[codex] prove offline trace-to-review release

[divo12]

Stack

Depends on #12. Review against codex/git-promotion-campaign-api.

Problem

The individual layers are insufficient evidence that OpenFlyWheel’s core claim works as one lineage. The release needs a permanent, provider-free proof from production-style traces through a reviewable, rollbackable improvement artifact.

Implementation

• Adds one offline fixture harness with prompt, editable tool implementation, lifecycle, verifier, diagnoser, execution boundary, and Langfuse observability connection.
• Serves five production traces through loopback Langfuse-compatible read-only health/observation/score endpoints.
• Runs the actual collection, Mine admission/snapshot, diagnosis/clustering, export ledger, benchmark, candidate, Fit, scheduler, promotion handler, and Git promotion code.
• Plants one verified-good trace plus frontier, regression, selection, and admission failures with distinct trace families.
• Produces a one-file tool candidate that fixes the target and sealed holdouts while preserving regression behavior.
• Records TRACE_SYNC → MINE → EXPORT_BENCH_EVAL → FIT → PROMOTE as durable scheduler jobs and executes PROMOTE through the real typed worker handler.
• Uses the real heartbeat to materialize the full seven-job DAG, then restarts SQLite before the promotion worker resumes it.
• Verifies every pre-promotion reservation settles and the durable daily spend ledger is exact.
• Pushes the promotion commit to a local bare Git remote and creates one injected PR reference without external network or deployment.
• Aligns the public contract: from ofw import ofw is the package module, connect_middle is the exact middleware alias, and ofw.fit(...).wait() creates/runs the durable campaign.
• Documents the permanent release command and exact evidence boundary.

End-to-end assertions

• Collection is revision-attributed and fit-ready with five observations.
• The Langfuse-compatible source receives zero writes.
• Mine admits four verified failures and one verified-good trace.
• Diagnosis creates four evidence-bound clusters.
• The export ledger validates and keeps developer/selection/admission partitions isolated.
• Paired gates and one-shot admission produce exactly the expected winner.
• The scheduler PROMOTE job reaches SUCCEEDED through PromotionJobHandler.
• The scheduler survives restart with PROMOTE still READY and records exactly 600 micro-units of prior stage spend with zero reservation leak.
• Promotion produces a PR reference and non-empty reverse patch, with no deployment.

Verification

• pytest -q tests/test_e2e_release.py — covered by full suite; run standalone with the documented command
• pytest -q — 150 passed
• Ruff and strict mypy across src and tests — clean
• forbidden construct scan — no Any, raw dict, object, getattr, setattr, lambdas, or __import__ in src/tests
• Bandit over src — zero findings
• pip-audit — no known dependency vulnerabilities
• source distribution and wheel build successfully

Deliberate scope

• The fixture’s proposer is deterministic test code; provider-backed candidate generation remains an injected implementation, not a release dependency.
• The only network socket is the loopback Langfuse fixture. No provider, GitHub, or deployment credential is used.