[anth-volk]

Fixes #1402

Summary

Documentation only (docs/orrery-publication.md and two README paragraphs).

• New "Status" section of docs/orrery-publication.md:
  • No upload is published today. The runs application accepts an upload only after the collector authorizes it, and the collector has no authorization endpoint: Authorize independent immutable graph publications calibration-diagnostics#208 was closed unmerged.
  • Builds still queue uploads. A queued job stays pending in the emitter's local queue, its files stay in the preserved directory, and no retry can succeed.
  • The collector will build the Orrery graph files itself: builds submit the graph's inputs (graph.schema.json, graph.execution.json, upstream files and the private native evidence, but not graph.orrery.json) to its artifact intake (Accept artifact submissions into private storage and run worker jobs microcosm-collector#12), and its Orrery worker builds graph.orrery.json from the schema and the execution overlay. The worker keeps the graph of a build that used licensed microdata, as UK builds do, private until output clearance. The direct upload to the runs application is then removed.
  • By default, a build queues an upload only when remote staging is enabled, then stages to Hugging Face under staged/<run_id>/ a bundle holding every file of the queued upload plus graph.execution.json when execution was recorded. The section names the exceptions: an interrupted build, --publish-orrery while staging is local-only or disabled, and Hugging Face staging that failed or did not complete.
• Configuration and migration sections: no longer name Correct current congressional district vintage label #208 or a hosted authorization deployment as a prerequisite.
• README.md: says that no upload is published today, linking the new Status section, and replaces the out-of-date sentence that a published emitter release is required before merge (it linked a #deferred-migration-prerequisites heading the doc no longer has) with a link to the doc's "Emitter dependency" section: Microcosm pins one exact emitter release.

What the statements rest on

• uk_runtime/orrery_publication.py: publication_enabled enables the upload by default only when remote staging is on, and --publish-orrery overrides that. finalize_graph registers every Orrery file in the manifest that the staged bundle is built from.
• uk_runtime/full_build_cli.py: an interrupted build queues the job but returns before staging to Hugging Face.
• microcosm-emitter 0.2.1, the version Microcosm pins (orrery/service/queue.py): every failed attempt leaves the job pending, there is no limit on attempts, and rows are kept "until publication or operator action".
• The collector's submission contract (docs/artifact-submissions.md on the microcosm-collector#12 branch): the orrery-inputs kind takes the schema, the execution overlay, upstream files and evidence, and graph.orrery.json maps to no role because the collector projects its own. Its Disclosure section says the Orrery worker records every Orrery artifact from a submission with licensed_data: true as private, never makes it public itself, and that it becomes public only after output clearance.
• packages/microcosm-build/pyproject.toml requires microcosm-emitter==0.2.1, and uv.lock records that release from PyPI.
• microcosm-runs lib/auth.ts: each upload is sent to the collector's /v1/auth/graph-publication/authorize. The deployed collector's OpenAPI document lists only health, token-exchange and telemetry routes, and that path answers 404.

Checks

• ruff check . (Ruff 0.15.16, as locked): passes.
• python3 tools/ci_test_plan.py verify: passes.
• No tests: no code changed, and no test reads this document.

🤖 Generated with Claude Code