fix(source): repair web delta exact-head validation

[bartytime4life]

Status

CONFIRMED: This bounded repair is complete at head 07337d473dda41195cbc41164f4210c5bb7d6c6f. The focused source-web-delta-profile workflow run 31148650755 completed successfully at that exact head.

This pull request remains draft, open, and unmerged.

Failure record

The initial license-respectful web-delta slice landed through PR #2102 at 3fe819cff5e8d6f022c0a0a0dfd9bbb03a5d839c. Repository automation merged it while its focused workflow run 31146556779, job 92767075176, was failing.

The failure was bounded to deterministic fixture validation and test invocation. It did not involve a live source, source rights decision, source activation, lifecycle write, evidence object, policy decision, release, deployment, or publication.

Root cause

Two implementation defects were confirmed:

1. Module-import boundary: the FIFO subprocess and hosted fixture replay invoked validate_web_delta_profile.py by file path. That execution mode did not reliably provide the repository root as Python’s import root, so the expected machine-readable UNSAFE_FILE result was not emitted.
2. Malformed heartbeat digest literals: the two HTTP 304 fixture records contained malformed SHA-256 test literals—two manifest digests were 62 hexadecimal characters and one raw digest was 66. Strict JSON Schema validation therefore stopped before semantic heartbeat assertions. Correcting those literals restored the payload hashes and event IDs already stored in the original fixture manifests.

The generated authoring receipt then became stale as the repair changed tracked artifact bytes.

Repair

• invoke the validator and replay helpers as Python modules;
• expose stored and recomputed payload/event identities in failed fixture assertions;
• retain the three original fixture manifests as immutable lineage;
• add identity-corrections.json as an append-only correction record for exactly two cases and three malformed digest attributes;
• add replay_web_delta_profile_fixtures.py, which verifies every prior value before applying corrections in memory;
• keep the existing source-event-envelope validator as a hard prerequisite;
• emit exact SHA-256 values from the checked-out workflow revision; and
• regenerate the authoring receipt against the exact corrected artifact set.

Exact-head validation

Focused validation at 07337d473dda41195cbc41164f4210c5bb7d6c6f:

• workflow run 31148650755: SUCCESS;
• focused unit tests: 10 passed;
• effective fixture replay: 17 cases;
• expected polarity: 6 PASS / 11 DENY;
• append-only corrections: 2 cases / 3 attributes;
• HTTP 304 no-action heartbeat: PASS;
• license/content-disclosure fail-closed tests: PASS;
• duplicate-key, non-finite-number, oversized-file, symlink, FIFO, unsafe-URL, and placeholder-digest checks: PASS;
• no-network and non-echoing diagnostic boundary: PASS;
• generated-receipt artifact-hash verification: PASS.

This record asserts the focused slice only. It does not represent every repository-wide check as uniformly complete; unrelated or broader hosted checks retain their own dispositions.

Trust boundary and non-effects

This remains fixture-only and no-network. It does not:

• fetch, parse, retain, or diff a live web page;
• decide source rights or license compatibility;
• activate a source or write RAW, WORK, QUARANTINE, PROCESSED, CATALOG, TRIPLETS, or PUBLISHED state;
• create EvidenceBundle, PolicyDecision, ReviewRecord, proof, promotion, or release authority;
• mutate STAC/DCAT/PROV, graph, API, MapLibre, Story Node, AI-answer, or public-product surfaces; or
• merge, release, deploy, promote, or publish.

Unknown or ambiguous rights remain metadata-only and fail closed.

Rollback

Before merge, close this draft pull request and delete agent/source-web-delta-profile-fix-20260807.

After an authorized merge, revert the bounded repair commit or merge commit. No live source, database, queue, lifecycle record, cache, deployment, release, or published artifact requires restoration.