Add the shared evidence-bound gap closeout loader - #982

Scope

Historical gap counts can remain open after later receipts supply evidence. This PR adds one shared Draft 2020-12 schema and one component-matrix loader for dated layer closeouts, using registered file hashes and two-family review credit. It adds no layer closeout records: the frozen crosswalk, matrix, host exports and main-base counts remain unchanged.

• Base: main eb31d233234cdc552fc81672087ac8769e3696e0; seven linear commits. The five reviewed commits were replayed, correction IBKR paper orders through NautilusTrader 1.231.0's IB engine, with an after-hours plan #147 remains its own sixth commit, and the FIRST GPT correction is one forward seventh commit.
• Published head: 416e5da30ceb63f4ae983faaab2f6843d5c4ecf5; the final commit refuses conflicting optional receipt hash/byte mirrors and unsupported installed jsonschema versions. Its direct parent is ad2e1b1ac4fc9c71a9a8a18a052813fa5f72b14c; no further rebase.
• Lane: lane:shared; other-lane acknowledgment and designated reads remain required. Runtime-workers' prior baseline ACK carries over under the CC's byte-preservation ruling.
• Scope: the shared loader/schema and their fixtures/docs, hash-pinned CI dependencies, the freshness-suite install, regenerated worker advisory snapshot and its direct comparison test, retained native evidence and explicit manifest registrations.

Each record names the original gap index/text and crosswalk hash, disposition/reason, retained evidence, supported vendor paths/pins and registered review references. The hash registry reads files[] only: real receipts[] rows contain descriptive metadata without hashes or byte counts.

A settled entry requires passing GPT and Claude JSON verdicts at one reviewed head, with reference metadata matching their registered bytes. A residual or blocked entry without that same complete credit records as proposed and preserves category/counts, including prior reviewed credit. Reviewed residuals remain open in their explicit category.

The conditional schema dependency uses the existing module-level SkipTest convention when jsonschema is missing. The freshness job keeps its calendar install step byte-identical to the existing pinned contract and adds a separate hash-pinned jsonschema step, using the existing CI requirements set, before Python 3.13 full discovery. Jsonschema 4.26.0 requires Python >=3.10; the no-record path retains the broader recording-script compatibility floor.

The worker advisory snapshot is regenerated on main c4f49907 through its unchanged native GitTree/derive_ci_protected path, following #849, and its existing test compares directly with the snapshot. The new snapshot has 330 locations and 98 shape entries, SHA-256 8752740817bb41c1a582e33fa475e4ce4064f2ccfecadb706bce40ecb4512157. The prior candidate also had 330/98, with SHA-256 04a245baf20ec34bfb33e76f0692bab6047331723a5c4f8da38f2da5fcf9a64c; those exact bytes are retained. Thirteen blind-checkout locations shift by two lines, with per-script counts and shape multiplicities preserved. The original pre-fix snapshot is retained too. Worker gate implementation, coverage bounds and enforcement assertions are unchanged. Layer PRs conform after this shared loader lands; #976 remains held for that sequence.

The architecture inventory test now uses :(glob)catalogs/landscape/*.json, matching both readers' top-level Path.glob('*.json'). The default Git pathspec had included the nested schema and failed CI on the real merge. The exact existing native method fails one test before and passes after changing only that literal. The complete requested modules pass on the integrated implementation. The test and its registered hash are the only authored changes beyond Git's clean integration of landed #984.

SOTA sources

• jsonschema v4.26.0, source a7277432b0f7bcd0551f6e589d30457017125df4: Draft202012Validator, check_schema, iter_errors:349, Python floor metadata, and supported install. The installed validator source matches the pinned bytes; CI uses exact package versions and hashes.
• Git v2.53.0 pathspec/glob semantics: default wildcard patterns can match directory separators; :(glob) applies FNM_PATHNAME. Native readers at merged main a7c15bd051088d0493d58bd84a3c8c35dcde6624 use top-level globs in architecture_sources.py:375 and architecture_builder.py:241.
• JSON Schema Draft 2020-12, validated through the upstream library rather than a replacement validator.
• Main c4f4990737c4e2ed8f0452d069e25a460f897bb5: existing confined loader, file registration, and receipt paths must be hashed files.
• pip 26.2.1 hash-checking option: the installed client and same-tag official source expose --require-hashes for repeatable installs. The existing calendar step is restored byte-for-byte; the separate schema step consumes the existing pinned CI file.
• The unchanged native workflow derivation and GitTree supply the regenerated advisory snapshot. The maintained refresh pattern is merged commit 89e89852161d8157e464f4bd07c2b5c747ad4706 (Flag runner-refused credential store lines #849); no hard-coded count/shape increments remain.
• Missing-library module convention: sampler tests.
• CPython v3.13.16 distribution-version API and missing-distribution exception, also used and recommended by pinned jsonschema. Both primary files match the installed bytes; source hashes are retained in gpt-fix/source-proof.json. The supported official metadata API supplies the runtime version check.

Evidence-class table

Local commands run

Latest correction at 416e5da3:

<CI_ENV>/bin/python -m unittest tests.test_gap_closeouts tests.test_component_matrix tests.test_validate
exit 0; 174 tests, zero skips (26 closeout + 64 matrix + 84 validator).
<CI_ENV>/bin/python scripts/validate.py
FULL exit 0; 70 components, 11,466 hashed files, 4 profiles, 239 receipts.
python3 scripts/component_matrix.py --check
exit 0; 32 rows, with the no-record path using an interpreter without jsonschema.
gitleaks git --no-banner --redact --log-opts='eb31d233234cdc552fc81672087ac8769e3696e0..HEAD'
Gitleaks 8.30.1 exit 0; seven linear PR commits, zero findings.

The two P2 regressions are retained in evidence/artifacts/shared-gap-closeouts-loader-20261010/gpt-fix/receipt.json: seven focused controls give six assertion failures and zero errors on the unchanged reviewed loader, then seven pass after the fix. Matching optional mirrors, metadata-only receipts and no-record behavior remain valid. An actual installed jsonschema 4.19.2 accepted the fixture before the correction and now refuses before returning a document; the actual missing-package refusal and no-record compatibility controls also pass. The version check uses the standard distribution metadata API before loading schema or closeout documents. The native worker assertion caught four extra advisory locations on an unpublished preparation candidate; naming the receipt metadata key receipt_path keeps it distinct from the filesystem iterator. The final committed-head worker assertion passes one test at 330 locations/98 shapes and zero unresolved; unchanged snapshot bytes retain the prior baseline ACK. These are fixture and integrity measurements. The earlier commands below retain their historical scope.

env PATH=<ci-env>/bin:<existing-PATH> nice -n 10 ionice -c 3 <ci-env>/bin/python -m unittest tests.test_gap_closeouts tests.test_component_matrix tests.test_runtime_worker_openhands_push_gate tests.test_start_closure_sampler tests.test_landscape_sweep_skills tests.test_saturation_ledger tests.test_lane_packets
Before the final freshness correction: exit 0; 552 tests, two existing conditional skips.

env PATH=<ci-env>/bin:<existing-PATH> nice -n 10 ionice -c 3 <ci-env>/bin/python -m unittest tests.test_workflow_hardening
At reviewed parent 8f933e57: exit 1; 142 tests, one StopIteration error, one existing conditional skip.

env PATH=<ci-env>/bin:<existing-PATH> nice -n 10 ionice -c 3 <ci-env>/bin/python -m unittest tests.test_workflow_hardening tests.test_gap_closeouts
At the preceding freshness correction: exit 0; 163 tests (142 workflow + 21 closeout), one existing conditional skip.
The workflow regression file remains unchanged.

env PATH=<ci-env>/bin:<existing-PATH> nice -n 10 ionice -c 3 <ci-env>/bin/python -m unittest tests.test_local_pages_architecture_landscape_exclusions tests.test_gap_closeouts tests.test_workflow_hardening
Before the landing rebase: exit 0; 170 tests (7 architecture + 21 closeout + 142 workflow), one existing conditional skip.

<ci-env>/bin/python <isolated guard-removal controls>
exit 0; five of five controls caught. These edit isolated module objects only.

python3 -m unittest discover -s tests -p test_gap_closeouts.py
exit 0; one declared module skip when jsonschema is absent.

<ci-env>/bin/python -m unittest <freshness/workflow modules>
Before the final landing rebase: 261 tests; one then-stale-registration publication assertion failed, the other 260 passed.
After supported registration refresh, the same publication assertion passed: one test, exit 0.

<ci-env>/bin/python scripts/component_matrix.py --check
exit 0; 32 rows, base counts 238 executable / 355 open unchanged.

env PATH=<ci-env>/bin:<existing-PATH> nice -n 10 ionice -c 3 <ci-env>/bin/python scripts/validate.py
Before the landing rebase: FULL exit 0; 70 components, 11,451 hashed files, 4 profiles, 239 receipts.

git diff --cached --check
exit 0.

gitleaks git --no-banner --redact --log-opts='eb31d233234cdc552fc81672087ac8769e3696e0..HEAD'
At ad2e1b1a: Gitleaks 8.30.1 exit 0; six linear PR commits, zero findings.

Fail-before interpretation is explicit: the original registry bug preempts the five existing guards' expected refusal messages in the real-receipt fixtures. Separate guard-removal controls prove that each named fixture detects its missing guard. The isolated residual/blocked cases measure the actual unauthorized count changes. No guard-removal control edits repository source.

The final freshness receipt is freshness-fix/receipt.json, with the actual fail-before and passing logs. The snapshot bytes remain SHA-256 8752740817bb41c1a582e33fa475e4ce4064f2ccfecadb706bce40ecb4512157, and the native derivation on the corrected workflow yields the same advisory locations and shapes. The new-base receipt is cc-fix/landing-rebase.json; its required-module log, original-baseline control and prior-candidate snapshot are registered too. The final committed-head worker assertion passes one test, and substituting only the original pre-fix snapshot makes that assertion fail as expected. The required logs, original snapshot and correction receipt are registered under evidence/artifacts/shared-gap-closeouts-loader-20261010/cc-fix/. The earlier synthetic equal-hash receipt fixture did not model the real metadata-only rows; the correction states that limit. Personal trace prefixes and final blank lines are normalized with actual assertions/results retained. The historical public-count trace keeps its execution-time line 200 and now cites current source line 298. Its linked receipt hash is refreshed.

The current branch contains seven linear commits on main eb31d233: 2c10ba79, c1d4439d, 7e768d69, bd42faf7, e1c6df76, ad2e1b1a, and 416e5da3. The first five replay the reviewed commits; ad2e1b1a preserves correction #147 as its own commit, containing only the one architecture test line and its native registry entry. The final forward commit addresses the two P2s in the FIRST GPT read. The only replay conflict was in manifests/evidence.json: the exact main copy was retained and the affected own rows were regenerated through the supported registration commands. The remaining registry deltas match the original commits row-for-row. All five replayed commits have identical range-diff output outside manifests/evidence.json; the fold carries the original regression evidence and records seven architecture tests with one failure before the correction and seven passing afterward. Main registrations and non-file registry arrays are preserved. No hand-merged manifest was used. Local testing follows touched modules plus FULL validate; full discovery remains hosted. The upstream full nox suite was not run, and these fixtures establish no vendor runtime, production-data or host acceptance.

At ad2e1b1a, the landing-rebase validation recorded FULL exit 0 with 70 components, 11,456 hashed files, 4 profiles and 239 receipts. The CI-parity venv ran all four required modules: 296 tests, OK, three skips (the existing conditional skip and two PyYAML-gated tests). Default Python, with PyYAML available, ran the other three modules: 275 tests, OK, one existing conditional skip; both PyYAML-gated tests passed. No single interpreter ran all 296 tests with one skip. The exact-head worker assertion passed separately, and snapshot SHA-256 8752740817bb41c1a582e33fa475e4ce4064f2ccfecadb706bce40ecb4512157 remains unchanged at 330 locations and 98 shapes. The range-diff and fold proofs have SHA-256 ab96d7593db0df206af4d678e897b595c999eea5fdf3853ca98e231e961a79ce and 9b5bfa3bf97674a86d77488cd94481f6cf3e1be500bcae67ec1b382bac527de9, respectively.

Decision record

docs/decisions/2026-10-10-shared-gap-closeouts.md and catalogs/landscape/gap-closeouts/README.md describe the authoritative registry, dependency floor, review-credit rules and supported update commands.

Host evidence

No host receipt or platform-status change. Per-layer host, production-data and login boundaries retain their own requirements. Runtime-workers independently regenerated and acknowledged the snapshot at 8f933e57 at 20:25:27Z. The CC's carryover ruling preserves that ACK: snapshot bytes remain unchanged, and the final committed-head native assertion passes. The CC acknowledged the peer inventory edit as correction #147, as #984's owner. The CC's 2026-10-11 00:23Z ruling carried its prior Claude PASS to ad2e1b1a using change-id 66088a3f1e92. The FIRST GPT read then requested these two P2 corrections. This forward commit changes the loader, so the CC determines whether that earlier Claude PASS carries to 416e5da3; carryover is not assumed. A GPT micro at the new head, current-head hosted CI and remaining landing gates are due.

Checklist

• Workflow action pins and permissions remain unchanged.
• Dependencies use existing exact versions and SHA-256 hashes.
• No credential values, expanded personal home paths or new required secrets.
• Peer-owned/protected paths and frozen historical crosswalk preserved.
• Required fixtures, source citations, native snapshot and final evidence bindings are retained.
• Worker baseline acknowledgment carried for the byte-identical snapshot.
• New-head hosted CI and designated reads.
• Other-lane acknowledgment and CC landing.