feat(reporting): persist authorized frozen reporting feeds

[bokelley]

get_reporting_status(view="periods") gains a durable, authorized walk of Core reporting records and the caller's terminal materializations and receipts. Capture releases the account lock and connection before projection, stores immutable wire records, and reauthorizes every continuation. Feed-enabled and receipt-only instances coexist on MCP and A2A.

Refs #1167. Replaces #1189 without changing or rewriting its published branch. B2.3 source integration only: epoch-0 queues, quarantine and the advertisement veto remain; B2.4 activation, aggregate artifacts, release, #1199 and TypeScript acceptance remain separate. #1172 remains separately scoped.

Why a replacement PR

PR #1189's published composition 8fb84eb5 has the invalid subject merge: compose frozen feeds with integrated reporting main. Its original conventional-commit job correctly rejected it. An appended commit cannot fix an ancestor's subject. This branch recreates the ordinary feature/main merge with a valid conventional title, then reproduces the reviewed correction tree and appends two narrow fixes. The original branch, commits, review and failed CI remain preserved; no amend, reset, rebase, force-push or validator exception is used.

The second original CI failure occurred before the reference seller started: SQLAlchemy 2.1 no longer installs the async greenlet dependency through the bare install target. Both example CI installs now request sqlalchemy[asyncio]>=2.0. The minimum version, all execution ceilings, job dependencies and strict aggregates are unchanged. This uses the dependency's supported extra rather than pinning away the failure.

Exact source identity

• Head a35882251f91d9050f2a0cf98e226a31442bdafa, tree 2f71a273c0218e7ffc490fb4df243d02711cff7b.
• New composition cea81b10f90da94067b42383ec40f3c921d24647 has ordered parents [50e35f0ae3540f19b40e8fc460f5870dfe018bf9, 09fd87f79a746665d828dea66b3a1dd9d1fc189e] and tree cd48225973a0f4ee592c80c8165393e1d2890488, byte-identical to old composition 8fb84eb5.
• Its sole-parent child e7fdb02dd29075154af180e8aab7495ae7dcce88 has tree 039f0559870b55df6eb5d3a274207cb364225495, byte-identical to reviewed feat(reporting): persist authorized frozen reporting feeds #1189 head a9bc4454. It is followed by sole-parent children 8e9c7fd83ed14df84e7d3156a74341553de82f83 and this head. This branch is not a descendant of a9; the original feature and actual main are retained ancestors in both histories.
• a9bc4454..a3588225: 2 files, +3/-6, Git binary patch with eight-character index IDs SHA256 29d83ad3d6a6017bbe8e7428e9e8959a29ead1c57c11bb10e54b410eaaf8ab32.
• Full PR against 09fd87f7: 38 files, +6343/-32, SHA256 3a3115f3ef4b722115edf2e967b9bef1fa0caf482687bcf5b470f11c4e0bac94. The 38 feature paths are unchanged as a set.
• The second changed file removes a redundant module-level TYPE_CHECKING import. ReportingFeedStore is already imported inside the constructor containing its only uses. All handler function/class ASTs and constants remain identical.
• All SQL, cache files and manifests are unchanged from a9. B464, C249, selector10, materializer187 and receipts102 remain byte-identical to main; feed33 remains byte-identical to the original feature. No fingerprints regenerated.

Feature and compatibility boundaries

The wire allowlist is obligations, revisions, adjustments, caller consumer-status, terminal materializations and revision/adjustment receipts. Private bindings, delivery attempts, pending checks and destinations stay private. Visibility precedes maxima, dependency closure, totals and pagination. Dependencies below incremental checkpoints remain available.

Compact rpf1 positions bind account, canonical consumer, semantic filters, after/through boundaries, snapshot identity, representation and last global key. Consumers advance the checkpoint after exhaustion. Page size/context may vary; semantic filters may not. Missing or incompatible positions require full replay. Immutable captured inputs/pages are never rebuilt from current configuration, readability, lifecycle or receipt leaves. Concurrent writes are deferred to a later walk, including with a one-connection pool; nested ledger transactions are rejected at this public boundary.

Receipt ingestion/replay and materializer reserve/I/O/finish keep their transaction boundaries. Per-instance discovery controls actual tools/skills, and every page rechecks caller/account authorization. Financial receipt numeric parsing stays strict; feed extensions may contain finite fractional JSON values. Page limits remain bounded exact integers.

Retained integration corrections and CI

The migration fixture requires the exact unchanged parent mapping, exactly ten waiver objects and 763 parent objects, plus all 33 feed objects. Existing objects are preserved byte-for-byte; no subset tolerance or DDL repair. Version probes use rc.6 and locale-sensitive C-only fixture flags are removed. Forty-two assertion extractions retain operations under -O: 35 outer awaits and seven entire predicates preserving preceding operands, multiple awaits and short circuit. Inverse AST reconstruction at a9 proved unchanged assertions-enabled order; those test bytes are unchanged here. Pure reads and cancellation joins remain intact. Two SQL damage pairs are parenthesized only.

The required Postgres conformance tests (Postgres 16) retains always() and permissions: {}, requires all eight upstream job keys and rejects every result other than exact success. Twenty job keys expand to 25 jobs. Feed jobs have contents: read; every job has an explicit timeout. Existing budgets remain unchanged, including feed native25m/test20m, compatibility50m/test45m/fetch2m, and installed25m/test20m. The native glob is filtered into a shell array before pytest sees explicit paths, excluding rolling/packaging/installed files. nullglob plus an empty-array failure prevents full-tree fallback; quoted arrays and bash pipefail preserve arguments and exit status. The title workflow retains the original feature's extra branch filter.

At a9, actual URL-present workflow-command collections produced 3,319 identities: core1979, process7, status251, materializer47, receipts637, receipt compatibility8, feed375, feed compatibility9, installed feed6. Selections were disjoint and their union equalled the full selection; the empty-selector control exited1. Selector/test bytes are unchanged here. This is prior collection evidence, not fresh execution or installed/rolling qualification for this head.

Validation and retained failures

Fresh local results at this head:

• Feed base selection: 166 passed, 224 intended optional skips, two deprecation warnings, 87.36s pytest / 108.079s outer. Raw stdout SHA256 e8f92a423e5f1e17828bad3258e1938559a0c225a3c26bdc40c0cbe9ec1189e5. No PostgreSQL or frozen-artifact coverage inferred from skips.
• Isolated dependency negative: SQLAlchemy2.1.0 without its extra fails the async import. The same version with the extra passes actual PostgreSQL async run_sync and the workflow's fixture-seeding command. The seed used exact source plus the qualified local dependencies; this is a focused local diagnostic, not an installed SDK or full storyboard result. Owned database/cluster removed after clean shutdown.
• The unchanged conventional-commit validator passes all eight commits. Normal Ruff, Black, mypy and adopter hooks passed without bypass.

Separately attributed historical local evidence on a9: native feed375 passed/zero skips in958.18s pytest, strict1045/1045 catalog mappings under C/libc/ICU, and original negative fixture/version controls. Those records remain bound to a9 and are not relabeled as runs of this head. The bounded source review approved a9; this replacement needs its own readback. Complete fresh CI must establish all25 jobs, nine real frozen artifacts, Python3.10 VCS/sdist controls and whole-job lifecycles. No old CI/review credit transfers.

Original #1189 run36058972101 attempt1 is terminal FAILURE: 25 jobs, 23 success, two failure, with no cancelled jobs. The strict PG aggregate passed. Conventional job107832953350 and translator job107832953324 remain ordinary reds. No retry or cancellation was requested. The original guard closed NOT_READY_ORDINARY_GATES with seal 6cdb5209f52e38075c88d66ed028e7025a15588766937577cda44bccd5cb004f; its 10/9/1 thread state and all prior seals remain unchanged. Its valid unused-import finding is corrected only on this replacement; the seven separately resolved source false positives remain attributed to their original receipts. Private tooling incidents are retained separately from SDK/CI outcomes.

Security and remaining limits

Fresh Gitleaks8.30.1 scans this exact head's38 full files (749,164 bytes) and all eight base-to-head merge-parent commits (146,106,145 added bytes), with byte/commit coverage reconciled. Current files: zero matches. History:82 retained matches individually recomputed from exact Git objects—68 schema idempotency examples,13 patterned documentation credentials,one verified digest; zero unadjudicated/private-credential matches. Fresh large-positive/negative controls passed. Disposition SHA256 8c59d6691262ed4d50068fb194c16c9351f6385f2df595de1d8a57f132c6ec2c. Pattern/allowlist limitations remain disclosed. No previous scan result transfers.

Standing train authorization permits a separately recorded exact-head substitute only when genuine GitGuardian App46505 explicitly size-skips. This is not a GitGuardian success. Fresh CodeQL output/annotations and ordinary CI/reviews remain required. The inherited documented wildcard/optional-auth exposure is unchanged, with no new listener/default/B104 suppression; the feed adds an opted-in read surface behind existing ingress. No new-risk exception or zero-alert claim is implied.

Six rolling release-note obligations remain: pre-17ee407a A, pre-0f34c666 B, pre-967b6e28 C, pre-5487f2bd B1, pre-3fd62121 B2.1 and pre-09fd87f7 B2.2 are unqualified. A whole-trigger startup after C remains unsupported; subset readiness/draining requirements remain. Historical discovery cost9rLB gets no #1191 credit. The legacy fail-closed cursor limitation receives no retroactive retention promise from this opt-in feed. Epoch-0/quarantine/advertisement veto, #1199/TS/release holds persist. Guard1201 stays draft LAST; legacy workflow stays disabled.

[aao-secretariat]

Ladon verdict: Approve

Approve.

The reviewer found no Critical/High/Medium findings. Walking the decision table top-down:

• Rows 1: no critical/high findings — skip.
• Row 2: gated_paths is false — skip.
• Row 3: high_risk is true but no (deleted) reasons (all four are (modified)) — skip.
• Row 4: no medium findings — skip.
• Row 5: high_risk + (modified) present, but no medium finding — skip.
• Row 6: no prior decision — skip.
• Row 7: no no-auto-approve team match — skip.
• Row 8: fewer than three medium findings (zero) — skip.
• Row 9: approve.

This PR replaces #1189 with a byte-identical feature tree; the genuine delta is two sound fixes (the sqlalchemy[asyncio]>=2.0 CI extra and removal of a shadowed TYPE_CHECKING import in receipts/handler.py). The feed surface is additive, fails closed on authorization and cursor HMACs, and keeps CI gates armed. The high-risk server files are modifications with no medium-or-higher concern, so they are presumed safe per the change-kind rule. review_decision is REVIEW_REQUIRED, but since gated_paths is false and no other gate fired, that does not block approval. Final merge remains subject to the fresh CI the PR body requires.