Release-native loading: certificate-verified datasets by default; immutable-first publication

[MaxGhenis]

Implemented and pushed release-native-loading to PolicyEngine/populace. No PR was created.

Commits:

• 183d250 — Make populace-data loading release-native
• acd16b7 — Make release publication immutable-first

Key changes:

• Certified loading now follows latest.json, pinned manifests and release revisions, verifies SHA-256, and validates model/Core compatibility.
• Mutable-root loading requires unverified_root=True and emits a prominent warning.
• Publication now creates and tags immutable release content before atomically updating root copies and writing latest.json last.
• Added failure, divergence, compatibility, publication-order, and live HF metadata coverage for the existing US and UK releases.

Validation:

• Full populace-data suite: 119 passed, 3 skipped out of 122.
• Skips were live Hugging Face integration tests under offline mode.
• ruff check packages/populace-data: passed.
• Changed-file formatting check: passed.

PR-ready summary

Summary

• Resolve certified datasets through latest.json and release-pinned manifests.
• Verify artifact SHA-256 and certified engine compatibility before dataset construction.
• Restrict mutable-root loading to an explicit warned opt-out.
• Publish immutable release content and tags before atomically updating root conveniences and the latest pointer.
• Add regression and live-metadata integration coverage for release-native loading and publication ordering.

---

Implements recommendation 1 of the 2026-07-09 architecture review (fixes populace#379): release-native loading (latest.json → release manifest → revision-pinned, sha256-verified, engine-compat-checked) with mutable-root loading demoted to an explicit warned opt-out, and publication reordered immutable-first / pointer-last.

Authored by Codex (gpt-5.6-sol, reasoning ultra); PR opened by the conductor. Local: 119 passed, 3 skipped; ruff clean.

🤖 Generated with Claude Code