[HouMinXi]

Scope

Implements only Phase 7 W2-1/W2-2 and W2-6 from the plan:

• Persist per-host-row UNTRUSTED fingerprints; exclude them from historical novelty.
• Persist and validate new preserve_basis records; accept legacy basisless preserved rows with a warning.
• Add digest-bound receipt source/channel, producer unavailable causes, and display-only receipt subtypes in verify/report.
• Preserve fail-closed verdicts, clean-credit/accounting, legacy receipt interpretation, and all 17 existing receipt-writer positional parameters. Product falsifier failures do not gain infrastructure trust from metadata.

This is independent of merged #352/#349/#350/#351. Base main: 8493df4cec2e951eed3ff9b17128418020acd2ed; head: 3f595aa7c63cdce84020f57218c16655e0e77c8c. The original plan checklist is a historical snapshot; this PR records wave 2b implementation/review status, not later-wave completion.

Compatibility and #351 composition

The only additional integration change is an audited StateFinding pin evolution for optional receipt_subtype: str | None = None. The test retains the original class hash after removing exactly that field, pins the complete new class, and rejects metadata-default/control-field/control-method mutations. All old fields/defaults/methods and other #351 isolation pins remain unchanged. #349 advisory and #350 null-config behavior are retained.

Review

• Owner five-lens passes, explicitly not independent.
• Official Compound Engineering 3.34.0 native/internal seven-persona review, independent validation and dedup: one positional-API defect was found, fixed, and re-reviewed; two consumer-test gaps were closed.
• Fresh affected final-byte reviews plus independent full-scope coverage validation; unchanged persona coverage is explicitly attributed, not described as fresh.
• Separate fresh sixth requirements acceptance.
• Subsequent actual-main/test: enforce current projection presentation isolation contract #351 composition received independent five-lens review and fresh requirements/pin acceptance: no findings.
• Final merge changes no source bytes: final tree equals reviewed integration tree aa6389c858cd0208b43309e6e2c5d8967459f95a.

No external-model review or transmission, merge approval, deployment, or full-suite certification is claimed.

Validation

Selections overlap and must not be summed:

• Integrated focused regression: 2125 passed, 19 deselected.
• Final-head quick compatibility/provenance/preservation/projection/null-config checks: 92 passed.
• All 20 touched Python files pass Ruff check/format; git diff check clean.
• Red controls cover preservation corruption, metadata/labels, producer cause capture, and pin isolation.

Local limits: the 19 deselected c3v2 cases hit the already base-matched offline subprocess audit. Raw-L1 whole-module failures matched base exactly (142 failed/48 passed/142 teardown errors). The #349 in-process CLI selection matched actual-main's 30 no-toolchain failures exactly; combined integration selection had 682 passing cases. These are not passing full suites. The previously denied real CLI/full-toolchain route was not retried or bypassed.

Remote CI is now terminal green for this exact attribution-clean head (verified 2026-11-01): Linux tests #242, lint #75, and CodeQL #873. Linux logs report 31922 passed / 81 skipped / 64 deselected in the service-free selection, plus 568 ownership/cancellation, 32 cgroup sandbox, and 11 local-process integration cases passing (selections may overlap; do not sum). Earlier duplicate synchronize runs were superseded/cancelled; no old-head CI is used as proof for this head. The head's CI was green before the separately authorized merge sequence.

Final composition check

Merged-main candidate after #347 (4746e6ec163700b859978665ca2d28b738d8fc56) combines cleanly with this unchanged head. All 28 changed paths are disjoint across #347/#353 and retain their reviewed owner blobs. Expected final tree: a649d8acf41985fbab743db4ae376005d91c0b73. Combined focused verification passed 2,094 tests with zero failures/skips; full Ruff check/format (789 files), whitespace, and independent composition/requirements acceptance pass. Receipt writer retains all 17 positional parameters/defaults; StateFinding's only additive field remains optional receipt metadata; runtime strict-response remains opt-in. No denied real-CLI/Semgrep route was run. Final main push CI is now verified below.

Final merged-main CI

Both approved PRs are merged. Final main 2141c997494d08a6756d7073c5dcb1397fc48dee has the reviewed composition tree a649d8acf41985fbab743db4ae376005d91c0b73; Linux tests and CodeQL are terminal green. Linux logs confirm this exact checkout: 32,010 service-free cases passed (81 skipped, 64 deselected; 2 subtests), 568 ownership/cancellation, 32 sandbox, and 11 integration cases passed (7 deselected). These selections may overlap and are not summed. Both merged feature branches were deleted and their absence verified. No CI source fix or history rewrite was needed for this merge sequence.

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →