fix(deps): harden post-merge evidence validation

[ll7]

Summary

Harden the dependency-license inventory and Issue #8163 receipt validator against ambiguous and
stale evidence. The validator now rejects duplicate normalized package identities, selects policy
rows by exact name/version/source identity, binds report content with a deterministic digest, and
checks receipt summaries and retained files fail-closed.

This is tooling and evidence-integrity work. It does not approve licenses, grant redistribution
rights, close the release gate, or make the blocked Issue #8163 batch authoritative.

Linked Issues

• Relates to release: admit first exact v0.0.6 supported-dependency disposition batch (36 rows) #8163
• Relates to release: publish a sanitized Robot SF v0.0.6 software package #8017

What Changed

• Reject duplicate package dispositions with the same normalized name, version, and lock source.
• Prevent a duplicate or mismatched policy row from masking an exact package identity failure.
• Add report_content_sha256 to generated inventory reports and verify it during freshness checks.
• Validate Issue release: admit first exact v0.0.6 supported-dependency disposition batch (36 rows) #8163 receipt status, scope, archive-audit counts and hashes, candidate-member
  bindings, strict-report summaries, and non-approval review state.
• Require operator-local receipt files to resolve to the retained bytes named by their hashes; make
  missing strict reports explicitly report hash non-verifiability.
• Add focused regression coverage for report mutation, duplicate identities, receipt drift, and
  exact policy matching.

Validation / Proof

• Focused dependency inventory/receipt suite: 34 passed.
• Promotion/workflow regression suite: 40 passed (28 promotion + 12 workflow tests).
• Targeted Ruff check: passed.
• Targeted Ruff format check: passed.
• git diff --check: passed.
• BASE_REF=origin/main scripts/dev/pr_ready_check.sh: passed in an isolated clean worktree;
  readiness stamp output/validation/pr_ready/fix-issue-8163-validator-successor.json records
  base 2292600b… and a clean tree with the same contents as the final remote head.
• Final exact base: 2292600b652e7811f14d41ffb90582515be644c2.
• Final exact head: 4daa9ed3b100db09a96aa50525ebedd8587ba1a6.
• No candidate bundle, campaign, scheduler allocation, publication, tag, DOI, legal approval, or
  redistribution decision was produced.

Claim Boundary / Risk

The change establishes validator behavior only. Dependency metadata, archive inspection, and
candidate bindings remain evidence rather than legal conclusions. The Issue #8163 receipt remains
blocked_diagnostic_only while candidate files and independent maintainer review are unavailable.
The strict inventory remains expectedly unresolved; fallback or degraded execution is not treated
as success evidence.

Deferred Work

• release: define supported v0.0.6 dependencies and the ORCA companion boundary #8021 remains blocked pending exact candidate, archive, policy, and independent-review evidence.
• The 36 dependency rows remain pending review; this PR does not admit any row.

Review / Merge Boundary

• Fresh hosted gates are recorded for the final head; superseded cancelled runs are excluded from
  the terminal result. An independent exact-head implementation review is still required before
  any guarded merge lane may promote this draft.
• This PR has no experimental result or planner claim; evidence applicability is NA.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 42719dd3-84b0-4e55-9bb1-e12568d96ec9

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ll7]

pr-metadata: reconciled @ 5721f30363602cc99709281e97e941871df5aa5f6f35e67f9e27a919dab1689a

[github-actions]

🔍 PR Contract Check Summary

Overall Status: 🟢 PASSED

Check	Status	Description
1. Closes-discipline	✅ PASSED	Demand Refs #N for epic issues
2. Closure declaration	✅ PASSED	Require Closes/Refs for title issues
3. State-refresh-only	✅ PASSED	Reject docs/context state updates
4. Evidence hygiene	✅ PASSED	Checks markers and provenance fields
5. Evidence writer usage	✅ PASSED	Require the shared marked writer path
6. Successor discipline	✅ PASSED	Require successor statement on multi-PR issues
7. Worker-lane label	⚪ None	Label PRs from cheap worker lane
8. Placeholder docstring ratchet	✅ PASSED	Reject NEW TODO/empty docstrings in added diff lines

ℹ️ Info

• No worker-lane provenance detected.

---

This check is mechanized. Please resolve any blockers to pass CI.

[ll7]

pr-metadata: reconciled @ d7cebbb75c5d2036a6c417b9d781a3408d1e926d57a5ac782555b2b3a98b6fac

[ll7]

pr-metadata: reconciled @ 424eb1bc44fa406979db6534e9b3beece2958889137e85126478416333895917

[ll7]

pr-metadata: reconciled @ cbc4965d6b0b36ace9eaf0a1bb68b9ef4d1f7600f2d16462bbf161a2d2caba73

[ll7]

pr-metadata: reconciled @ af765a3e1cf313b6cb9be55fc38718e4d2c382487ff34438cd9130232a2fc47f

[ll7]

review-claim: goal-autopilot-20260901-pr8175 @ 36aa5e1 until 2026-09-01T05:07:16Z

[ll7]

pr-metadata: reconciled @ b0d2f252bad2ebe3c800a89ec357688ba1b4f7d9c33db431b8a3d068ba7a54e2

[ll7]

Exact-head self-review

Reviewed PR #8175 at exact head 4daa9ed3b100db09a96aa50525ebedd8587ba1a6 against exact base
2292600b652e7811f14d41ffb90582515be644c2 in the linked worktree
/home/luttkule/git/robot_sf_ll7.worktrees/pr-8175-review-20260901.

Intended-design alignment

• #8175 is a bounded validator-hardening successor for blocked #8163 and #8017.
• The diff preserves fail-closed status and strengthens package identity, report-content, and
  receipt checks; it does not admit dependency rows, grant legal or redistribution rights, or
  change benchmark behavior.
• The synthetic promotion fixtures now carry the canonical report-content digest, preserving their
  intended downstream assertions after the validator contract was tightened.

Proof

• Post-refresh dependency, inventory, and promotion regression suite: 62 passed.
• BASE_REF=origin/main PR_READY_MODE=final PR_READY_PR_BODY_FILE=/tmp/robot-sf-pr-8175-body-20260901.md scripts/dev/pr_ready_check.sh — passed against
  origin/main=2292600b652e7811f14d41ffb90582515be644c2; the exact readiness stamp records a clean
  tree and usable CUDA runtime.
• Canonical exact-head hosted gate snapshot: 35 checks, 33 success, 2 expected skipped,
  no failures or pending checks; all current check heads match 4daa9ed3b100db09a96aa50525ebedd8587ba1a6.
• Targeted Ruff, format, and git diff --check checks passed.
• No unresolved inline review comments or requested reviewers were present.
• No delegated route artifact was available (delegation_skipped: route-unavailable); direct
  main-agent implementation verification was performed.

Findings disposition

• Fixed the missing strict-report non-verifiability diagnostic in e155ce6aa3d9d38aa58cb6d0ab7aece75a5a22da.
• Fixed promotion fixtures to bind report content in 36aa5e156205c9d2be9961650c7642967380591e.
• Refreshed the branch onto current origin/main in 4daa9ed3b100db09a96aa50525ebedd8587ba1a6.
• No remaining actionable implementation finding.

Admission boundary

This review is implementation and tooling evidence only. Dependency batch #8163 remains
blocked_diagnostic_only; no benchmark, campaign, publication, legal, or redistribution claim is
admitted. Ordinary base policy is appropriate because the base-sensitive selector found no
base-sensitive files. The single-account internal-review waiver applies only to the absent distinct
account; it does not waive any external, domain, legal, provenance, or campaign gate (none is
required by this PR).

gate-verdict: accepted @ 4daa9ed
base-policy: ordinary-cas @ 4daa9ed
pr-metadata: reconciled @ b0d2f252bad2ebe3c800a89ec357688ba1b4f7d9c33db431b8a3d068ba7a54e2

[ll7]

review-claim: released @ 4daa9ed

PR #8175 merged as 49779be15f53af703cd90052839892419af26ebe; the implementation review claim is no longer active.