fix: reject malformed nested pilot preregistration input

Reject malformed selection and amendment list entries as structured PRR CLI input errors.

Author: streamentry

docs/evidence/METRICS_CURRENT.md

@@ -5,9 +5,9 @@ Machine-readable snapshot: `outputs/metrics_snapshot.json` regenerated with `mak
 > **Purpose:** One authoritative table of current pipeline metrics. If any doc disagrees
 > with this file, this file wins. Updated whenever benchmark/benchmark config changes.
 >
-> **Last updated:** 2026-09-05 (pilot pre-registration input boundary; benchmark values unchanged)
+> **Last updated:** 2026-09-06 (pilot pre-registration nested input boundary; benchmark values unchanged)
 
-> **Current verification note (2026-09-05):** Phase AA AA6 exposes the AARG-
+> **Current verification note (2026-09-06):** Phase AA AA6 exposes the AARG-
 > reproducibility aggregate through a repeatable CLI/make workflow, while Phase
 > AB AB5 exposes the ABAG- claim-integrity aggregate, Phase AC AC3 exposes the
 > ACDG- aggregate, Phase Y Y5 exposes the YAG- aggregate, and Phase Z Z5
@@ -100,7 +100,7 @@ Machine-readable snapshot: `outputs/metrics_snapshot.json` regenerated with `mak
 > Phase AC AC3 exposes the ACDG-
 > aggregate disconfirming-evidence gate as a repeatable CLI/make workflow. It
 > has 18 focused gate tests plus 2 CLI integration tests. Full pytest
-> collection succeeds at 12,438 tests; the live count is enforced by the
+> collection succeeds at 12,440 tests; the live count is enforced by the
 > current-state alignment test. This artifact does not establish
 > biological validation or benchmark improvement.
 
@@ -122,6 +122,12 @@ Machine-readable snapshot: `outputs/metrics_snapshot.json` regenerated with `mak
 > exceptions; it does not authenticate signers or establish assay or biological
 > evidence.
 
+> **Pilot pre-registration nested-input note (2026-09-06):** The PRR CLI now
+> rejects non-string selection criteria and amendment-reason entries before
+> semantic validation. This keeps malformed nested data in the structured input
+> error path; it does not authenticate signers or establish assay or biological
+> evidence.
+
 > **Pilot freeze-integrity note (2026-08-24):** Locked PRR- records now require
 > a deterministic SHA-256 over their canonical content. This catches edits to
 > frozen selection criteria and thresholds; it does not authenticate the

docs/getting-started/COMMAND_SURFACE.md

@@ -141,7 +141,7 @@ qualified pilot. A valid record must be locked and carry a matching
 checks record integrity only. It does not authenticate a signer, validate an
 assay, or establish biological evidence.
 Malformed field types are reported as input errors rather than being coerced
-or allowed to crash the command.
+or allowed to crash the command, including malformed nested list entries.
 
 ## Recalibration workflow
 

docs/research/ROADMAP.md

@@ -1,6 +1,6 @@
 # Roadmap
 
-## Current state — 2026-09-05
+## Current state — 2026-09-06
 
 Phase AB is complete as of 2026-07-26. AB5 exposes the existing CSD-, RDR-,
 EGN-, and EHP- claim-integrity artifacts through an ABAG- aggregate, CLI
@@ -208,6 +208,10 @@ On 2026-09-05, the PRR CLI began rejecting malformed field types as structured
 input errors. This prevents permissive coercion or handler crashes at the JSON
 boundary while leaving valid locked and editable records unchanged.
 
+On 2026-09-06, the same boundary began validating nested PRR list entries,
+preventing malformed amendment or selection items from reaching semantic
+validation as unexpected Python types.
+
 This file is the current milestone authority. The older
 [`50_LOOP_PLAN.md`](50_LOOP_PLAN.md) is a historical execution record, not a
 live status page. Select the next bottleneck from

src/openamp_foundry/cli/commands/reports.py

@@ -2063,6 +2063,13 @@ def _run_pilot_preregistration_check(args: argparse.Namespace) -> int:
                 "error": f"Malformed PRR JSON: {field_name} must be a list",
             }))
             return 2
+    for field_name in ("selection_criteria", "amendment_reasons"):
+        if any(not isinstance(item, str) for item in entry_dict.get(field_name, [])):
+            print(json.dumps({
+                "status": "error",
+                "error": f"Malformed PRR JSON: {field_name} entries must be strings",
+            }))
+            return 2
     for field_name in ("dry_lab_only_declaration", "is_locked"):
         if field_name in entry_dict and not isinstance(entry_dict[field_name], bool):
             print(json.dumps({

tests/integration/test_pilot_preregistration_cli.py

@@ -108,3 +108,27 @@ def test_invalid_preregistration_scalar_type_returns_input_error(capsys):
     assert rc == 2
     result = json.loads(capsys.readouterr().out)
     assert "primary_hypothesis must be a string" in result["error"]
+
+
+def test_invalid_preregistration_list_item_returns_input_error(capsys):
+    payload = _locked_payload()
+    payload["amendment_reasons"] = [{"reason": "not-a-string"}]
+    rc = main([
+        "pilot-preregistration-check",
+        "--entry-json", json.dumps(payload),
+    ])
+    assert rc == 2
+    result = json.loads(capsys.readouterr().out)
+    assert "amendment_reasons entries must be strings" in result["error"]
+
+
+def test_non_string_selection_criterion_returns_input_error(capsys):
+    payload = _locked_payload()
+    payload["selection_criteria"] = [42]
+    rc = main([
+        "pilot-preregistration-check",
+        "--entry-json", json.dumps(payload),
+    ])
+    assert rc == 2
+    result = json.loads(capsys.readouterr().out)
+    assert "selection_criteria entries must be strings" in result["error"]