JSON schemas in schemas/ are never loaded at runtime

[SemTiOne]

Context

The repo ships three JSON Schema files in schemas/:

• profile.schema.json
• module.schema.json
• contract.schema.json

These define additionalProperties: false constraints, required fields, type checks, and pattern validations (e.g. module id ^[a-z0-9-]+$). However, no Python code loads or validates against them. They are only referenced in YAML comments for IDE language-server hints:

# yaml-language-server: $schema=../../schemas/module.schema.json

Problem

Profile and module validation is done manually in cli/validator.py (e.g. validate_profile_shape()), which is more permissive than the schemas. For example:

• apiVersion is not validated (schema requires cds/v1alpha1)
• metadata.name, metadata.environment are not checked
• Module id pattern ^[a-z0-9-]+$ is not enforced
• additionalProperties: false is not enforced at the top level

This means a profile or module YAML with extra/unknown keys, wrong apiVersion, or invalid id passes validation silently.

Suggested fix

Load the appropriate JSON Schema in validate_profile_shape() and validate_module_configs() (which already uses Draft202012Validator for per-module config schemas). This would enforce the full schema constraints, not just the manual subset.

Files involved

• schemas/profile.schema.json
• schemas/module.schema.json
• schemas/contract.schema.json
• cli/validator.py