fix(collector): bind Polymarket binary to source revision

[proerror77]

Change contract

Bind every published polymarket-raw-ops artifact identity to the exact compile-time MONDAY_SOURCE_REVISION, and fail CI or ACR publication unless --version matches the selected source SHA.

Out of scope

Collector data behavior, Gate recovery semantics, production cutover, snapshot/research logic, and #235.

Dependency / merge order

Depends on #389 already merged at e93319412d73fb5c041040d0e7cf7af0321100df. This PR must merge before building the next exact-main Polymarket Gate candidate.

Focused validation

• Red proof: before the implementation, the targeted CLI-version test observed no version.
• cargo test -p hft-collector --bin polymarket-raw-ops — 5 passed.
• cargo clippy -p hft-collector --bin polymarket-raw-ops --no-deps -- -D warnings — passed.
• Exact revision build emits polymarket-raw-ops e93319412d73fb5c041040d0e7cf7af0321100df.
• Two otherwise-identical builds with different 40-hex revisions produced different binary SHA256 values.
• The evidence-compiler Dockerfile rejects missing/malformed source revisions and passes the accepted revision into the Rust build.
• PR CI and ACR both run the built image binary and require its exact source-bound --version output.
• .github/scripts/test-acr-publish-workflow.sh — passed.
• git diff --check — passed.
• Two-axis spec and standards reviews — passed with no findings.
• Broad cargo fmt --all -- --check remains blocked by pre-existing unrelated formatting drift; this PR does not reformat unrelated code.

Rollout / rollback impact

After merge, rebuild the exact-main binance-lob-archiver artifact and require the Polymarket candidate SHA to differ from the already pinned 9aeca5caf148b7770657b2e1017cce3f72e6bfc26e492bc63e4cc06b585d3340 before starting a new formal Shadow Gate. Rollback is reverting this source-identity change; no production service is changed by this PR.

Closes #390

[coderabbitai]

📝 Walkthrough

Walkthrough

The change binds polymarket-raw-ops version output to a validated source revision during Docker builds, adds focused CLI coverage, and verifies the revision in CI, container images, and extracted ACR artifacts.

Changes

Polymarket source revision binding

Layer / File(s)	Summary
CLI revision identity rust_hft/tools/collector/src/bin/polymarket-raw-ops.rs	The CLI version is derived from MONDAY_SOURCE_REVISION, with a fallback value, and a unit test verifies the generated version.
Docker revision injection rust_hft/deployment/docker/Dockerfile.polymarket-evidence-compiler	The Docker build validates the 40-character hexadecimal SOURCE_REVISION and passes it to Cargo as MONDAY_SOURCE_REVISION.
Artifact revision verification .github/workflows/ci.yml, .github/workflows/acr-publish.yml	CI and artifact publication checks run polymarket-raw-ops --version and compare it with the selected source revision.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• proerror77/monday issue 326: Its immutable-image/source-binding objective aligns with embedding and verifying the selected source revision.

Possibly related PRs

• proerror77/monday#180: Shares the evidence compiler and polymarket-raw-ops revision-verification flow.
• proerror77/monday#332: Shares the ACR/CI source-revision propagation and artifact verification changes.

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant EvidenceCompilerImage
  participant PolymarketRawOps
  GitHubActions->>EvidenceCompilerImage: Build with SOURCE_REVISION
  EvidenceCompilerImage->>PolymarketRawOps: Compile with MONDAY_SOURCE_REVISION
  GitHubActions->>PolymarketRawOps: Run --version
  PolymarketRawOps-->>GitHubActions: Return embedded source revision

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes satisfy #390 by binding version output to MONDAY_SOURCE_REVISION and verifying mismatches in CI and ACR.
Out of Scope Changes check	✅ Passed	The PR stays within binary identity and workflow checks and does not introduce unrelated functional changes.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Title check	✅ Passed	The title is concise and accurately describes the main change: binding the Polymarket binary to the source revision.
Description check	✅ Passed	The description covers the required change, out-of-scope items, dependency, validation, and rollout details, with only a minor template heading mismatch.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/polymarket-binary-source-identity-390

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 78a2542e68

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".