[PILOT-04] Deliver the external checker flow end to end

[Abiorh001]

Refs #491.

Replace both executable checker catalogues with one versioned Workstream default checker and approved digest-pinned external PRE/POST images. The selected flow is:

verified bounded ZIP/private scratch → four default checks → required external PRE images over read-only verified material → atomic immutable Submission, evaluation_pending and initial dispatch → external POST images → governed routing.

Default or required PRE findings create no Submission/dispatch and preserve in_progress. Infrastructure failures remain distinct and recoverable. Missing summary/attestation are warnings. Project rules run in images; adding a checker does not require a Workstream backend deploy.

The Rust service/SDK uses exact image manifests, request-bound ART grants and bounded isolated invocations. Current compilation, approval, policy reads, recovery and runtime consume one external-policy contract. No executable catalogue, compatibility decoder or schema-adapting predecessor writer remains. Historical rows are retained unchanged in migration proofs; migration 0036 refuses obsolete fresh writes. TASK-before-CHECKERS custody and caller-owned admission atomicity remain protected.

Activation refuses unresolved required capabilities after current PM authority/custody checks. Canonical error.details.missing_capabilities exposes only bounded requirement ID, stage and title. Registration alone cannot clear a gap; corrected compilation and approved binding are required.

Merged: 6d64a6353fd619f5b917359da8b82c307d97d40d, from reviewed head ebad64be38e94cde7a0280bcd43a70c7eab51f17. The merged tree exactly matches the tested merge 54d80359328019c6095fe0598ede6964eac73888 (tree a371b1830703137678efd6981a5aaa9f04813aa4).

Verification

• Earlier canonical collection at clean 85b083279: 8,776 unique nodes, all ten lanes, zero exclusions. Collection is not execution evidence.
• Full Ruff and Commitrail checks pass. Affected independent source/archive/authority reviews pass; final affected frozen-head source/test-delta review passes, with peer review retained for the earlier reviewer-authored ART changes.
• Six selected-predecessor rules regressions pass. Activation contracts/API errors: 64 focused tests pass against source equivalent to the frozen repair, including real ASGI response projection with controlled dependencies (not a native authorization claim).
• Structural repair: eight focused tests pass at 25742a230; immutable action membership and missing/extra-action/default-identity discriminators pass. No new structural debt or loosened limits.
• Literal predecessor cleanup: three PostgreSQL migration/current-activation checks pass at 68108f7d, with database/role/MinIO cleanup complete. All earlier archive variants remain identical. Additional nonvacuity assertions are included in the candidate and required CI.
• Earlier clean native proofs cover current project reads/activation, selected admission/dispatch, false-policy completion, intermediate lock waits, rollback/replay and history. Earlier exact da76eabed passes the actionable-capability correction/approval/activation PostgreSQL journey, including all six business-effect snapshots unchanged on refusal (1 test, 75.76 seconds; complete cleanup). The same exact da76eabed real Rust/PostgreSQL/MinIO drill exits zero: four defaults, real external PRE, immutable Submission/dispatch, real POST to review_pending, default and external PRE failures without additional Submission, infrastructure restart and fresh replay without duplicate admission. Database/role/MinIO/scratch cleanup is complete. This does not claim public P12 intake or live-provider/gVisor execution.
• The prior full hosted run 38289500670 passed seven backend lanes; it failed two lanes on stale test expectations and timed out in schema execution. That is not a full-suite pass. All three causes are repaired without changing lane placement, test nodes, CI caps or production budgets: current draft projection/replay expectations; exact PRE permission/audit inventories; and six receipt expiry fixtures that patched an unused constant. The last similar delivery fixture is also corrected, and both unused executor constants are removed.
• Repair proofs: capability-growth PostgreSQL 2 passed at 7e17883e (183.83s); pure audit contracts 12 passed plus exact inventory mutants and signed public PostgreSQL read/write denial 2 passed at 9813a7b0 (27.78s); receipt/delivery PostgreSQL 7 passed at c5d28178 (545.95s within unchanged 600s local bound). All owned database/role/MinIO cleanup is verified. Receipt fixtures use the current local ART provider; this is separate from the real-image proof. Integrated source/test-delta peer review passed at 85b083279, whose code is unchanged in the published candidate.
• Complete hosted execution at 62b661bd8 passed nine backend lanes. Schema finished in 748.049s, clearing the previous timeout; its only failure was stale UUID classification metadata referencing deleted checker files and old outbox AST locations. The final repair removes four stale keys and adds three exact current owner classifications, preserving every other classification and the unchanged scanner/policy/tests. All 24 identifier tests and seven missing/stale-key scanner discriminators passed at 33c47d683; independent metadata/source review passed. This correction changes only classification JSON and the evidence record.
• Hosted run 38297853598 at 1eafd2ce4 passed nine lanes, including schema and every previously failing regression. TASK C hit its unchanged 1200s limit with 294/295 tests completed, zero skips/deselections and no assertion failure. The unfinished worker-permission denial test remains unchanged.
• The bounded CI repair moves the six native CHECKERS completion-evidence tests from TASK to the existing four checker-delivery PROJECT lanes. All 8,776 tests and ten lanes remain. Before/after canonical collections passed; comparison using one real node list proves only six lane assignments change and 8,770 remain unchanged, with execution kinds preserved. HEAD-seeded UUID parameter differences are qualified separately. All 63 existing catalogue/runner tests, Ruff, Commitrail and lead independent source/test-delta review pass. No test assertion, runtime code, timeout, PostgreSQL marker, exclusion or selection algorithm changes.
• Final Backend CI passed all ten lanes and aggregation. Downloaded aggregate artifact SHA-256 45d5780b9d02390b2218167ec4f88f1abb06fea3b75db57ddf1c6ea1a2b0958d matches GitHub metadata. Verified exact tested head, manifest/evidence/coverage/isolation hashes, every lane collected/completed set and exhaustive disjoint ownership: 8,776 unique completed tests, zero skips/deselections, no interruptions. Agent Gates, MCP, CLI public contract, external runtime and CodeRabbit passed; zero unresolved review threads.

Local image proof uses runc/docker-dev; it is not gVisor deployment evidence. Public contributor upload/finalize and CLI submit/status remain PILOT-12; public false-guide activation remains PILOT-08. The user merged this PR; no deployment has been performed.

[coderabbitai]

Important

Review skipped

We couldn't safely recover the incremental review. No full review was started, and the last reviewed checkpoint was preserved. Retry later, or explicitly request a full review by commenting @coderabbitai full review.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: eac79d10-7d34-4446-899b-fee90f6d91a3

📥 Commits

Reviewing files that changed from the base of the PR and between e31e177 and 7453a0d.

📒 Files selected for processing (12)

• .ci/behavior-ownership/partition.v1.json
• .commitrail/changes/pilot04-workstream-default-checker.md
• backend/app/modules/checkers/api/default_checker.py
• backend/app/modules/checkers/default_checker.py
• backend/scripts/behavior_ownership.py
• backend/scripts/test_lane_catalogue.py
• backend/tests/checkers/default/test_contract.py
• backend/tests/checkers/default/test_execution.py
• backend/tests/test_artifact_architecture.py
• backend/tests/test_ci_lane_catalogue.py
• docs/architecture_checker_framework.md
• docs/roadmap_status.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The PR adds an unselected, versioned Workstream default checker with four ordered blocking checks and warning-only observations. It adds input and result validation, archive evaluation, tests, ownership metadata, and documentation. The checker is not connected to an active caller.

Changes: Workstream default checker

Layer / File(s)	Summary
Checker contract backend/app/modules/checkers/api/default_checker.py, backend/tests/checkers/default/test_contract.py, .commitrail/changes/pilot04-workstream-default-checker.md	Defines the checker identity, ordered checks, warning codes, input and result models, and behavior hash. Contract tests validate check order, result shape, warnings, and eligibility.
Archive evaluation backend/app/modules/checkers/default_checker.py, backend/tests/checkers/default/test_execution.py, .commitrail/changes/pilot04-workstream-default-checker.md	Checks rejected and verified archives, detached material identity, secret signatures, and unchanged submissions. Tests cover successful checks, findings, warnings, and unavailable outcomes.
Repository integration and documented status .ci/behavior-ownership/partition.v1.json, backend/scripts/behavior_ownership.py, backend/scripts/test_lane_catalogue.py, backend/tests/test_artifact_architecture.py, backend/tests/test_ci_lane_catalogue.py, docs/architecture_checker_framework.md, docs/roadmap_status.md, .commitrail/changes/pilot04-workstream-default-checker.md	Adds the checker modules and tests to ownership and lane metadata. Updates architecture and roadmap descriptions to state that the checker is unselected and has no active caller. Records acceptance, validation, and review details.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Merge Risk: ⚪ Minimal · up to 7453a

The checker remains unselected, and no merge-blocking issue was established. Merge after normal checks.

Pre-merge checks · 4 · 1

Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 35.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 40 functions across 8 files. (4 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title refers to the checker work, but it overstates the scope. This pull request adds an unselected Workstream default checker and does not deliver the external checker flow end to end.
Description check		The description provides extensive scope, behavior, evidence, test results, risks, and merge-readiness information. It does not follow the repository template headings and omits several explicit check…

Full details: Docstring Coverage

Explanation

Docstring coverage is 35.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 40 functions across 8 files. (4 skipped: 4 unsupported.)

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}