fix: bind Tradernet audit artifacts to exact head

[safal207]

What changed

• checks out the exact audited 40-character SHA instead of the synthetic refs/pull/<n>/merge revision;
• records and compares initial, expected, and final HEAD values;
• requires a clean worktree before and after browser capture;
• moves generated reports and temporary browser dependencies outside the repository worktree;
• gives each evidence artifact a unique run_id-run_attempt name;
• adds an immutable manifest.json with repository, workflow SHA, expected/initial/final SHA, run ID, run attempt, timestamps, file sizes, and SHA-256 digests;
• adds a post-upload artifact-receipt.json binding the manifest to GitHub's artifact ID, URL, and artifact digest;
• applies the contract to both Tradernet public terminal loading and mobile image visibility workflows.

Root cause

The previous workflows relied on the default pull-request checkout behavior. GitHub Actions therefore checked out a synthetic merge revision while the audit report described the PR head SHA. Re-runs also reused the same run ID and artifact name, leaving the evidence identity ambiguous without run_attempt, artifact ID, and digest.

The first fail-closed execution also exposed an untracked Python __pycache__ generated by the helper validation step. The helper check now parses the source without writing bytecode and runs tests with PYTHONDONTWRITEBYTECODE=1; the final clean-worktree gate remains strict.

Safety boundary

This remains an advisory, read-only public observation. The change does not add authentication, form submission, portfolio access, orders, financial operations, fuzzing, load testing, deployment, or repository write credentials.

Exact-head validation

Current PR head: 3a6ca6430691f45c3a0d0c5473aab96d439b23ec.

All exact-head checks completed successfully:

• CI run 30224538046;
• Security Audit run 30224538037;
• Tradernet mobile image run 30224538050;
• Tradernet public terminal loading run 30224538039.

Both Tradernet workflows passed:

• exact SHA checkout;
• initial HEAD equality;
• bounded public-only safety contract;
• manifest helper tests;
• passive browser capture;
• final HEAD equality;
• clean final worktree;
• manifest generation;
• evidence upload;
• artifact receipt generation and upload.

Artifact verification

Mobile image evidence

• evidence artifact ID: 8638182559;
• artifact SHA-256: dc95d6b3b530167cc031c57abefc2ae5b60b0f4330e6fa739e77fd2dc5e42285;
• manifest SHA-256: 541329ce6b7f72af62d6d6bc5c8ee3b0f28940380b57e91ef372702f0ac3a34d;
• receipt artifact ID: 8638182660.

Public terminal loading evidence

• evidence artifact ID: 8638192000;
• artifact SHA-256: a907bd558d990d412f531b403ddc99fcc4386378df5fbaaf55cb2f41077b820d;
• manifest SHA-256: ec8ee00c25832b0d399a9e01d2d14fb570c1bd4c9e3350982bc37e46312a142d;
• receipt artifact ID: 8638192166.

Downloaded ZIP SHA-256 values match GitHub's artifact digests. Each receipt matches its manifest digest, run ID, run attempt, artifact ID, and artifact digest. Every file listed in both manifests matches its recorded size and SHA-256.

Local validation

• Python source parsed successfully without bytecode output;
• three unit tests pass:
  • file hashing and exact-head binding;
  • fail-closed rejection when final HEAD differs;
  • artifact receipt binding to run_id, run_attempt, manifest digest, artifact ID, and artifact digest;
• both modified workflow files parse as YAML;
• diff remains limited to two Tradernet workflows, one helper, and one test file.

Follow-up not included

Canonical LTP JSONL generation and deterministic offline replay remain a separate follow-up. This PR fixes evidence identity first and does not claim that live browser recapture is deterministic replay.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d43815d3-62a9-4252-bbc4-3b738429ad8d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/tradernet-exact-head-manifest

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}