Add private Shepherd archive preflight

[evangauer]

What changed

• add an operator-only, offline Shepherd ZIP preflight that never extracts archive contents
• require a private manifest so participant archive and evidence paths never appear in process arguments
• validate ZIP structure, entry paths/types, resource bounds, CRCs, UTF-8, and supported CSV shapes before reviewed import
• emit only bounded, opaque, privacy-minimized evidence with no filenames, headers, cells, identities, or row excerpts
• document the assisted migration boundary and add the package command
• add adversarial tests for archive bombs, path tricks, corruption, mutation races, CLI failure/redaction contracts, and exact resource limits

Why

Shepherd full exports may arrive as ZIP archives containing participant data and attachments. We need a reviewable way to establish structural safety and identify supported CSV candidates without extracting files, leaking paths or content, claiming importability, or touching a database/network.

Impact

Operators can generate local structural evidence before the existing reviewed CSV dry run. This does not expand the self-serve importer, inspect unsupported attachments as migrated data, or authorize production writes.

Validation

• focused archive preflight suite: 49/49
• full web suite: 3,923 passed / 6 skipped (before the final aggregate-accounting regression)
• web TypeScript check
• Prettier
• tracked and untracked diff checks
• independent security/reliability re-review: no blocker

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openvpm-app	Ready	Preview	Aug 11, 2026 4:27pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
openvpm	Ignored		Aug 11, 2026 4:27pm