[PILOT-04] Deliver the external checker flow end to end

[Abiorh001]

The checker pipeline now has one executable flow: bounded private ZIP preparation → four Workstream defaults → approved digest-pinned external PRE images over verified read-only files → caller-owned atomic immutable Submission/evaluation_pending/initial dispatch → external POST images → governed routing.

The defaults block unsafe ZIPs/resource overflow, failed server byte identity/manifest custody, high-confidence secrets and unchanged files unless the rules changed. Summary and attestation are optional warnings. Project rules execute in images. Work failures return findings without creating a Submission; infrastructure failures preserve recoverable evidence. TASK-before-CHECKERS custody is retained.

Both executable catalogues, their services/DTO facades/alternate request/result decoders and catalogue-only tests are removed. Fresh SQL intent/admission writes require current external-checker lineage. Retired PRE attempt/evidence/member writes are refused. Existing immutable records and required schema/protocol identities are retained as data; migration tests restore literal captured rows without invoking retired checker implementations.

Not ready for human merge approval yet. Published head 683ba388e passed the real-image drill, Rust runtime, CLI, MCP and Agent Gates. The required Backend run failed: shared fixtures still construct superseded custody, selected-policy assumptions need reconciliation, and the schema lane exceeded its existing bound. Those failures are being repaired in one reviewed batch, without compatibility code, guard weakening or CI cap increases. Three useful raw-SQL approval safeguards removed with catalogue tests have been restored against current external policy and passed real PostgreSQL. No passing total substitutes for final-head full CI.

Validation:

• Clean 835737909: three canonical PostgreSQL/MinIO controls passed in 245.53 seconds—every installed PL/pgSQL function compiles, retired writes refuse with exact SQLSTATE and unchanged retained rows, and current selected admission/dispatch/production completion reaches false-policy acceptance with complete contribution/award evidence and replay. Runner exit zero; database, role and object-store cleanup complete. Installed schema fingerprint f510310623f222209cbbee89291edb8e1582d65ddaf9d173d534dd796ab68991.
• Completed-0008 retained-material discriminator passed at 70424eedb in 90.06 seconds; prior helper fails at the intended terminal-member comparison. Paid-0018 preservation passed at 0749dfb10 in 96.33 seconds, reaching the actual submitter record and exact two awards through the 0019 upgrade. Both runners exited zero with full cleanup. Required assertions and SQL guards were preserved.
• All 93 current scratch tests passed after obsolete marker/ledger upgrades and their tests were removed. Independent SQL/TASK/ART, archive and fixture-delta reviews passed their recorded frozen heads. Ruff and six documentation/process gates passed.
• Canonical collection at 835737909 found 8,754 unique tests across ten lanes with no exclusions. This is collection, not exhaustive execution. After that production checkpoint, the published head adds the independently reviewed fixture transaction/parent lookup repairs, verification record and current-main CLI reconciliation; backend production code is unchanged. The merged CLI failure/timeout exit checks passed all 21 gate tests.
• Real PostgreSQL/MinIO/Rust owner flow at published 683ba388e passed default and actual external PRE success, immutable Submission/dispatch, actual POST and production completion to review_pending, default-secret and external-project rejection with no new Submission, stopped-service recovery and restart/replay. Runner exit zero; database, role, MinIO and scratch cleanup complete. Schema fingerprint is the final f510... value above.

The service and SDK are Rust; project images may use their own language. Actual sandbox evidence uses local runc/docker-dev, not hosted gVisor. File-output publication remains unavailable. Public contributor upload/finalize and CLI submit/status remain PILOT-12; false-guide activation remains PILOT-08. No deployment or merge performed.

Refs #491.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: eac79d10-7d34-4446-899b-fee90f6d91a3

---

📥 Commits

Reviewing files that changed from the base of the PR and between e31e177 and 7453a0d.

---

📒 Files selected for processing (12)

• .ci/behavior-ownership/partition.v1.json
• .commitrail/changes/pilot04-workstream-default-checker.md
• backend/app/modules/checkers/api/default_checker.py
• backend/app/modules/checkers/default_checker.py
• backend/scripts/behavior_ownership.py
• backend/scripts/test_lane_catalogue.py
• backend/tests/checkers/default/test_contract.py
• backend/tests/checkers/default/test_execution.py
• backend/tests/test_artifact_architecture.py
• backend/tests/test_ci_lane_catalogue.py
• docs/architecture_checker_framework.md
• docs/roadmap_status.md

---

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

---

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

Walkthrough

The PR adds an unselected, versioned Workstream default checker with four ordered blocking checks and warning-only observations. It adds input and result validation, archive evaluation, tests, ownership metadata, and documentation. The checker is not connected to an active caller.

Changes

Workstream default checker

Layer / File(s)	Summary
Checker contract backend/app/modules/checkers/api/default_checker.py, backend/tests/checkers/default/test_contract.py, .commitrail/changes/pilot04-workstream-default-checker.md	Defines the checker identity, ordered checks, warning codes, input and result models, and behavior hash. Contract tests validate check order, result shape, warnings, and eligibility.
Archive evaluation backend/app/modules/checkers/default_checker.py, backend/tests/checkers/default/test_execution.py, .commitrail/changes/pilot04-workstream-default-checker.md	Checks rejected and verified archives, detached material identity, secret signatures, and unchanged submissions. Tests cover successful checks, findings, warnings, and unavailable outcomes.
Repository integration and documented status .ci/behavior-ownership/partition.v1.json, backend/scripts/behavior_ownership.py, backend/scripts/test_lane_catalogue.py, backend/tests/test_artifact_architecture.py, backend/tests/test_ci_lane_catalogue.py, docs/architecture_checker_framework.md, docs/roadmap_status.md, .commitrail/changes/pilot04-workstream-default-checker.md	Adds the checker modules and tests to ownership and lane metadata. Updates architecture and roadmap descriptions to state that the checker is unselected and has no active caller. Records acceptance, validation, and review details.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

---

Merge Risk: ⚪ Minimal · up to 7453a

The checker remains unselected, and no merge-blocking issue was established. Merge after normal checks.

Pre-merge checks | 2 | 3

❌ Failed checks (3 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 35.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 40 functions across 8 files. (4 skipped: …	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check		The title claims an end-to-end external checker flow, but this change adds an unselected Workstream default checker and does not implement or wire the external checker flow.	Rename the pull request to describe the primary change, such as "[PILOT-04] Add the Workstream default checker contract and execution".
Description check		The description contains detailed implementation and validation context, but it does not follow the required Workstream PR Trust Bundle structure. Most required sections are missing, including Goal, I…	Rewrite the description using the repository template. Add each required section, record the applicable scope and product-behavior checkboxes, list commands and results, document acceptance-criteria proof and test changes, provide reviewer …

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

Full details: Docstring Coverage

Explanation

Docstring coverage is 35.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 40 functions across 8 files. (4 skipped: 4 unsupported.)

---

Full details: Description check

Explanation

The description contains detailed implementation and validation context, but it does not follow the required Workstream PR Trust Bundle structure. Most required sections are missing, including Goal, Intent And Planning Context, What Changed, Design Chosen, Scope Control, Evidence, Acceptance Criteria Proof, Test Delta, reviewer results, CI integrity, risks, follow-up work, and human review focus.

Resolution

Rewrite the description using the repository template. Add each required section, record the applicable scope and product-behavior checkboxes, list commands and results, document acceptance-criteria proof and test changes, provide reviewer and CI-gate status, and state remaining risks, follow-up work, and human review focus. Preserve the existing validation details and explicitly mark unavailable evidence or pending approval.

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}