Preserve authenticated initial intake heads during reconciliation

[roger-sato]

Summary

• Preserve the authenticated initial observation for revised intake PRs Kappa 0.1 budget screens and conditional paired-plane sensitivity #3107, Conditional κ = 0.001730189061233850760095: idle rank-48 star exchanges on #3148's T740 fill (+0.0238%) #3184 and Conditional κ = 0.001734815770385098563484: exact per-group idle-donor search on #3200 (+8.75e-9) #3251. At canonical 20ecf2891d80b5acf18d980b2164fb44ea7faa90, the ledger retains each original starting_head, but mutable intake metadata describes a later head. The checker rejects these legitimate records, and a complete generator run incorrectly replaces their initial heads with the current heads.
• Share one Git-free checkpoint adapter between generator and checker. It authenticates four existing receipt files by exact SHA-256, selects the PR-specific original-head field, and verifies current/reviewed head, metadata number and contributor against the authenticated receipt. Original observations were independently checked against their first committed intake records: 82d67beb, 09fbc0f0 and 24db9bff. No ledger, intake, receipt, frozen source, selected result or source pin is changed.
• Add rejection controls and watch the exact new helper, test and receipt dependencies in the existing tooling workflow. This is an explicit adapter for the current checkpoint: changed receipt bytes or another revision of these three PRs fail closed and require reviewed maintenance. Future intake needs a durable immutable initial-observation pin; unverified ledger history is never a fallback.

Credit Douglas R. Colkitt's reconciliation/intake infrastructure, roife's PR704 for metadata binding, and the retained Gonzalo Mier / rohanarun contribution records. This contribution repairs offline provenance checking, not scientific results or live GitHub state.

Test plan

• CPython 3.12.14, macOS 27 arm64: all 7 new tests pass normally and with -O, with warnings treated as errors. They execute the actual generator and checker metadata boundary, preserve current head/reviewed head/attribution, and reject forged initial/current heads, future revisions, metadata substitutions and changed receipt bytes.

  python3.12 -B -W error -m unittest discover -s tests -p 'test_pr_reconciliation_initial_heads.py' -v
  python3.12 -B -W error -O -m unittest discover -s tests -p 'test_pr_reconciliation_initial_heads.py' -v

• Independent complete generator comparison, with writes intercepted in memory: exactly three starting_head values change across 3,028 rows; every other JSON value and the complete Markdown output remain identical. No generated artifact was written.

• Independent code/source-binding review; no live registered SOURCES.json or VERIFY.json pin needs modification. Historical evidence remains unchanged.

• In a disposable complete integration tree with this change plus exact pending PR3648 (a0d88d68), PR3686 (932f3b1) and PR3688 (3463ba61), all 38 reconciliation tests pass in both modes. Both new files are included in the tracked inventory used by the historical wrapper. Those other PR changes are not included here.

  python3.12 -B -W error -m unittest discover -s tests -p 'test_pr_reconciliation*.py' -v
  python3.12 -B -W error -O -m unittest discover -s tests -p 'test_pr_reconciliation*.py' -v

• Ran python3.12 -B scripts/replay_historical_check.py tooling-ledger once on that combined tree, capped at 600 seconds. It passes the former initial-head failure and the family checks through batch1047, then exits after 29.76 seconds at the separate existing PR1048 review-completion mismatch: batch1099's historical flags/evidence differ from the later ledger record. The untouched canonical checker reproduces that failure directly. No validation bypass or data rewrite was added.

• Full tooling CI is not green: it needs the pending compatibility fixes above and separate resolution of the existing PR1048 mismatch. No complete historical-ledger replay success or Linux execution is claimed.

Prepared with substantial OpenAI Codex assistance for investigation, implementation, tests, execution, independent agent review and writing. Apache-2.0.

Hosted follow-up (2026-10-19 JST): the fork push run at af040ab4 passes the exact tooling and scoped owner/provenance steps, then stops before the reconciliation unit tests at the unchanged docs/ci-verification.md source-admission guard addressed by PR3648. Thus the new reconciliation tests and combined 38-test result above remain local evidence. Upstream pull-request Actions require maintainer approval; no full Linux ledger success is claimed.