test: add canonical Tradernet LTP replay

[safal207]

What changed

Adds canonical, hash-chained LTP JSONL traces and deterministic offline replay evidence for two bounded Tradernet public audit journeys:

• public terminal loading;
• mobile onboarding-image visibility.

The workflow:

• checks out the exact audited 40-character SHA;
• performs the existing read-only public browser capture;
• checks out the LTP inspector at frozen revision 5474f29021adf1fd9257f7d8375fedc485d00352;
• binds the critical-action registry from that same frozen revision;
• creates one-object-per-line canonical JSONL using SHA256(prev_hash || canonical_json(frame));
• applies JavaScript-compatible numeric canonicalization so Python hashing matches the inspector's JSON.stringify bytes;
• runs the agents profile in strict JSON mode with replay checking;
• runs offline replay twice and requires byte-identical stdout and equal SHA-256;
• records commands, stdout, stderr, exit codes, inspector report, explain output, replay comparison and file digests;
• never re-invokes the browser, model, tool or protected effect during replay.

Exact-head result

Current PR head: bab457b564be5f11affe9de0146011d1a723a121.

All checks completed successfully on that exact head:

• CI run 30250476221;
• Security Audit run 30250476235;
• Tradernet Public Terminal Loading run 30250476160;
• Tradernet Terminal Mobile Image Visibility run 30250476251;
• Tradernet Canonical LTP Replay run 30250476311.

Both LTP matrix jobs passed the full path:

exact checkout
-> bounded public capture
-> frozen inspector checkout
-> canonical JSONL trace
-> strict agents inspection
-> offline replay #1
-> offline replay #2
-> byte comparison
-> exact final HEAD
-> immutable manifest
-> evidence artifact
-> artifact receipt

Inspector result

Both traces report:

• verdict: PASS;
• profile: agents;
• trace integrity: verified;
• identity binding: ok;
• replay determinism: ok;
• continuity breaks: 0;
• failed checks: [];
• violations: [];
• frames: 9.

The inspector is frozen to 5474f29021adf1fd9257f7d8375fedc485d00352. The workflow also executes the frozen critical-action registry parity test before inspection.

Deterministic replay evidence

Both journeys produced byte-identical replay output with SHA-256:

546fd19eb912d03ca2c3fea14b46b4a83b155c62ca0f5695bdd5ec8e7e957798

Public terminal loading

• evidence artifact ID: 8646782241;
• artifact SHA-256: c1419f2a41a37fd13602e24fe5312123cc7e79c9dafc473bf0082e5c3fdbf641;
• receipt artifact ID: 8646782480;
• manifest SHA-256: 291755b6018567c658836d983766ed6fc6d54612e886faec060992f66596736e;
• trace SHA-256: f901cb98d71d93745f9931319c83cbc7f2a3d87014aa734b2a304e1ace4a6d31;
• inspector report SHA-256: bee86e0591924c96acbfb9baf23a464a7e4afe641c97a13c41ee584ad7a75868;
• hash root: 053c2839f398b9bafaa7933249c92d056b1e97b121e64204d925aceba9ffbcb5.

Mobile image visibility

• evidence artifact ID: 8646765314;
• artifact SHA-256: bda00d39f1e3571a009b020271f55df0759f973fc3839acd9239feea5e6d1a63;
• receipt artifact ID: 8646765590;
• manifest SHA-256: aef4515922d0e08f90d8ea3c72ac11ed5297011e4b39a0fcfa521e73d2e02cee;
• trace SHA-256: 30c96ad4037529775e6e9f777360642d71c5b68846102a8a2b68392d7eb33792;
• inspector report SHA-256: 11d17c5753f80d3bb7e019dde8de447561dc133d7d256d840ea30cfde854b97c;
• hash root: 77cd20dd438e64fe38503f9640c0379dac692bee43e30c80a465bfe404519e0a.

Downloaded ZIP SHA-256 values match GitHub artifact digests. Each receipt matches its manifest, run ID, run attempt, artifact ID and artifact digest. Every file listed in both manifests matches its recorded size and SHA-256. A separate post-download verification completed 95 checks across the two bundles.

Negative coverage

Nine local/CI tests cover:

• clean canonical trace;
• JavaScript-compatible numeric canonicalization;
• tampered event;
• reordered events;
• duplicate frame ID;
• changed session identity;
• unsupported trace version;
• malformed JSONL;
• direct critical action from WEB context.

Fail-closed hardening found during implementation

The development runs exposed and fixed several evidence-path defects rather than suppressing them:

• a workflow encoding error prevented GitHub from registering the workflow;
• a literal -- was passed as the inspector command;
• Python 0.0 serialization differed from JavaScript 0 hashing;
• an opaque file upload corrupted the Python source;
• the package-manager lifecycle banner polluted machine-readable JSON.

The final implementation uses verified UTF-8 source, direct frozen inspector invocation and clean JSON output. Failed LTP runs publish a separate diagnostic artifact instead of dropping evidence.

Safety and claim boundary

This remains advisory and read-only. It does not authenticate, submit forms, access a portfolio, place orders, transfer money, send messages, deploy, fuzz, load test or execute any action represented by the trace.

The successful result supports ADMISSIBLE only for these two bounded, exact-head CI traces and their recorded offline trajectory. It does not establish Tradernet production readiness, authenticated-flow safety, storage durability, tenant isolation, encryption, retention, backup/recovery or operational monitoring.

Stack

This draft PR is stacked on draft PR #118. Relative to #118 head 3a6ca6430691f45c3a0d0c5473aab96d439b23ec, the branch is not behind and changes exactly four LTP files. After #118 merges, this PR should be restacked or retargeted before merge.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 37702217-80e0-42bf-a4ea-5085b548c2a4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/tradernet-ltp-offline-replay

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}