fix(automation): admit exact Reddit package before publication

[Sam-24-dev]

Summary

• Add local producer admission against prepared main T, using PR fix(reddit): admit committed source packages in CI #125's shared schema, UTC provenance and coverage validation.
• Bind staging to the initially validated source receipt; require the committed tree and post-hook index to match the admitted complete index before push.
• Preserve existing extraction, file restoration, Git fail-stop behavior and source-only publication. No remote ETL or deployment change.

Scope: six files, 374 changed lines

355 additions + 19 deletions; below the 400-line limit. No size exception requested.

File	Added / deleted	Purpose
automation/run_reddit_baseline.ps1	25 / 2	Worktree identity capture, index admission before commit, committed admission before push
scripts/check_reddit_package_admission.py	98 / 1	Shared blob admission and explicit local modes independent of CI
scripts/prepare_reddit_producer.py	2 / 1	Freeze both newly executed validation dependencies with existing controls
tests/test_reddit_package_admission.py	124 / 0	Real index/blob/mode/provenance and CLI regressions
tests/test_reddit_producer_preparation.py	15 / 0	Refuse changed validation controls before synchronization
tests/test_reddit_source_package.py	91 / 15	Real Git/bare-remote publication-stage, rollback and fail-stop assertions

Contract

1. Retain extraction and existing root/latest/history byte validation. Explicit worktree admission captures a duplicate-free semantic hash of the entire initial receipt, including original CSV digest claims and provenance; JSON LF/CRLF is equivalent.
2. After git add, compare the complete index to T. Require a nonempty package-only A/M subset, all three regular 100644 package blobs (unchanged CSVs allowed), exact hashes, schemas/counts/scope and original receipt identity. Reject unrelated/empty staging, deletion/rename, executable/symlink or unmerged entries.
3. Reuse the same real UTC/window/date/192-hour and max(400, integer-ceil(85% base mentions)) rules. Neither worktree hashes nor CI not-applicable status substitute for producer admission.
4. After commit, require the exact committed tree to equal the captured complete-index fingerprint, sole parent T, and unchanged post-hook index. Independently validate committed package bytes before push.
5. Explicit local CLI modes require no GitHub event, token, PR fetch or Checks API request. CI behavior remains separate and unchanged. Git selectors, mutex ownership and prepared-SHA assertions remain intact.
6. Failure restores only the existing bounded output bytes. It does NOT undo synchronization, index changes, local commits, remote branches or PRs. No reset, clean, automatic retry or destructive cleanup. Next-run preflight remains fail-closed.

Initial implementation verification (HEAD ddc01d7)

Existing isolated Python 3.11.9 and installed dependencies; no installations. Pytest launched through the retained owner-safe stdin harness with -I -B, dotenv denied, external settings/data/log/temp fixtures, file-only Git, live network/gh denied and containment-checked cleanup.

• Final relevant focused selection: 22 passed, 0 skipped, 1 existing warning, 131.68s; PYTEST_EXIT=0, WRAPPER_EXIT=0, EXTERNAL_TEMP_CLEANUP=True.
• Final full backend tests/: 587 passed, 0 skipped, 1 existing warning, 742.37s; PYTEST_EXIT=0, WRAPPER_EXIT=0, EXTERNAL_TEMP_CLEANUP=True.
• Real fixtures cover autocrlf true/false, receipt LF/CRLF, unchanged CSV, altered blobs, duplicate keys, extra/deleted/renamed paths, executable/symlink/unmerged entries, 501 -> reject 425 / accept 426, 400 floor, future/expired/cross-date provenance, coherent staged replacement and commit/index-hook tampering.
• Coherent staged replacement: no local commit or remote branch, restored file bytes and next-run blocked. Hook mutation: local commit retained as evidence, no push, next-run blocked. Existing commit/push/PR failure cases still assert actual stages and Git/remote state.
• Ruff check, in-memory Python compilation, PowerShell 5.1 parser (runner/guard/module), detect-secrets scoped scan (0 findings), and git diff --check passed. Bandit -ll: 0 medium/high; six low findings. Semgrep unavailable locally, not claimed PASS; automatic CI must execute it.
• No frontend changes; no local frontend build performed. No workflow/data/assets/dependency/attribute, protected-clone, Scheduler, production or secret changes.
• Independent read-only six-file review found no blocking defect; all six hashes preserved. Native RDD is disabled/unmanaged; this is not a native receipt or fabricated approval.

Earlier development evidence

• Initial focused run: 171 passed, 7 failed, 1 warning, 603.52s; pytest/wrapper exit 1, cleanup complete. One inspected failure was an LF/CRLF fixture mismatch under byte-preserving attributes; its exact unchanged-CSV assertion was retained and the fixture bytes corrected. Other six detailed tracebacks were truncated and were not independently attributed.
• Intermediate focused run: 182 passed, 0 skipped, 599.51s; pytest/wrapper exit 0 and cleanup complete. It proves intermediate bytes only, not final bytes.
• Final candidate subsequently added original semantic-receipt binding and explicit empty-head rejection, then ran the final checks above. No timeout increases, assertion weakening, added skips or harness-guard widening.

Operational limits / activation

Follow-up to #125. Fixtures and green CI do not prove a live Sunday run. This does not make weekly automation fully autonomous or alter Monday's final acceptance/publication gates. Same-host arbitrary hostile hook code and mutation after final sampling are not OS-level atomicity guarantees.

After independent review and a separate merge authorization, a separately authorized idle-time controlled activation is required: update the active clone's complete control code under its existing mutex, verify the frozen target and installed lockfile versions, and preserve Scheduler/log/state/data. Do not execute the task during activation. No activation or merge is performed by this PR.

Automatic CI on exact HEAD ddc01d7

• Backend: 587 collected; 577 passed, 10 skipped, 1 warning in 103.16s. Eight Windows-only guard/preparation cases and two secret-hook-availability cases skipped in Linux CI; all 587 passed locally.
• Frontend: 145 tests passed; analyze, coverage/no-drop, assets policy and debug web build executed successfully.
• Bandit/Semgrep: both executed successfully; Semgrep 267 rules on 145 files, 0 findings/0 blocking.
• detect-secrets: bulk scan, optional receipt scan and receipt identity check executed successfully.
• Trusted-base admission workflow and exact-head admission result: SUCCESS with classification=code-only, eligibility=not-applicable. This is NOT successful producer package admission and NOT operational Sunday evidence.
• All six displayed checks are successful for this exact HEAD. No automatic/manual reruns, ETL, dispatch, recovery, deployment, protected-clone update or activation performed.

Test-only amendment: HEAD 630b9ea

• Only tests/test_reddit_package_admission.py and tests/test_reddit_source_package.py changed: 40 additions + 4 deletions = 44 versus previous HEAD. Complete PR: 355 additions + 19 deletions = 374, six paths, no size exception.
• Wrong-parent regression now supplies valid original receipt and actual admitted-index fingerprints, proves shared committed eligibility with current UTC provenance/coverage, and requires the exact sole-parent-T rejection. Missing receipt or unrelated validation cannot satisfy it; all four autocrlf/newline variants passed.
• Successful real-Git/local-bare-remote fixture captures the actual admission fingerprint and complete native precommit index. It asserts remote SHA equals the accepted local commit, sole parent T, complete committed tree matches that index, exact CSV blob bytes match original package/receipt, unchanged sentiment CSV, and shared committed blob validation.
• Three production Git blobs/modes and the unchanged preparation-test blob are identical to the reviewed previous HEAD. No timeouts, coverage/freshness rules, production logic or existing rollback/fail-stop assertions changed.

Final-byte local validation (each once)

Explicit existing interpreter: C:\Users\USER\Documents\GitHub\ttap-security-urllib3-20261005.venv311\Scripts\python.exe -I -B - focused|full, retained owner-safe stdin harness; only candidate-root/test-scope substitutions, no safety-guard widening.

• Complete focused tests/test_reddit_package_admission.py + tests/test_reddit_source_package.py: 134 passed, 0 skipped, 1 existing warning in 375.83s; PYTEST_EXIT=0, WRAPPER_EXIT=0, owned EXTERNAL_TEMP_CLEANUP=True.
• Only after focused pytest/wrapper/cleanup succeeded: full backend tests/, 587 passed, 0 skipped, 1 existing warning in 744.19s; PYTEST_EXIT=0, WRAPPER_EXIT=0, owned cleanup complete. No failed executions or automatic local repeats in this amendment.
• Ruff check-only, in-memory compilation, scoped detect-secrets (0 findings) and git diff --check passed. Test-scope Bandit -ll: 0 medium/high, 148 low (assert/subprocess test findings). No installs, lock/data/output changes or live services.
• Existing local named main was not used or updated; all identity/budget comparisons use verified live remote main and explicit base c320ee2.
• Previous CI evidence above belongs to ddc01d7 ONLY. Automatic checks for this new HEAD must be observed separately; no old-head PASS transfers.

Automatic CI for amended HEAD 630b9ea

• All six displayed exact-HEAD checks SUCCESS; these are new automatic executions, not old-head evidence.
• Backend: 587 collected, 577 passed, 10 skipped, 1 warning. Eight Windows-only guard/preparation and two secret-hook-availability cases skipped in Linux CI; local full suite executed all 587 successfully.
• Frontend: 145 candidate tests passed; analyze, coverage/no-drop, assets checks and debug web build successful.
• Bandit/Semgrep: actual successful execution, 267 Semgrep rules on 145 files, 0 findings/0 blocking.
• detect-secrets: successful.
• Admission job and exact-head check: code-only / not-applicable, NOT successful admission of a real producer package.
• One additional conventional test commit and one normal push to the same PR branch; no history rewrite, automatic CI rerun, merge, activation, Scheduler, ETL, dispatch, recovery or deploy.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.