[mikemcdougall]

Issue

Closes #311
Refs #257 (published/source cohort and complete executable-document qualification remain)
Refs honua-io/honua-release#721 (explicit source admission and all original command replays remain)
Refs honua-io/honua-release#652 (original document and augmentation obligations remain)

Summary

Development source installs need immutable resolver and build inputs before the release harness can consider an explicit source admission. Produce review-only inputs for all five required profiles and the original three README/INSTALL contexts with twelve ordered pip invocations, preserving each original command and recording its explicitly derived fixed-interpreter command.

Changes Made

• Bind producer implementation and subject revisions separately, complete tracked source/Git-blob identities, exact package metadata and interpreter/tool bytes.
• Resolve core, grpc, geopandas, raster and combined SDK/all-extras plus Admin; retain original reports and canonical wheel origins, exact versions, filenames, SHA256 digests and recursively verified closure.
• Capture cumulative installed metadata, PEP610 origins and finite file inventories before and after every original source-install step, including exact editable/backend provenance. Rejudge wheel files, pip metadata/scripts/default bytecode and copied source trees; extra or changed inputs refuse.
• Install the separately captured backend closure with hashes before source hooks/builds. Keep source-built and editable wheels distinct from published artifact identities.
• Capture original governed subject 5a79352 under the unchanged pinned documentation image, Python3.12.15 and pip25.0.1. Load only the producer's reviewed packaging wheel read-only; actual child observations and seven refusal cases prove it is excluded from subject processes.
• Retain actual container image/source/command/mount/terminal observations and both output streams. Wait for live owned work; clean up only terminal or never-started containers through normal removal.
• Add focused actual-pip and offline failure controls plus complete original-proposal positive/rejudge and twenty-one mutation checks after generation. Keep raw failing resolver data private until origins validate.
• Rejudge the outer execution receipt through a pure shared verifier bound to separately trusted image/mount/user/source context, thirty-six original public files including the safe pre-action request context, exact action order, original inner proposal bytes and original twelve command declarations. Full inner artifact verification remains mandatory.

Breaking Changes

None. No package version, release pin, publication, original document command, source-admission policy or candidate binding changes.

Gate Impact

• Review-only input production; all admission/qualification/published-identity flags remain false.
• All original35 documents and their commands remain required; default direct-origin refusal remains.

Testing

• Exact c345 head: all required lint/type/package/compatibility/security and eight OS/Python test variants passed; documentation checks passed.
• Source run39397441960: 23 development +9 governed controls passed, including the complete outer positive and26 mutations. Both full producer jobs passed all five profiles, three contexts/twelve ordered pip steps, backend/source builds and21 complete-proposal mutations.
• Exact original e91f image/subject5a producer passed seven actual runtime refusals. Original36-file outer/context/inner readback passed with independently derived5a document declarations and hash-verified index→linux/amd64 manifest→config identity.
• Independent source review clear; zero unresolved threads. Final protected merge admission rechecked at the exact head.

The producer does not execute or grant pass credit to the original non-pip lint/test commands. All35 document replays, source admission, installed-consumer runtime checks and exact-candidate qualification remain separate requirements. A missing final proposal or any failed/partial proof remains nonpassing.

Current head c345f37: fresh source workflow 39397441960 is queued. Historical bce8 source workflow 39394979618 completed successfully: 23 development controls, 8 governed offline controls and both full producer jobs passed. Its single required lint failure (E702) is corrected; actual Docker repeated-inspect mount order is now modeled through complete row-census comparison with retained original bytes. The final source also captures the original pre-action request sidecar, explicit daemon image platform, and a complete outer positive plus 26 refusal controls; fresh exact-head execution remains pending. Historical 9ada governed job 118525181411 completed successfully under the original image; its old outer receipt lacks the new inner-proposal hash and does not qualify the changed head. That head’s host job and all eight OS/Python test variants failed the same obsolete three-run-line workflow fixture, now corrected. Raw outputs and the historical artifact are retained; no source admission or document pass is inferred.

Final c345 proof: source workflow39397441960 completed successfully; governed artifact12254747422 digest sha256:1fbbe5b1cf5145b82ace71e53e5bd751f4a3736e8f3cc4500fd9d013eafee3f3. The original outer verifier readback binds inner proposal06dc513580cc22c16d6a82f11f3dfe8c4ccaa7b670a1d206efd580daa06de59e and contextf029b23189a17eba109155c4e6f30d3595779fbe95b523b1e843d8979883aaf7. Local containerd index ID and CI config ID are retained separately through the exact immutable OCI descriptor chain.

The captured derived recipe uses the original image pip with --isolated/--python into owned environments, a preloaded verified backend and --no-build-isolation. It is an explicit input-proposal context, not an assertion that the unchanged documentation runner’s HOME/default-isolation installs already passed. Release721 must bind its governed context, execute all original commands and verify fresh effects before any source exception.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T09:45:09.455540Z	c345f37	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.