next iter.
+		// The model sees concrete failure mode + retries with corrective
+		// context. Same "validator IS the observer" shape as Phase 43.
+		errSummary := vErr.Error()
+		history = append(history, IterateAttempt{
+			Iteration: i,
+			Raw:       trim(raw, 2000),
+			Status:    AttemptStatus{Kind: "validation_failed", Error: errSummary},
+		})
+		currentPrompt = req.Prompt + "\n\nPrior attempt failed validation:\n" + errSummary + "\n\nFix the specific issue above and respond with a corrected JSON object."
+	}
+
+	return nil, &IterateFailure{
+		Error:      fmt.Sprintf("max iterations reached (%d) without passing validation", maxIter),
+		Iterations: maxIter,
+		History:    history,
+	}, nil
+}
+
+// ExtractJSON pulls the first JSON object from a model's output.
+// Handles fenced code blocks (```json ... ```), bare braces, and
+// stray prose around the JSON. Returns nil on no extractable object.
+//
+// Same algorithm shape as Rust's extract_json so a model producing
+// output that one runtime accepts will be accepted by the other.
+func ExtractJSON(raw string) map[string]any {
+	// Try fenced first.
+	for _, c := range fencedCandidates(raw) {
+		if v, ok := parseObject(c); ok {
+			return v
+		}
+	}
+	// Fall back to outermost {...} balance.
+	bytes := []byte(raw)
+	depth := 0
+	start := -1
+	for i, b := range bytes {
+		switch b {
+		case '{':
+			if start < 0 {
+				start = i
+			}
+			depth++
+		case '}':
+			depth--
+			if depth == 0 && start >= 0 {
+				if v, ok := parseObject(raw[start : i+1]); ok {
+					return v
+				}
+				start = -1
+			}
+		}
+	}
+	return nil
+}
+
+// fencedCandidates returns the bodies of every ``` fenced block in
+// `raw`. Skips an optional language tag on the opening fence (e.g.
+// ```json).
+func fencedCandidates(raw string) []string {
+	var out []string
+	s := raw
+	for {
+		idx := strings.Index(s, "```")
+		if idx < 0 {
+			break
+		}
+		after := s[idx+3:]
+		// Skip optional language tag up to the first newline.
+		bodyStart := strings.Index(after, "\n")
+		if bodyStart < 0 {
+			bodyStart = 0
+		} else {
+			bodyStart++
+		}
+		body := after[bodyStart:]
+		end := strings.Index(body, "```")
+		if end < 0 {
+			break
+		}
+		out = append(out, strings.TrimSpace(body[:end]))
+		s = body[end+3:]
+	}
+	return out
+}
+
+func parseObject(s string) (map[string]any, bool) {
+	var v any
+	if err := json.Unmarshal([]byte(s), &v); err != nil {
+		return nil, false
+	}
+	obj, ok := v.(map[string]any)
+	return obj, ok
+}
+
+func trim(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	return s[:n]
+}

internal/validator/iterate_test.go

@@ -0,0 +1,189 @@
+package validator
+
+import (
+	"context"
+	"errors"
+	"testing"
+)
+
+func TestExtractJSON_FromFencedBlock(t *testing.T) {
+	raw := "Here's my answer:\n```json\n{\"fills\": [{\"candidate_id\": \"W-1\"}]}\n```\nDone."
+	v := ExtractJSON(raw)
+	if v == nil {
+		t.Fatal("expected match in fenced block")
+	}
+	if _, ok := v["fills"]; !ok {
+		t.Errorf("missing fills key: %+v", v)
+	}
+}
+
+func TestExtractJSON_FromBareBraces(t *testing.T) {
+	raw := "Here you go: {\"fills\": [{\"candidate_id\": \"W-2\"}]}"
+	v := ExtractJSON(raw)
+	if v == nil {
+		t.Fatal("expected match in bare braces")
+	}
+}
+
+func TestExtractJSON_ReturnsNilOnNoObject(t *testing.T) {
+	if v := ExtractJSON("just prose, no json"); v != nil {
+		t.Errorf("expected nil, got %+v", v)
+	}
+}
+
+func TestExtractJSON_PicksFirstBalancedObject(t *testing.T) {
+	v := ExtractJSON(`{"a":1} then {"b":2}`)
+	if v == nil {
+		t.Fatal("expected match")
+	}
+	if v["a"].(float64) != 1 {
+		t.Errorf("expected first object, got %+v", v)
+	}
+}
+
+func TestExtractJSON_NestedBalancedObjects(t *testing.T) {
+	v := ExtractJSON(`prefix {"outer": {"inner": [1,2,3]}, "x": "y"} suffix`)
+	if v == nil {
+		t.Fatal("expected match on balanced nested object")
+	}
+	if outer, ok := v["outer"].(map[string]any); !ok || outer["inner"] == nil {
+		t.Errorf("nested structure lost: %+v", v)
+	}
+}
+
+func TestExtractJSON_TopLevelArrayReturnsFirstInnerObject(t *testing.T) {
+	// Both Rust and Go runtimes accept the first balanced {...} as a
+	// successful match — for `[{"a":1},{"b":2}]` that's the first
+	// inner object. Documenting this so the contract stays consistent
+	// across runtimes.
+	v := ExtractJSON(`[{"a":1},{"b":2}]`)
+	if v == nil {
+		t.Fatal("expected first inner object to be returned")
+	}
+	if v["a"].(float64) != 1 {
+		t.Errorf("expected first object {a:1}, got %+v", v)
+	}
+}
+
+// ─── Iterate orchestrator tests with scripted ChatCaller ────────────
+
+func scriptedChat(responses ...string) (ChatCaller, *int) {
+	idx := 0
+	return func(_ context.Context, _, _ string, _, _ string, _ *float64, _ int) (string, error) {
+		if idx >= len(responses) {
+			return "", errors.New("scripted chat exhausted")
+		}
+		r := responses[idx]
+		idx++
+		return r, nil
+	}, &idx
+}
+
+func TestIterate_AcceptsFirstValidArtifact(t *testing.T) {
+	chat, calls := scriptedChat(`{"endorsed_names":["W-1"]}`)
+	validate := func(_ string, _ map[string]any) (Report, error) {
+		return Report{ElapsedMs: 1}, nil
+	}
+	resp, fail, err := Iterate(context.Background(),
+		IterateRequest{Kind: "playbook", Prompt: "produce X", Provider: "ollama", Model: "qwen3.5:latest"},
+		IterateConfig{}, chat, validate)
+	if err != nil || fail != nil {
+		t.Fatalf("expected success, got err=%v fail=%+v", err, fail)
+	}
+	if resp.Iterations != 1 {
+		t.Errorf("iterations = %d, want 1", resp.Iterations)
+	}
+	if len(resp.History) != 1 || resp.History[0].Status.Kind != "accepted" {
+		t.Errorf("history: %+v", resp.History)
+	}
+	if *calls != 1 {
+		t.Errorf("expected 1 chat call, got %d", *calls)
+	}
+}
+
+func TestIterate_RetriesOnNoJsonThenSucceeds(t *testing.T) {
+	chat, _ := scriptedChat(
+		"sorry I cannot do that",
+		`{"endorsed_names":["W-1"]}`,
+	)
+	validate := func(_ string, _ map[string]any) (Report, error) {
+		return Report{}, nil
+	}
+	resp, _, err := Iterate(context.Background(),
+		IterateRequest{Kind: "playbook", Prompt: "produce X", Provider: "ollama", Model: "x"},
+		IterateConfig{}, chat, validate)
+	if err != nil || resp == nil {
+		t.Fatalf("expected success, err=%v", err)
+	}
+	if resp.Iterations != 2 {
+		t.Errorf("iterations = %d, want 2", resp.Iterations)
+	}
+	if resp.History[0].Status.Kind != "no_json" {
+		t.Errorf("first history status: %+v", resp.History[0].Status)
+	}
+}
+
+func TestIterate_RetriesOnValidationFailureThenSucceeds(t *testing.T) {
+	chat, _ := scriptedChat(
+		`{"bad":"shape"}`,
+		`{"good":"shape"}`,
+	)
+	calls := 0
+	validate := func(_ string, body map[string]any) (Report, error) {
+		calls++
+		if _, ok := body["good"]; ok {
+			return Report{}, nil
+		}
+		return Report{}, &ValidationError{Kind: ErrSchema, Field: "x", Reason: "missing good"}
+	}
+	resp, _, err := Iterate(context.Background(),
+		IterateRequest{Kind: "playbook", Prompt: "produce X", Provider: "ollama", Model: "x"},
+		IterateConfig{}, chat, validate)
+	if err != nil || resp == nil {
+		t.Fatalf("expected success, err=%v", err)
+	}
+	if calls != 2 {
+		t.Errorf("validate calls = %d, want 2", calls)
+	}
+	if resp.History[0].Status.Kind != "validation_failed" {
+		t.Errorf("first history status: %+v", resp.History[0].Status)
+	}
+	if resp.History[0].Status.Error == "" {
+		t.Errorf("validation_failed entry must carry error string")
+	}
+}
+
+func TestIterate_MaxIterationsExhaustedReturnsFailure(t *testing.T) {
+	chat, _ := scriptedChat(`{}`, `{}`, `{}`)
+	validate := func(_ string, _ map[string]any) (Report, error) {
+		return Report{}, &ValidationError{Kind: ErrCompleteness, Reason: "always wrong"}
+	}
+	resp, fail, err := Iterate(context.Background(),
+		IterateRequest{Kind: "playbook", Prompt: "X", Provider: "ollama", Model: "x", MaxIterations: 3},
+		IterateConfig{}, chat, validate)
+	if err != nil {
+		t.Fatalf("infrastructure error unexpected: %v", err)
+	}
+	if resp != nil {
+		t.Fatalf("expected failure, got %+v", resp)
+	}
+	if fail.Iterations != 3 {
+		t.Errorf("iterations = %d, want 3", fail.Iterations)
+	}
+	if len(fail.History) != 3 {
+		t.Errorf("history length = %d, want 3", len(fail.History))
+	}
+}
+
+func TestIterate_PropagatesChatInfraError(t *testing.T) {
+	chat := func(_ context.Context, _, _ string, _, _ string, _ *float64, _ int) (string, error) {
+		return "", errors.New("connection refused")
+	}
+	validate := func(_ string, _ map[string]any) (Report, error) { return Report{}, nil }
+	_, _, err := Iterate(context.Background(),
+		IterateRequest{Kind: "playbook", Prompt: "X", Provider: "ollama", Model: "x"},
+		IterateConfig{}, chat, validate)
+	if err == nil {
+		t.Fatal("expected infrastructure error to surface")
+	}
+}

internal/validator/lookup_jsonl.go

@@ -0,0 +1,86 @@
+package validator
+
+import (
+	"bufio"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+)
+
+// rosterRow is the on-disk shape of one line in a roster JSONL.
+// Fields are tolerant — string-valued city/state/role become *string
+// on WorkerRecord; absent or null fields stay nil so the validators
+// know "we don't know" vs "we know it's empty."
+//
+// Mirrors the projection used in the Rust ParquetWorkerLookup so
+// JSONL exported from `workers_500k.parquet` (or a synthetic dataset)
+// loads here without translation. Producer:
+//
+//	duckdb -c "COPY (SELECT candidate_id, name, status, city, state,
+//	  role, blacklisted_clients FROM workers) TO 'roster.jsonl'
+//	  (FORMAT JSON, ARRAY false)"
+type rosterRow struct {
+	CandidateID        string   `json:"candidate_id"`
+	Name               string   `json:"name"`
+	Status             string   `json:"status"`
+	City               *string  `json:"city"`
+	State              *string  `json:"state"`
+	Role               *string  `json:"role"`
+	BlacklistedClients []string `json:"blacklisted_clients"`
+}
+
+// LoadJSONLRoster reads a roster JSONL file and returns an
+// InMemoryWorkerLookup. The validators accept any WorkerLookup, so
+// callers that need a different backing store (e.g. queryd-backed
+// lookup against the live Parquet view) can plug in their own
+// implementation without changing this function.
+//
+// Parse errors on individual lines are skipped, not fatal — the
+// roster is operator-supplied and a corrupted line shouldn't
+// disable the whole validator surface. The return error is for
+// I/O failures (path missing, unreadable).
+//
+// Empty path returns an empty lookup + nil — gives the daemon a
+// "no roster configured" mode where worker-existence checks fail
+// Consistency. Matches the Rust gateway's default.
+func LoadJSONLRoster(path string) (*InMemoryWorkerLookup, error) {
+	if path == "" {
+		return NewInMemoryWorkerLookup(nil), nil
+	}
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, fmt.Errorf("open roster: %w", err)
+	}
+	defer f.Close()
+
+	var records []WorkerRecord
+	scanner := bufio.NewScanner(f)
+	scanner.Buffer(make([]byte, 0, 1<<16), 1<<24)
+	for scanner.Scan() {
+		line := scanner.Bytes()
+		if len(line) == 0 {
+			continue
+		}
+		var row rosterRow
+		if err := json.Unmarshal(line, &row); err != nil {
+			continue // tolerate malformed lines
+		}
+		if strings.TrimSpace(row.CandidateID) == "" {
+			continue
+		}
+		records = append(records, WorkerRecord{
+			CandidateID:        row.CandidateID,
+			Name:               row.Name,
+			Status:             row.Status,
+			City:               row.City,
+			State:              row.State,
+			Role:               row.Role,
+			BlacklistedClients: row.BlacklistedClients,
+		})
+	}
+	if err := scanner.Err(); err != nil {
+		return nil, fmt.Errorf("scan roster: %w", err)
+	}
+	return NewInMemoryWorkerLookup(records), nil
+}

internal/validator/lookup_jsonl_test.go

@@ -0,0 +1,64 @@
+package validator
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLoadJSONLRoster_RoundTripFields(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "roster.jsonl")
+	body := `{"candidate_id":"W-1","name":"Ada","status":"active","city":"Toledo","state":"OH","role":"Welder","blacklisted_clients":["C-1"]}
+{"candidate_id":"W-2","name":"Bea","status":"inactive","city":null,"state":null,"role":null,"blacklisted_clients":[]}
+malformed line that should be skipped
+{"candidate_id":"","name":"empty id","status":"active"}
+`
+	if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
+		t.Fatalf("write fixture: %v", err)
+	}
+
+	l, err := LoadJSONLRoster(path)
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if l.Len() != 2 {
+		t.Fatalf("expected 2 records (skip malformed + empty id), got %d", l.Len())
+	}
+
+	w1, ok := l.Find("W-1")
+	if !ok {
+		t.Fatal("missing W-1")
+	}
+	if w1.City == nil || *w1.City != "Toledo" || w1.Role == nil || *w1.Role != "Welder" {
+		t.Errorf("W-1 fields: %+v", w1)
+	}
+	if len(w1.BlacklistedClients) != 1 || w1.BlacklistedClients[0] != "C-1" {
+		t.Errorf("W-1 blacklist: %+v", w1.BlacklistedClients)
+	}
+
+	w2, ok := l.Find("w-2") // case-insensitive
+	if !ok {
+		t.Fatal("missing W-2 (case-insensitive)")
+	}
+	if w2.City != nil || w2.State != nil || w2.Role != nil {
+		t.Errorf("W-2 should have nil pointers for missing fields: %+v", w2)
+	}
+}
+
+func TestLoadJSONLRoster_EmptyPathReturnsEmptyLookup(t *testing.T) {
+	l, err := LoadJSONLRoster("")
+	if err != nil {
+		t.Fatalf("empty path should not error: %v", err)
+	}
+	if l.Len() != 0 {
+		t.Errorf("expected empty lookup, got len=%d", l.Len())
+	}
+}
+
+func TestLoadJSONLRoster_MissingFileErrors(t *testing.T) {
+	_, err := LoadJSONLRoster("/nonexistent/path/roster.jsonl")
+	if err == nil {
+		t.Fatal("expected error for missing path")
+	}
+}

internal/validator/playbook.go

@@ -0,0 +1,132 @@
+package validator
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+// PlaybookValidator is the Go port of Rust's
+// `crates/validator/src/staffing/playbook.rs`. Sealed playbook
+// validation per Phase 25:
+//
+//   - Operation must be a non-empty string starting with `fill:`
+//   - endorsed_names must be a non-empty array, ≤ target_count × 2
+//   - fingerprint must be non-empty (validity-window requirement)
+//
+// PlaybookValidator is stateless — no WorkerLookup dependency, unlike
+// FillValidator and EmailValidator. The whole validation runs on the
+// artifact body alone.
+type PlaybookValidator struct{}
+
+// NewPlaybookValidator returns a zero-deps validator. Constructor for
+// symmetry with the other two; not strictly required.
+func NewPlaybookValidator() *PlaybookValidator { return &PlaybookValidator{} }
+
+// Name satisfies Validator. Matches Rust's "staffing.playbook" so
+// audit-log scrapes work across runtimes.
+func (PlaybookValidator) Name() string { return "staffing.playbook" }
+
+// Validate runs the four PRD checks. Errors abort the run; warnings
+// (none today) would attach to a passing Report.
+func (v PlaybookValidator) Validate(a Artifact) (Report, error) {
+	started := time.Now()
+	if a.Playbook == nil {
+		return Report{}, &ValidationError{
+			Kind:   ErrSchema,
+			Field:  "artifact",
+			Reason: fmt.Sprintf("PlaybookValidator expects Playbook, got %s", a.Kind()),
+		}
+	}
+	body := a.Playbook
+
+	op, ok := stringField(body, "operation")
+	if !ok {
+		return Report{}, &ValidationError{
+			Kind:   ErrSchema,
+			Field:  "operation",
+			Reason: "missing or not a string",
+		}
+	}
+	if !strings.HasPrefix(op, "fill:") {
+		return Report{}, &ValidationError{
+			Kind:   ErrSchema,
+			Field:  "operation",
+			Reason: fmt.Sprintf("expected `fill: ...` prefix, got %q", op),
+		}
+	}
+
+	endorsed, ok := body["endorsed_names"].([]any)
+	if !ok {
+		return Report{}, &ValidationError{
+			Kind:   ErrSchema,
+			Field:  "endorsed_names",
+			Reason: "missing or not an array",
+		}
+	}
+	if len(endorsed) == 0 {
+		return Report{}, &ValidationError{
+			Kind:   ErrCompleteness,
+			Reason: "endorsed_names must be non-empty",
+		}
+	}
+
+	if target, ok := uintField(body, "target_count"); ok {
+		max := target * 2
+		if uint64(len(endorsed)) > max {
+			return Report{}, &ValidationError{
+				Kind:   ErrCompleteness,
+				Reason: fmt.Sprintf("endorsed_names (%d) exceeds target_count × 2 (%d)", len(endorsed), max),
+			}
+		}
+	}
+
+	if fp, _ := stringField(body, "fingerprint"); fp == "" {
+		return Report{}, &ValidationError{
+			Kind:   ErrSchema,
+			Field:  "fingerprint",
+			Reason: "missing — required for Phase 25 validity window",
+		}
+	}
+
+	return Report{Findings: []Finding{}, ElapsedMs: elapsed(started)}, nil
+}
+
+// stringField returns (val, true) if body[key] is a string, else
+// ("", false). Matches Rust's serde_json::Value::as_str() shape.
+func stringField(body map[string]any, key string) (string, bool) {
+	v, ok := body[key]
+	if !ok {
+		return "", false
+	}
+	s, ok := v.(string)
+	return s, ok
+}
+
+// uintField returns (val, true) if body[key] is a non-negative whole
+// number; matches Rust as_u64. JSON numbers come in as float64, which
+// is why we do the conversion explicitly.
+func uintField(body map[string]any, key string) (uint64, bool) {
+	v, ok := body[key]
+	if !ok || v == nil {
+		return 0, false
+	}
+	switch t := v.(type) {
+	case float64:
+		if t < 0 {
+			return 0, false
+		}
+		return uint64(t), true
+	case int:
+		if t < 0 {
+			return 0, false
+		}
+		return uint64(t), true
+	case int64:
+		if t < 0 {
+			return 0, false
+		}
+		return uint64(t), true
+	}
+	return 0, false
+}

internal/validator/playbook_test.go

@@ -0,0 +1,77 @@
+package validator
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestPlaybook_WellFormedPasses(t *testing.T) {
+	r, err := PlaybookValidator{}.Validate(Artifact{Playbook: map[string]any{
+		"operation":      "fill: Welder x2 in Toledo, OH",
+		"endorsed_names": []any{"W-123", "W-456"},
+		"target_count":   2.0,
+		"fingerprint":    "abc123",
+	}})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if r.ElapsedMs < 0 {
+		t.Errorf("elapsed_ms negative: %d", r.ElapsedMs)
+	}
+}
+
+func TestPlaybook_EmptyEndorsedNamesFailsCompleteness(t *testing.T) {
+	_, err := PlaybookValidator{}.Validate(Artifact{Playbook: map[string]any{
+		"operation":      "fill: Welder x2 in Toledo, OH",
+		"endorsed_names": []any{},
+		"fingerprint":    "abc",
+	}})
+	var ve *ValidationError
+	if !errors.As(err, &ve) || ve.Kind != ErrCompleteness {
+		t.Fatalf("expected Completeness, got %v", err)
+	}
+}
+
+func TestPlaybook_OverfullEndorsedNamesFailsCompleteness(t *testing.T) {
+	_, err := PlaybookValidator{}.Validate(Artifact{Playbook: map[string]any{
+		"operation":      "fill: Welder x1 in Toledo, OH",
+		"endorsed_names": []any{"a", "b", "c"},
+		"target_count":   1.0,
+		"fingerprint":    "abc",
+	}})
+	var ve *ValidationError
+	if !errors.As(err, &ve) || ve.Kind != ErrCompleteness {
+		t.Fatalf("expected Completeness, got %v", err)
+	}
+}
+
+func TestPlaybook_MissingFingerprintFailsSchema(t *testing.T) {
+	_, err := PlaybookValidator{}.Validate(Artifact{Playbook: map[string]any{
+		"operation":      "fill: X x1 in A, B",
+		"endorsed_names": []any{"a"},
+	}})
+	var ve *ValidationError
+	if !errors.As(err, &ve) || ve.Kind != ErrSchema || ve.Field != "fingerprint" {
+		t.Fatalf("expected Schema/fingerprint, got %+v", err)
+	}
+}
+
+func TestPlaybook_WrongOperationPrefixFailsSchema(t *testing.T) {
+	_, err := PlaybookValidator{}.Validate(Artifact{Playbook: map[string]any{
+		"operation":      "sms_draft: hello",
+		"endorsed_names": []any{"a"},
+		"fingerprint":    "x",
+	}})
+	var ve *ValidationError
+	if !errors.As(err, &ve) || ve.Kind != ErrSchema {
+		t.Fatalf("expected Schema, got %v", err)
+	}
+}
+
+func TestPlaybook_WrongArtifactKindFailsSchema(t *testing.T) {
+	_, err := PlaybookValidator{}.Validate(Artifact{FillProposal: map[string]any{}})
+	var ve *ValidationError
+	if !errors.As(err, &ve) || ve.Kind != ErrSchema || ve.Field != "artifact" {
+		t.Fatalf("expected Schema/artifact, got %+v", err)
+	}
+}

internal/validator/types.go

@@ -29,6 +29,8 @@ type Artifact struct {
 	FillProposal map[string]any
 	// EmailDraft: {to, body, subject?, kind?, _context?: {candidate_id?}}
 	EmailDraft map[string]any
+	// Playbook: {operation, endorsed_names, target_count?, fingerprint}
+	Playbook map[string]any
 }
 
 // Kind returns a short string for error messages — mirrors the
@@ -39,6 +41,8 @@ func (a Artifact) Kind() string {
 		return "FillProposal"
 	case a.EmailDraft != nil:
 		return "EmailDraft"
+	case a.Playbook != nil:
+		return "Playbook"
 	default:
 		return "Unknown"
 	}