fix(audit): make post-release validation evidence authoritative

[codethor0]

Summary

Repairs the post-release audit tooling defects identified during the
independent Ghost Sweep v0.1.2 audit.

Findings addressed

• GS-IND-001: validation reports contradicted recorded command exit codes
• GS-IND-002: backend py_compile selected no source files
• GS-IND-003: E2E could continue against an unverified existing process
• GS-IND-004: verification workspaces were recursively packaged
• GS-IND-005: generated audit timestamps could disagree
• GS-IND-006: archives retained macOS provenance extended attributes

Key changes

• Uses authoritative process exit codes for validation status
• Generates validation-results.json from cmd-results.ndjson
• Compiles Python files from the backend working directory
• Rejects empty py_compile file selections
• Blocks E2E when backend readiness or provenance fails
• Records SHA, tree, PID, working directory, and port provenance
• Excludes verification and temporary workspaces from bundles
• Creates archives without extended attributes
• Uses canonical audit start and completion timestamps
• Validates manifest counts and clean extraction

Validation

• Audit evidence regression tests: PASS
• Bundle packaging regression tests: PASS
• Backend pytest: 219/219 PASS
• Frontend Jest: 28/28 PASS
• Baseline isolated E2E: 26/26 PASS
• Extended isolated E2E: 29/29 PASS
• Extension smoke: PASS
• Docker config/build/runtime: PASS
• Secret scan and synthetic positive controls: PASS
• py_compile selected 80 files
• Bundle manifest: 241 files, all verified
• No recursive bundle copies
• No temp verification paths
• No AppleDouble or .DS_Store
• No extended attributes
• Clean extraction and manifest verification: PASS

Validation evidence:

/Users/thor/Downloads/ghost-sweep-audit-tooling-validation-20260711-072150/

Out of scope

• GS-IND-007 npm dependency advisories
• GS-IND-008 frontend version metadata
• Sheet import --apply
• Deployment
• Release publication

This pull request is ready for owner review but is not authorized for merge.

Made with Cursor