feat(polymarket): publish source-bound quote runner

[proerror77]

Change contract: publish an immutable, source-bound bare-metal Polymarket quote-runner artifact from the exact selected source, with exact CLI, image, binary, and manifest verification.\n\nOut of scope: production deployment/cutover; reference collector, uploaders, raw-ops behavior, snapshots, research logic, and #235.\n\nDependency or merge order: #420 merged first as eb095a7; this PR is based on that exact merge SHA.\n\nFocused validation:\n- deployment/aliyun/test-polymarket-market-recorder-release.sh\n- .github/scripts/test-acr-publish-workflow.sh\n- bash -n and shellcheck for the release helper and test\n- actionlint for acr-publish.yml and ci.yml\n- cargo +1.91 fmt --manifest-path rust_hft/prediction-markets/Cargo.toml --check\n- exact-source new-ploy-runner build and exact --version/-V verification\n- feed::recorded::tests::writer_records_explicit_quote_collection_classification\n- real binary release create/verify plus mutated-source rejection\n- two-axis code review: approved with no P0-P3 findings\n\nRollout/rollback impact: after merge, manually publish the polymarket-market-recorder target, independently verify the artifact, upload it to a digest-addressed OSS release path, and atomically replace only /opt/monday/bin/new-ploy-runner while preserving the old digest-addressed binary and evidence for rollback. No other production identity changes in this PR.

Summary by CodeRabbit

• New Features

  • Added --version and -V options to display the runner’s source revision.
  • Release packages now include checksummed binaries and signed metadata describing the build and image.
  • Published builds now provide downloadable release artifacts with 90-day retention.

• Bug Fixes

  • Added validation to reject invalid source revisions and detect tampered or incomplete release packages.

• Tests

  • Expanded automated checks for build metadata, artifact integrity, and release workflow compliance.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds source-revision metadata to the Polymarket runner, creates verified release artifacts from published images, uploads them, and adds static and runtime contract tests to CI.

Changes

Polymarket release flow

Layer / File(s)	Summary
Source-bound runner build rust_hft/deployment/docker/Dockerfile.polymarket-market-recorder, rust_hft/prediction-markets/apps/new-ploy-runner/src/main.rs	The Docker build validates SOURCE_REVISION and embeds it into new-ploy-runner, whose version flags report the embedded revision.
Release artifact creation and publication .github/scripts/polymarket-market-recorder-release-artifact.sh, .github/workflows/acr-publish.yml	The helper creates and verifies checksummed binary and JSON manifest artifacts, while the publish workflow extracts the runner and uploads the verified directory.
Release contract validation deployment/aliyun/test-polymarket-market-recorder-release.sh, .github/workflows/ci.yml, deployment/aliyun/test-trading-ecs-host-contract.sh	CI runs static and optional image-based contract checks, including tampered-manifest rejection, and updates the expected artifact-upload count.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ACRPublishWorkflow
  participant DockerImage
  participant ReleaseArtifactHelper
  participant ArtifactStorage
  ACRPublishWorkflow->>DockerImage: Extract new-ploy-runner
  ACRPublishWorkflow->>ReleaseArtifactHelper: Create and verify release artifacts
  ReleaseArtifactHelper->>ReleaseArtifactHelper: Generate checksums and manifest
  ACRPublishWorkflow->>ArtifactStorage: Upload verified artifact directory

Loading

Possibly related PRs

• proerror77/monday#280: Modifies the same ACR workflow and Polymarket Docker build path.
• proerror77/monday#347: Modifies the same CI control-plane verification step.
• proerror77/monday#391: Adds related source-revision version validation in the publish workflow.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR covers artifact publication and verification, but not the deploy, quote-record, and rollout criteria in #421.	Add the deployment/install, service-identity, quote-record, and rollout-preflight work required by #421, or split the issue to match the publication-only scope.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The changes stay focused on the Polymarket runner release flow and related validation, with no obvious unrelated edits.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Title check	✅ Passed	The title is concise and accurately summarizes the source-bound Polymarket runner publication.
Description check	✅ Passed	The description covers the required change, out-of-scope, dependency, validation, and rollout details; only the explicit Scope exception section is missing.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/polymarket-quote-runner-421

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0b7309b1b4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".