Export artifact bytes explicitly

scripts/cli-first-contract-smoke.js

@@ -81,6 +81,11 @@ expect(
   "CLI-first non-e2e gate wording",
   /scripts\/acceptance-cli-first\.sh[\s\S]*final public-release e2e remains intentionally excluded/
 );
+expect(
+  criteria,
+  "artifact export explicit local byte write",
+  /artifact export <id> --to <path>` writes bytes[\s\S]*explicit bounded download stream[\s\S]*complete staged content is available/
+);
 expect(
   cliFirstAcceptance,
   "CLI-first acceptance report",
@@ -330,6 +335,21 @@ expect(
   "CLI blocks build before scheduling unsafe inputs",
   /blocked_before_schedule[\s\S]*scheduled_work[\s\S]*false/
 );
+expect(
+  cli,
+  "CLI artifact export writes explicit local bytes from stream content",
+  /fn artifact_export_local_write_followup[\s\S]*open_artifact_download_stream[\s\S]*content_base64[\s\S]*std::fs::write/
+);
+expect(
+  cli,
+  "CLI artifact export keeps content out of reports",
+  /fn artifact_stream_summary[\s\S]*content_material_returned_in_report[\s\S]*false/
+);
+expect(
+  coordinator,
+  "coordinator exposes conservative artifact stream content",
+  /fn download_stream_content_base64[\s\S]*stdout_truncated[\s\S]*artifact_size_bytes[\s\S]*BASE64_STANDARD\.encode/
+);
 
 for (const [name, pattern] of [
   ["agent --json flag", /struct AgentEnrollArgs[\s\S]*#\[arg\(long\)\]\s*json: bool/],