修复抓取收据验证边界并接入 Autopilot lineage

.gitignore

@@ -12,3 +12,4 @@ dist/
 htmlcov/
 *.egg-info/
 runs/
+.autopilot/

autopilot/project.json

@@ -0,0 +1,87 @@
+{
+  "schemaVersion": "system-design-workbench.autopilot-project.v2",
+  "taskSchemaVersion": "system-design-workbench.autopilot-task.v1",
+  "taskDirectory": "autopilot/tasks",
+  "runtimeDirectory": ".autopilot",
+  "hardLimits": {
+    "maxMinutes": 45,
+    "maxChangedFiles": 4,
+    "maxVerificationAttempts": 2,
+    "maxPatchBytes": 65536
+  },
+  "producer": {
+    "id": "codex-exec-v1",
+    "cliVersion": "0.144.1",
+    "executableSha256": "134063e133f0b4244fa3b251acf973d4fe4b4aeeacbdc135211bf480f59f1477",
+    "maxSeconds": 600,
+    "maxOutputBytes": 4194304,
+    "promptContract": "system-design-workbench.codex-producer-prompt.v2"
+  },
+  "protectedPaths": [
+    ".git",
+    ".autopilot",
+    ".github/workflows",
+    ".gitignore",
+    "autopilot",
+    "CHANGELOG.md",
+    "LICENSE",
+    "Makefile",
+    "README.md",
+    "pyproject.toml",
+    "schemas",
+    "scripts",
+    "uv.lock"
+  ],
+  "requiredStopConditions": [
+    "budget-exhausted",
+    "verification-attempts-exhausted",
+    "scope-expansion-required",
+    "protected-path-change-required",
+    "dirty-working-tree",
+    "task-input-changed",
+    "new-authority-required"
+  ],
+  "checks": [
+    {
+      "id": "cli-test",
+      "kind": "argv-v1",
+      "timeoutMs": 120000,
+      "argv": [
+        "uv",
+        "run",
+        "--locked",
+        "pytest",
+        "tests/test_cli.py"
+      ]
+    },
+    {
+      "id": "crawl-test",
+      "kind": "argv-v1",
+      "timeoutMs": 120000,
+      "argv": [
+        "uv",
+        "run",
+        "--locked",
+        "pytest",
+        "tests/test_crawl.py"
+      ]
+    },
+    {
+      "id": "project-check",
+      "kind": "argv-v1",
+      "timeoutMs": 300000,
+      "argv": [
+        "make",
+        "check"
+      ]
+    }
+  ],
+  "reviewPolicy": {
+    "kind": "record-before-close-v1"
+  },
+  "controllerSourceManifest": {
+    "toolVersion": "1.0.0",
+    "manifestSha256": "0fbb587d6a940ebfdd11f01a1927dee86f169d22c6d5247ec91ad2a2312932f7",
+    "sourceSetSha256": "fede99b03f5d876ae2128086f674dfe4e2cc687098cfdbf37b8ea9531a38af24"
+  }
+}

autopilot/tasks/SDW-AUTO-901.json

@@ -0,0 +1,117 @@
+{
+  "schemaVersion": "system-design-workbench.autopilot-task.v1",
+  "id": "SDW-AUTO-901",
+  "status": "READY",
+  "execution": {
+    "kind": "prepared-bound-patch-v1",
+    "patchSha256": "78508dd8d7e36e6b172dec2d659130119b5275ae1c9cc96c3e7cc5932c7a8c16",
+    "patchBytes": 2454,
+    "preparation": {
+      "sourceHead": "ad98560072e5938c2814f045ddd2ac680d7dc583",
+      "project": {
+        "path": "autopilot/project.json",
+        "fileSha256": "1687980d1f6ff5c4f330cc385c22138e1e18ea01ccb3628f3ee549b56be4753a",
+        "gitBlobOid": "a4adf2f2ec76ab0e4297d6da52a85db3ff32809b",
+        "canonicalSha256": "aa4e0a90a916fd297aac585b19a43ae6feec951b1226424fc8936fe585b6acbf"
+      },
+      "task": {
+        "path": "autopilot/tasks/SDW-AUTO-901.json",
+        "fileSha256": "e11baa1d3c0775c9aec5098183a7bb7c8d12ce52124a2a5850559a13254295d5",
+        "gitBlobOid": "73d4ea0c5d5ef022f146a817c8945f4c54bb16a4",
+        "canonicalSha256": "3d08463bf3c304c3c0cd163834eaacaf368c443cf6b55051ce8d04b40819909b"
+      },
+      "candidateSnapshotSha256": "be883bbcbf58d84bcccb3c059c27543fc1dcfdd8516b6660bea81c9f17891f49",
+      "producer": {
+        "schemaVersion": "system-design-workbench.codex-producer-receipt.v1",
+        "id": "codex-exec-v1",
+        "cliVersion": "0.144.1",
+        "executableSha256": "134063e133f0b4244fa3b251acf973d4fe4b4aeeacbdc135211bf480f59f1477",
+        "argvLabel": "codex exec fixed-contract-v1",
+        "sourceBindingSha256": "76b7f0fb9a030699c7414b7bf6e0da880b680954d62702e307fec4f75ce93c07",
+        "promptSha256": "004e4f069911910c9db5acc36ea123f1e578671375e91e1e6f23088e6668364f",
+        "exitCode": 0,
+        "signal": null,
+        "timedOut": false,
+        "outputLimitExceeded": false,
+        "durationMs": 72416,
+        "stdout": {
+          "bytes": 44792,
+          "sha256": "242bbda2d8f0a65d9c8f32f393649e4abdd4eb862c5f655e63ce94671c0c3ffe"
+        },
+        "stderr": {
+          "bytes": 0,
+          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        },
+        "events": {
+          "lineCount": 23,
+          "turnCompletedCount": 1,
+          "errorCount": 0
+        },
+        "patchSha256": "78508dd8d7e36e6b172dec2d659130119b5275ae1c9cc96c3e7cc5932c7a8c16",
+        "patchBytes": 2454,
+        "candidateSnapshotSha256": "be883bbcbf58d84bcccb3c059c27543fc1dcfdd8516b6660bea81c9f17891f49"
+      }
+    }
+  },
+  "objective": "Make `verify_crawl_bundle` reject a crawl receipt whose top-level `status` differs from the deterministic status derived by `_receipt_from_store` from `pages` and `max_pages`. Preserve all valid crawl receipts, reuse the producer's exact precedence for pending, complete, failed, and blocked page combinations, add a regression that changes only a valid complete receipt's top-level status to `failed` and proves verification rejects it with a stable, specific failure, and keep both changed files compliant with the repository's current Ruff formatting contract.",
+  "problemEvidence": [
+    "`_receipt_from_store` deterministically derives the top-level crawl status from page statuses, terminal page count, and max_pages.",
+    "`verify_crawl_bundle` recomputes failures_by_code and validates the SQLite projection, but it never recomputes or compares the top-level crawl status.",
+    "On source HEAD c57b1bcb788d6228bbade186667c3bed46ef1996, a valid one-page complete crawl remains `valid: true` after changing only `crawl-receipt.json.status` from `complete` to `failed`.",
+    "The existing crawl test file passes before the fix, so the new regression must fail on the source behavior and pass only when the verifier enforces the producer's status contract.",
+    "The fix belongs in verification and its direct tests; changing crawl production, public models, build configuration, or schemas is outside this task.",
+    "The first isolated candidate passed all 12 crawl tests and Ruff lint, but `ruff format --check` rejected its multiline `processed_count` sum; that candidate is not eligible for TaskSpec installation, and the replacement must satisfy the existing formatter without a later manual patch."
+  ],
+  "allowedPaths": [
+    "src/tracefetch/verify.py",
+    "tests/test_crawl.py"
+  ],
+  "forbiddenPaths": [
+    ".github",
+    ".gitignore",
+    "CHANGELOG.md",
+    "LICENSE",
+    "Makefile",
+    "README.md",
+    "autopilot",
+    "pyproject.toml",
+    "schemas",
+    "scripts",
+    "src/tracefetch/crawl.py",
+    "src/tracefetch/contracts.py",
+    "uv.lock"
+  ],
+  "baselineChecks": [
+    "crawl-test"
+  ],
+  "acceptanceChecks": [
+    "crawl-test",
+    "project-check"
+  ],
+  "budget": {
+    "maxMinutes": 30,
+    "maxChangedFiles": 2,
+    "maxVerificationAttempts": 1
+  },
+  "authority": {
+    "write": true,
+    "invokeAgent": false,
+    "applyPatch": true,
+    "commit": false,
+    "push": false,
+    "release": false,
+    "network": false
+  },
+  "externalOutcome": "An independent reviewer accepts a frozen two-file candidate that makes `verify_crawl_bundle` reject a top-level status inconsistent with the producer's deterministic page projection, while the targeted crawl tests and the full TraceFetch project check pass without changing valid crawl behavior.",
+  "stopConditions": [
+    "budget-exhausted",
+    "verification-attempts-exhausted",
+    "scope-expansion-required",
+    "protected-path-change-required",
+    "dirty-working-tree",
+    "task-input-changed",
+    "new-authority-required",
+    "crawl-status-contract-requires-behavior-change"
+  ],
+  "requiresChanges": true
+}

autopilot/tasks/SDW-AUTO-902.json

@@ -0,0 +1,107 @@
+{
+  "schemaVersion": "system-design-workbench.autopilot-task.v1",
+  "id": "SDW-AUTO-902",
+  "status": "READY",
+  "execution": {
+    "kind": "prepared-bound-patch-v1",
+    "patchSha256": "152fd43e9de0efdd87b9b8dc5fcfa154a4616e5f37cc444d4547247ff81edb08",
+    "patchBytes": 11818,
+    "preparation": {
+      "sourceHead": "cff9587db73c7a31d5e864b2792c6440b54af02f",
+      "project": {
+        "path": "autopilot/project.json",
+        "fileSha256": "4729153e18f731cc6c3f1450320eab479d44147140cdd9a1c63b7949b209e412",
+        "gitBlobOid": "e31b776e55cee1136758764ced3af1f60b6ff04b",
+        "canonicalSha256": "942ec6ad09ddc509953064ce3be3bea397c818875ad6138cefccf0de778b65d8"
+      },
+      "task": {
+        "path": "autopilot/tasks/SDW-AUTO-902.json",
+        "fileSha256": "417f5e634d62b8decbe2df0b911724ef032b8bd67aa863cecaef9de153647fad",
+        "gitBlobOid": "776e8857d300c2a7afa2d24b268a142c1e145eed",
+        "canonicalSha256": "e57c2d195c215a940ffa3be19ba92200000ab26993555fec563171d0e3e197a3"
+      },
+      "candidateSnapshotSha256": "cb7dc6e8f230db839bc2f58fa8dc1d114392afafe13d7a6f52870c66a31ef808",
+      "producer": null
+    }
+  },
+  "objective": "Make `tracefetch verify <crawl-directory>` preserve its JSON error contract for malformed crawl receipts and corrupted crawl state. Use one shared receipt parse result. Map malformed/schema-invalid JSON, invalid UTF-8, and unreadable receipts to the exact fixed failures `crawl receipt failed schema validation`, `crawl receipt is not valid UTF-8`, and `crawl receipt is unreadable` without reflecting load-boundary exception or input text. CLI failures must exit 6 with empty stdout and one `tracefetch.error.v1` stderr object; a 5000-page schema-invalid sentinel case must stay within 4096 bytes and not echo the sentinel. A successfully modeled receipt must retain its crawl ID and complete-page count when state is missing, corrupt, or a symlink. SQLite query and row-projection `sqlite3.Error`, `TypeError`, `ValueError`, or `OverflowError` must become `crawl SQLite state is invalid`, never a traceback. Preserve valid crawl payloads, ordinary evidence verification, and existing downstream page diagnostics. Fix the shared verification layer, keep all changed Python files Ruff-formatted, and leave no ignored producer artifact.",
+  "problemEvidence": [
+    "On committed source HEAD e52d1fd8681323eacd3205677a7b3b54aec70aff, a crawl directory containing only `crawl-receipt.json` with `{}` reaches `verify_crawl_bundle`, then `crawl_verification_payload` reparses the same file and raises an uncaught Pydantic `ValidationError` with 11 missing-field errors.",
+    "The reproduced CLI process exits 1 and prints a Python traceback, contradicting README's contract that errors are one `tracefetch.error.v1` object on stderr with stable exit codes.",
+    "`verify_crawl_bundle` already catches `OSError`, `UnicodeError`, and `ValidationError` while reading the crawl receipt and returns an `invalid crawl receipt` failure; the second unguarded parse in `crawl_verification_payload` is the root divergence.",
+    "The existing `tests/test_cli.py` suite passes 7 tests on the source behavior because it covers tampered ordinary evidence but not malformed crawl receipts.",
+    "Regression coverage must call the public CLI entry point for malformed JSON, invalid UTF-8, and a valid JSON object missing required receipt fields; each case must assert exit 6, empty stdout, one parseable error envelope, and no `Traceback`, `pydantic_core`, or `ValidationError` text outside the bounded failure details.",
+    "A direct verification-layer regression must prove `crawl_verification_payload` returns `valid=false` with zero verified pages and the failure list instead of throwing when the receipt cannot be modeled.",
+    "Valid crawl receipts must retain the existing `tracefetch.crawl-verification.v1` fields, crawl ID, verified-page count, and `valid=true`; ordinary `receipt.json` verification is outside the changed control path and must remain unchanged.",
+    "The fix must reuse the result of the existing receipt failure boundary or a single shared parse result; adding a broad catch only in `cli.py` would leave `crawl_verification_payload` unsafe for its other caller and is not sufficient.",
+    "Transaction a2433ac0-fa05-4b99-87a8-3c46b0354cdf produced a semantically plausible three-file candidate whose focused CLI/crawl tests passed 25/25, but `ruff format --check .` rejected multiline expressions in `src/tracefetch/verify.py` and `tests/test_crawl.py`; that candidate was formally rejected as `ruff-format-contract-failed` and must not be installed or repaired manually.",
+    "Independent review of the rejected candidate showed that directly embedding Pydantic `ValidationError` text is a security and availability failure: a 5000-page invalid receipt produced about 2.4 MB of stderr, a single failure near 2.38 million characters, and reflected `TOP_SECRET_SENTINEL`; fixed portable failure messages and a 4096-byte complete-envelope bound are therefore hard acceptance gates.",
+    "The rejected helper returned `receipt=None` before parsing whenever `crawl.sqlite3` was a symlink, so a valid one-page receipt's failure payload regressed from its real crawl ID and verified-page count to an empty ID and zero; receipt validity and state validity must remain separate.",
+    "Transaction eeec5b9e-6560-463d-83ed-54ed5e2b59cd invoked the producer once but candidate audit rejected an ignored generated path; resume correctly ended at `PRODUCER_OUTCOME_UNKNOWN` without invoking the model again. A replacement producer may run checks only if it leaves no `.venv`, `.pytest_cache`, `.coverage`, `build`, `dist`, or other ignored output in the isolated candidate clone.",
+    "Transaction 451a4c03-f2e6-45b8-a09b-8e1b7f660cc6 produced a formatted candidate that passed focused 27/27 and full 117/117 checks, bounded a 5000-page schema-invalid sentinel case to 242 bytes, and preserved valid receipt summaries for missing, corrupt, and symlinked state. It was formally rejected after a probe placed a sentinel in a schema-valid page URL and bundle path. Independent review showed that probe exercised existing downstream diagnostics rather than the malformed receipt load boundary; broad redaction would change public behavior and exceed this task, so the rejected candidate cannot be reused but the replacement must retain its narrower load-boundary semantics.",
+    "An explicit input-byte ceiling and open-handle protection against local concurrent replacement are not defined by the current TraceFetch receipt contract. They remain separate follow-up risks; this task must not invent a new size threshold or claim TOCTOU protection while fixing the confirmed exception and output-reflection path.",
+    "Transaction a6bd4c8a-8fc3-4c88-9c54-503e899e2a00 produced the calibrated load-boundary behavior and passed 29 focused tests, but `ruff format --check .` rejected one multiline call in `tests/test_cli.py`: `(output / \"crawl-receipt.json\").write_text(json.dumps({\"pages\": pages}), encoding=\"utf-8\")` must remain on the formatter's single line. That candidate was formally rejected as `ruff-format-contract-failed`; the replacement must use the exact committed Ruff style without relying on a later formatting patch.",
+    "Transaction 94c87198-b226-4f21-a7dc-6d333bd0e194 fixed the formatter issue but left `_verify_crawl_state` row conversion outside its `sqlite3.Error` boundary. After updating `pages.depth` to the string `not-an-integer`, the public CLI still exited 1 with an uncaught `ValueError` traceback. That candidate was formally rejected as `corrupt-state-traceback`; regression coverage must tamper a schema-valid crawl SQLite row, assert the internal payload retains crawl ID and complete-page count with `crawl SQLite state is invalid`, and assert the CLI still exits 6 with one JSON error.",
+    "Transaction 5b1625c6-77da-448e-94a5-d19d1e6da0ad implemented the SQLite conversion boundary and passed 28 focused tests, but Ruff rejected two multiline forms. The replacement must keep `assert json.loads(captured.err)[\"details\"][\"failures\"][-1] == (\"crawl SQLite state is invalid\")` on one line; that candidate was formally rejected as `ruff-format-contract-failed` and cannot be post-formatted or reused.",
+    "Transaction 8c95c95c-3d1b-4509-8c0f-6f841a7c8afd covered the corrupt-row contract and passed 31 focused tests, but Ruff rejected an inline verified-pages conditional in the result dictionary; the replacement should compute a local `verified_pages` value before constructing the dictionary so the formatter owns layout. It also mapped a receipt symlink to the legacy combined symlink message instead of the required exact `crawl receipt is unreadable`. The candidate was formally rejected as `receipt-symlink-contract-mismatch` plus `ruff-format-contract-failed`.",
+    "After the seventh rejected batch, the operator paused new TraceFetch transactions and changed the source-owned controller instead of retrying the same producer contract. Pushed controller commit 69f75e573e5b077878152dae75f534ed1615c33d adds prompt contract v2, which requires the producer to run declared baseline checks before editing, rerun every baseline and acceptance recipe before finishing, and remove generated ignored artifacts. The new controller source set 843089a34bb3d0b3a5c2503538c5b02474e6e1b13d039638f57f47545d95f1f5 is a real workflow delta; it authorizes exactly one fresh bounded transaction, not an automatic retry loop.",
+    "Transaction ac575b5c-4441-4f68-a037-c725097dba7f ran once under prompt contract v2 and returned `candidate-empty`; resume moved the persisted latch to terminal `PRODUCER_OUTCOME_UNKNOWN` without a second model invocation, candidate installation, product write, commit, or push. The operator therefore stopped producer retries and selected the source-owned manual prepared-patch path. The independently authored three-file patch is 11818 bytes with SHA-256 152fd43e9de0efdd87b9b8dc5fcfa154a4616e5f37cc444d4547247ff81edb08; it passed 31 focused tests and full `make check` with 121 tests and 82.74% coverage before binding."
+  ],
+  "allowedPaths": [
+    "src/tracefetch/verify.py",
+    "tests/test_cli.py",
+    "tests/test_crawl.py"
+  ],
+  "forbiddenPaths": [
+    ".github",
+    ".gitignore",
+    "CHANGELOG.md",
+    "LICENSE",
+    "Makefile",
+    "README.md",
+    "autopilot",
+    "pyproject.toml",
+    "schemas",
+    "scripts",
+    "src/tracefetch/cli.py",
+    "src/tracefetch/contracts.py",
+    "src/tracefetch/crawl.py",
+    "src/tracefetch/errors.py",
+    "uv.lock"
+  ],
+  "baselineChecks": [
+    "cli-test",
+    "crawl-test"
+  ],
+  "acceptanceChecks": [
+    "cli-test",
+    "crawl-test",
+    "project-check"
+  ],
+  "budget": {
+    "maxMinutes": 30,
+    "maxChangedFiles": 3,
+    "maxVerificationAttempts": 1
+  },
+  "authority": {
+    "write": true,
+    "invokeAgent": false,
+    "applyPatch": true,
+    "commit": false,
+    "push": false,
+    "release": false,
+    "network": false
+  },
+  "externalOutcome": "An independent reviewer accepts a frozen candidate that converts malformed crawl-receipt verification into the documented JSON error and exit-6 contract while valid crawl and ordinary evidence verification remain unchanged; after the frozen lineage closes, the exact product commit is pushed on its lineage branch without claiming PR, merge, release, or production acceptance.",
+  "stopConditions": [
+    "budget-exhausted",
+    "verification-attempts-exhausted",
+    "scope-expansion-required",
+    "protected-path-change-required",
+    "dirty-working-tree",
+    "task-input-changed",
+    "new-authority-required",
+    "malformed-crawl-receipt-contract-requires-behavior-change"
+  ],
+  "requiresChanges": true
+}