Every handoff is checked against a contract
Sixteen JSON schemas sit between the stages, one for every point where a stage hands work to the next, and each describes the exact shape that handover has to take. Work moves on only once it matches, so a bad output fails loudly at the boundary instead of quietly downstream.