feat(doi): add recoverable Zenodo publication and citations

[arena-ai-coding-agent]

Summary

Refs #8. This is a draft for review, not production acceptance or an issue-closure claim. It implements the DOI workflow and its safety foundations, but Julia/Nickel runtime verification and the first real backend performance baseline are blocked in this environment.

Implementation

• HTTP.jl Zenodo deposition-v1 client with fixed production/sandbox origins, server-only redacted credentials, suppressed HTTP wire logging, streamed uploads, bounded 429/Retry-After handling, and no blind replay of ambiguous create/publish POSTs. Uses the documented legacy application/json contract, not an invented version URL or incompatible vendor serializer.
• Durable two-phase publication journal: private filesystem storage, kernel locks, atomic/fsynced write-ahead transitions, immutable snapshots/ZIP, draft recovery, asynchronous publication reconciliation, exact remote/local integrity checks, and immutable DOI/provenance receipts with checksummed downloads.
• Persistent immutable study config/results; exact config/result/method binding; explicit configuration-only payloads; rejection of mock/empty/failed results; retained scientific DANGER warnings. DOI insertion never rewrites scientific objects.
• Reachable Julia-rendered Evidence Mode publication page: private-draft upload acknowledgement, archive review, DANGER dialog, exact typed confirmation, reserved versus published identifiers, sandbox TEST badges, recovery and citations. Minimal launcher integration in StudyView and the existing (unmounted) AnalysisConfigEditor, rather than a new TypeScript application feature.
• Explicit CSRF/origin/body guards; publication-aware deletion/rename protection; hidden-state, encoded-study, symlink and SPA-path file-serving protections.
• Offline-first scripts/link-doi.sh: validated production receipts; preserved release notes, citation/receipt assets, idempotent Projects v2 draft upsert, partial-failure recovery. Correctly edits the DI_ draft-content ID rather than the PVTI_ project item ID. It never calls Zenodo or creates/publishes a GitHub release.
• JSON Schema + Nickel + DEED attestation contracts; official CFF 1.2.0 validation; operator/author/recovery docs and context help; isolated and full-app tests; browser/linker tests; bounded-memory benchmark and strict >10% comparison tool.

Verification actually executed

• Frontend bun run check: 599 pass, 5 existing TODO, 0 fail, 3,368 assertions, typecheck and seven benchmark checksums.
• New linker/schema/CFF/performance-comparator tests: 15 pass, 0 fail, 121 assertions; all GitHub interactions mocked.
• Chromium browser adapter: 4 pass, 0 fail, using a synthetic local API and an adapter-only HTML fixture derived from the Julia source template. This is not Julia rendering or end-to-end backend evidence. CI requires actual Julia-emitted HTML.
• Tree-sitter: 124 Julia sources, 0 syntax findings — parsing only, not Julia runtime/typechecking.
• Shell/source hygiene, TypeScript lint/typecheck, SPDX, whitespace, YAML parse and staged blob checks passed. Shellcheck is not installed.

Blocking acceptance work

The latest push run 36209226931, like 36207063201, was rejected before any jobs started:

Actor is not allowed to trigger Actions workflows. Workflow file: '.github/workflows/doi.yml'.

No Julia test has run here: there is no local Julia runtime and runtime download attempts failed. Nickel binary download also failed. These are not application test failures, and the gates have not been weakened to hide them.

• An authorized actor resolves the Actions policy or runs the documented lanes on a provisioned machine.
• Run isolated Julia lifecycle/real-HTTP streaming, actual-output JSON/CFF/Nickel/projection/browser checks, and full-app/Oxygen tests.
• Confirm root and isolated manifests with Pkg. Versions are retained; project hashes/dependency closure were reconstructed from the pinned Pkg algorithm, not produced by a successful instantiate/resolve here.
• Establish a reviewed, same-host DOI benchmark baseline and run the >10% time/allocation gate. The comparator is tested; there are no actual DOI timing/allocation measurements yet. Until a baseline exists, CI emits a warning and only retains the informational report.
• Perform an operator-approved live sandbox acceptance check before enabling production, including current licence/metadata normalization compatibility and explicit sandbox publish confirmation.

No real Zenodo upload/publication, DOI mint, GitHub release edit or project-item write was performed. Publication remains disabled by default. No issue is being closed by this PR.

Documentation

• docs/doi-publication.md — setup, privacy/authentication boundary, author flow, state recovery, GitHub linker and API contract.
• docs/testing/doi-publication.md — exact commands, coverage map, performance policy, evidence limits and production checklist.

The new DOI CI lane needs no credentials, R packages, biological databases or live deposits. The existing full scientific CI retains the integration tests.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 7075e990-6376-4cbd-86c8-37273bdf6c58

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}