[Vivswan]

What this changes

parse time   materialPattern() regex over the whole key line
               ->  one structured walk: fields, form checks, the side's algorithm rule, z.base64() on the blob
published    PUBLIC_KEY_PATTERN keeps a hand-spelled base64 grammar (zod's own pattern opens with ^$| and cannot be embedded)
lockstep     test/sections/deploy_keys/published-pattern.test.ts compiles the built schema's pattern with ajv
             and holds it to parsePublicKey's verdict: the e2e generators' keys, a 5,000-key sweep, 14 invalid rows

differential, old against new on verdict, message text, and material:
  20,050 key lines (45 hand-made, 5 generator, 20,000 seeded random)   0 mismatches   952 accepted, 19,098 refused
  published pattern (ajv) against the new parse                        0 mismatches

How

• Two spellings of one rule, by design: zod validates at parse time, the schema needs a pattern string; the lockstep test fails CI when a zod bump moves base64 semantics or one spelling is edited alone.
• Removed: materialPattern, STORED_KEY_PATTERN, the regex-driven parseMaterial, declaredRejection, storedRejection; parseMaterial now yields the material or the reason.
• The one blob where zod and the grammar differ is the empty string, unreachable behind the two-field check on both sides.
• Library: zod's z.base64(), the schema library already in use; ajv in the test, already a devDependency.

Proof

• Tests: deploy_keys, refusal-messages, published-schema, schema-corpus, slice-exports, layout: 183 pass; e2e 373/373; every refusal message byte-identical.
• Gates: typecheck, knip, build:check 14 files unchanged, fleet biome 0, member-shape 0, line cap.

Technical details

• Published pattern text: its two capture groups became non-capturing, the only textual change; the accepted language is unchanged.
• Renamed: BASE64_BLOB is BASE64_PATTERN (the refusal-messages constant table follows).
• Files: src/sections/deploy_keys/schema.ts, test/sections/deploy_keys/published-pattern.test.ts (new), test/sections/refusal-messages.test.ts.

[github-actions]

File size check

0 over a hard cap (fails), 6 warning(s).

File	Size	Tier	Cap
src/engine/diff.ts:56	11 comment lines	warn	10
src/github/api-error.ts:9	11 comment lines	warn	10
src/problem.ts:73	18 comment lines	warn	10
src/sections/contract/errors.ts:13	11 comment lines	warn	10
src/sections/contract/module.ts:55	12 comment lines	warn	10
src/sections/shared/list/decl.ts:265	14 comment lines	warn	10

Split the file, wrap the line, shorten or exempt the comment, or list the path in .file-size-allow.local with a # reason.

5 managed file(s) skipped; repo-platform owns them.

[Copilot]

🟢 Approval recommended

The focused parser refactor and schema-agreement tests have no identified blocking defects.

No open issues 🎉

What changed in this PR

Refactors deploy-key parsing to validate the base64 field with z.base64(), while retaining a separate pattern for the published JSON Schema.

Changes:

• Replaces regex-driven parsing with structured field, form, algorithm, and base64 checks.
• Adds tests comparing the published schema pattern with parser verdicts across generated, randomized, and invalid keys.
• Updates the refusal-message test's constant list for the renamed base64 pattern.

File	Description
test/​sections/​refusal-messages.test.ts	Updates the base64 constant name in the test allowlist.
test/​sections/​deploy_keys/​published-pattern.test.ts	Adds schema-pattern and parser agreement tests.
src/​sections/​deploy_keys/​schema.ts	Introduces structured parsing with Zod base64 validation.

_{Review effort: Balanced}