fix: bind the periodic publisher to its reviewed wire path - #106

_{P1 Badge} Remove personal workstation data from the tracked receipt

When this tracked evidence is published, the captured PATH exposes the operator's Windows username (3fall), private home-directory layout, tool inventory, and Codex runtime paths; PYTHONPATH/TEMP and the embedded pytest output repeat those identifiers, and the second new receipt contains the same disclosure. Regenerate both receipts with usernames and machine-local paths redacted or normalized before committing them.

AGENTS.md reference: AGENTS.md:L544-L549

Useful? React with 👍 / 👎.

_{P1 Badge} Reproduce the producer-only false-green defect

This receipt reverts both the publisher and the consumer, and its recorded failure is the old consumer raising ValueError("invalid reading shape") on the descriptor key. That failure already occurs when a test calls _pack_reading directly, so it does not demonstrate that the strengthened queue-backed guard catches the prior coverage escape. Preserve the corrected consumer and reproduce a producer-path defect such as dropping descriptor_envelope forwarding, with the old guard green and this guard red, before using this receipt as the false-green evidence.

AGENTS.md reference: AGENTS.md:L366-L369

Useful? React with 👍 / 👎.

_{P2 Badge} Accept schema 2 in trusted-base receipt comparison

When this new v2 receipt becomes part of the trusted base and a later guard change legitimately reruns it, compare_red_reproduction_bindings enters its moved-receipt/moved-guard path and calls _honest_candidate_receipt, but tools/ci_active_checkout_runner.py:618 still accepts only schema_version == 1. Protected active-checkout CI will therefore reject every valid rerun of this receipt before examining its bindings, making the prevention evidence impossible to update after a guard change; extend that comparison path to validate v2 before emitting v2 here.

AGENTS.md reference: AGENTS.md:L387-L390

Useful? React with 👍 / 👎.

_{P2 Badge} Redact host paths outside the temporary worktree

When pytest reports a warning or traceback from an installed plugin or dependency, its output can contain /home/<user>/..., /Users/<user>/..., or another interpreter/site-packages path that is outside worktree; this normalizer replaces only the temporary checkout prefix, so the resulting tracked receipt can still disclose workstation identity. Fresh evidence at this head is the new generic normalizer's single-prefix replacement, while the added regression only checks the previously observed Windows strings. Redact or reject all host-specific paths before writing the receipt.

AGENTS.md reference: AGENTS.md:L544-L549

Useful? React with 👍 / 👎.

_{P2 Badge} Align schema selection with the optional evidence modes

When callers supply --source-mutations without a false-green control, or supply a control without a source mutation, the producer permits the combination and selects schema 2 here, but _validate_red_reproduction_evidence requires every schema-2 receipt to contain both source_mutations and all control fields. The tool therefore executes the reproduction and writes a receipt that its own governance validator immediately rejects as an inexact shape; either require the two modes together up front or make the schema fields conditional.

AGENTS.md reference: AGENTS.md:L361-L369

Useful? React with 👍 / 👎.

_{P2 Badge} Correct the summary of the executed red receipts

The bound runtime receipt selects only nine nodes, not the twelve claimed here: it omits the no-descriptor, real-socket fourth-topic, prefix-topic, and foreign-topic guards. The next claim is also inaccurate because the paired false-green receipt binds defective commit 04e7a309..., whereas only the runtime receipt binds 062a0e3b.... Consequently this tracked evidence summary overstates both the executed coverage and the common object binding; regenerate the missing executions or describe the two receipts exactly.

AGENTS.md reference: AGENTS.md:L445-L450

Useful? React with 👍 / 👎.

_{P2 Badge} Record the environment that pytest actually received

_run_pytest receives _test_environment, which includes the actual PATH and, on Windows, COMSPEC, PATHEXT, SYSTEMROOT, and WINDIR, but every receipt replaces that mapping with this fixed four-key value. When tool resolution, plugin loading, or OS facilities affect the red result, the receipt therefore records a different environment from the one that executed and cannot support exact adjudication; normalize sensitive values while preserving the executed keys rather than dropping them.

AGENTS.md reference: AGENTS.md:L168-L170

Useful? React with 👍 / 👎.