Ingest: accept dependency-free tagged handoffs

[andrebrait]

Summary

• accept a null tagged-handoff builder only when every route row has empty extras
• bind dependency-free package records to that handoff without weakening present-builder or identity checks
• preserve the general loader's compatibility with retained builderless records

Evidence

Frozen RED test	git hash-object	RED run tail
tests/test_pfb_pkg.py	b12793dcea31b6241a4ac05e5b1faad1b921455f	prior faulty head: 1 failed, 13 passed
tests/test_publish_release.py	c677881cf8c4500e98907e610048988e8d1aac35	origin/main production: 6 failed, 8 passed

Final SHA-256:

• tests/test_pfb_pkg.py: b3de1bf5692bb562033e3860cb69b5b0267c3ba3a6caf02fb647e2ac03a1180c
• tests/test_publish_release.py: db956144bc69ed924c8150ff69375d8358a7f35bbdb8a6eeedf08556847e08be

RED:

• final 14 focused tests against origin/main production: 6 failed, 8 passed
• final 14 focused tests against faulty head 027c1707: 1 failed, 13 passed; retained builderless/non-empty records were rejected

GREEN:

• final focused matrix: 14 passed
• full pkg suite: 750 passed, 109 subtests
• CI run 33430999048: python and shell passed
• Grok verification: exact immutable v3.3.7 handoff and 5/5 package records accepted; 86/86 retained canonical packages accepted; hostile intake cases rejected
• Claude mutation verification: valid-digest unknown-field and mixed-route any aggregation mutants both killed

Refs pfBlockerNG/pfBlockerNG#3004

🤖 Generated by Oh My Pi and posted on behalf of @andrebrait.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0b01dbaa-4332-4633-93ae-37fc26563c9e

📥 Commits

Reviewing files that changed from the base of the PR and between 9b355da and 027c170.

📒 Files selected for processing (6)

• scripts/pfb_pkg.py
• scripts/tagged_release_handoff.py
• tests/test_catalogue_assembly.py
• tests/test_pfb_pkg.py
• tests/test_publish_catalogues.py
• tests/test_publish_release.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change removes legacy build-record validation, enforces 40-character port SHAs, and makes dependency_builder conditional on extra packages. Tagged handoffs now support null builders and validate builder consistency for each build record.

Changes

Dependency builder validation

Layer / File(s)	Summary
Build record contract scripts/pfb_pkg.py, tests/test_pfb_pkg.py, tests/test_catalogue_assembly.py, tests/test_publish_catalogues.py	Build records now require the current field set, validate 40-character lowercase port SHAs, and require valid dependency_builder values when extra packages exist. Fixtures and tests use the updated record shape.
Handoff builder binding scripts/tagged_release_handoff.py, tests/test_publish_release.py	Tagged handoffs may omit dependency_builder when route rows have no extra packages. Record validation enforces matching builder presence and values. Tests cover null, valid, missing, malformed, and mismatched builders.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 027c1

The change broadens acceptance of dependency-free tagged handoffs while retaining strict validation for builders, fields, extras, and identity checks. No actionable merge-blocking risk remains beyond normal checks and review.

Poem

I twitch my nose at builders bright

Forty hex marks make records right
Empty extras let builders hide
Matching handoffs stand beside
I hop through tests with pride

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 25 functions across 6 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: ingestion now accepts tagged handoffs without dependency packages or a required dependency builder when effective extras are empty.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[andrebrait]

Independent review audit — 6a708ffaa1c9348db4f4c46664ee19826a410284

• Contract — Codex: CLEAN. Generic retained-record compatibility is unchanged; strict builder/extras and identity enforcement remains at tagged intake.
• Correctness/security — Grok: CLEAN. Exact v3.3.7 handoff plus 5/5 package records passed; 86/86 retained canonical packages and stable CE catalogue generation passed; hostile handoff/record cases rejected.
• Test honesty — Claude: CLEAN. Final 14 tests produced 6 failures / 8 passes against base production and 1 failure / 13 passes against the prior faulty head, then 14 / 14 green. The valid-digest unknown-field and mixed-route aggregation mutants were killed. Full suite: 750 passed plus 109 subtests; exact-head CI run 33430999048 passed.
• Simplicity — Codex: CLEAN, net removable lines: 0. The final production diff stays at the tagged-handoff seam.

CodeRabbit generated no actionable comments on the earlier head; its final-head re-review was quota-limited. Per the repository owner's release-task waiver, it was not re-asked inside the live window; the four independent permitted-model legs above are the merge gate.

🤖 Generated by Oh My Pi and posted on behalf of @andrebrait.