fix(automation): prepare frozen Reddit producer main

[Sam-24-dev]

Summary

• Prepare clean, frozen remote main before bridge freshness, coverage baseline, snapshots or extraction; retain the guard's existing mutex through synchronous child completion.
• Reject inherited Git repository/index/object/config selectors before Git operations in preparation and the child. Diagnostics expose names, never environment values. Regular on-disk global configuration and hooks remain enabled.
• Fetch only remote main atomically into origin/main and a unique owned capture ref; freeze T from that explicit destination, never incidental FETCH_HEAD. Delete only the owned capture with its expected object ID; never roll back existing refs.

Reviewed scope and size exception

Base: 3a78bea.
HEAD: efee0fc.
Owner explicitly authorized size:exception for this existing PR only, with a hard maximum of 535 cumulative changed lines.
Measured complete PR: 532 additions + 2 deletions = 534 lines, seven paths. This is not an additional allowance.

• automation/reddit_output_transaction.psm1: shared fail-closed Git environment assertion; output transaction behavior unchanged.
• automation/run_reddit_baseline_guarded.ps1: preparation and pre-child environment gates under the same mutex; preserve success markers on failure.
• automation/run_reddit_baseline.ps1: revision/environment assertions before baseline and publication, and environment checks before publication Git steps.
• scripts/prepare_reddit_producer.py: bounded noninteractive fetch; explicit main capture; ancestry, control blob/mode, exact lock distribution and guarded fast-forward checks.
• tests/test_reddit_producer_preparation.py: real disposable Git A/B, combined/individual selectors, config overrides, real competing fetch, preserved refs/files/index, normal paths, mutex and failure cases.
• tests/test_local_reddit_runner.py: three necessary fixture lines load the actual shared assertion and verify the intended dirty-output error.
• tests/test_reddit_source_package.py: retain the original two revision-context fixture additions.

No extraction behavior, subreddit scope, retries/backoff, 85% ceiling/local floor, receipt dates/hashes, source-only three-file publication, output rollback, dependency pins, workflows, public assets, datasets or Scheduler/Startup changes.

Counterexample evidence

Before amendment, a real-helper fixture with selectors for B made prepare(A) advance B. A real competing other-branch fetch also made preparation accept that branch via FETCH_HEAD.
Final regressions reject the combined selectors before any Git call and preserve both repositories' HEAD, all refs, index, FETCH_HEAD, status and file hashes. A clean-environment control succeeds for A only.
The real competing fetch still replaces FETCH_HEAD, but prepared T/main select the fetched main commit. The tracking-ref injection is asserted to actually execute; preexisting capture-namespace refs and unrelated refs/files remain preserved.

Executed local checks on final bytes

Existing isolated Python 3.11.9; no installations. Ordinary TDD is OFF under owner policy; no fabricated RED claim.

• Focused: 52 passed (49 preparation cases + 3 legacy preflight cases), 250.17s, exit 0.
• Full backend: 476 passed, 0 skipped, one existing Pandera warning, 387.50s, exit 0.
• Combined safe stdin harness process exited 0 including cleanup: external settings/CSV fixtures, dotenv/network/real publication blocked, logging handlers closed before temporary cleanup.
• A preceding full run had 475 passed/1 fixture failure because it stripped the module import. Only that fixture was corrected; production gates were not weakened. The final counts above supersede that run.
• Ruff 0.11.13 on four changed Python files; external-cache compileall; PowerShell 5.1 parser on guard/runner/module; git diff checks: PASS.
• Bandit 1.8.6 -ll: 0 medium/high findings, 3 low below the existing threshold, 0 files skipped.
• detect-secrets baseline hook on all seven scoped paths: exit 0; baseline bytes unchanged. Staged diff and forbidden-file allowlist checks: PASS.
• Exact amended-HEAD CI is monitored separately. Old green checks do not validate this amendment. No automatic CI reruns.

Exact amended-HEAD CI

All four checks on efee0fc succeeded, attempt 1; no CI reruns requested.

• Backend tests: SUCCESS.
• detect-secrets: SUCCESS.
• Bandit and Semgrep: SUCCESS.
• Frontend quality: SUCCESS.
• Backend collected 476 tests: 466 passed, 10 skipped, 1 existing warning in 84.72s. Eight Windows-only guard cases and two detect-secrets-hook-dependent tests skipped in Backend; all executed locally. Separate Secret Scan executed successfully.
• Frontend analysis, tests/coverage, coverage gates, assets checks and debug web build executed successfully. These checks do not prove a live producer or ETL run.

Limits and activation

• Expected SHA is revision evidence, not mutex ownership proof. Existing disk configuration/hooks remain trusted and are not disabled.
• Fetch/fast-forward state is not undone by output rollback; failure reports original/frozen/actual revisions where available and requires inspection.
• Control changes require separately authorized idle-time installation. Installed dependencies must exactly match the frozen lock; no automatic package installation.
• Automated package admission, hard-timeout fallback, merge and active-clone installation remain separate.
• No real producer, Scheduler task, ETL, workflow dispatch, recovery or deploy was executed. Fixtures/CI do not prove live Sunday-to-Monday success.
• Stop for independent review before merge or activation.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.