fix(release): import receipts for the frozen candidate

[nullStack65]

The native receipt import job had no way to receive the operator's file and rebuilt the candidate before import. Add a bounded native_receipts_json dispatch input, pass it as data through an environment variable, and bind the selected frozen candidate's run ID, repository, source SHA, version, attempt and manifest digest before existing target-owned artifact receipt verification/upload.

Receipt-import dispatches skip candidate builds and qualification. Preserve the frozen candidate and all existing verification/publication gates, including PR24 Intel DMG inspection. Update the operator instructions.

Validation: 15 focused workflow tests pass, including execution of actual inline Node checks against synthetic candidates with identity tampering and invalid/oversized UTF-8 input; scoped type-aware lint/type check, formatting, YAML parsing and diff checks pass. Distinct Luna review found no blocker. No genuine native receipt created, installation or publication. PR20 remains the single release owner. Normal exact-head CI required before ordinary landing.

Current-base integration: published branch head1e6cf4f5e7a13d5492def3ef686816880f098bec includes landed PR26/main e3ff441. Diff against current main remains the same three reviewed receipt-ingress files. Exact integrated-head normal CI must pass before ordinary squash landing. GitHub PR metadata is temporarily reporting the previous head; branch ref independently verified through connector and authenticated gh. No merge while head/checks disagree.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository: nullStack65/t3code/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2e9113a4-4412-486c-bf0b-c68810fbba83

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[nullStack65]

Current-base integration: PR26 landed via ordinary guarded squash as e3ff441 after exact-head CI37642582778 SUCCESS. PR25 now nonforce-fast-forwarded from29477bef to1e6cf4f5e7a13d5492def3ef686816880f098bec, integrating that main ancestry; tree6641d176e620f2a95127acd8e68805c69121b40d. The diff against refreshed main remains only the same three reviewed receipt-ingress files. New exact integrated-head normal CI required; no unchanged broad local tests rerun. Final landing remains ordinary squash to preserve linear main; no bypass or force.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.5 KiB	−34 B (−0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	+4 B (+0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−38 B (−0.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.3 KiB	56.2 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	10	9	−1 (−10.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.6 KiB	+35 B (+0.3%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	+6 B (+0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+29 B (+0.4%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.0 KiB	+44 B (+0.1%)	66.4 KiB	✅
Claude	Live turn messages	8	9	+1 (+12.5%)	21	✅

Baseline: e3ff441 · PR result: 1e6cf4f · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 114.1 KiB
• Claude decoded thread snapshot: 114.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[nullStack65]

PR synchronization recovered using one ordinary close/reopen of this same PR at15:35UTC. GitHub now reports exact integrated head1e6cf4f5e7a13d5492def3ef686816880f098bec and current basee3ff44102cbd6e93581d96b316d452218fcc9729. Prior head29477bef CI37642518319 SUCCESS is retained historical evidence; new normal CI must qualify this integrated head. No source rewrite, force, settings change, alternate PR or review removal.

[nullStack65]

Source RESULT: ordinary exact-head guarded squash merged59152d9d9d8fa363f03794ac2ed608ffa36779de, single main parente3ff441, tree6641d176 exactly equals reviewed integrated head1e6cf4f5. Exact integrated-head normal CI37645079144 SUCCESS; exact finalsource postmerge CI37646455496 SUCCESS. All substantive source checks green; no unresolved discussions, admin/bypass/force or branch deletion. Genuine receipts not yet imported: finalsource candidate37646685913 is building. PR20 substantive release record remains the single acceptance/publication owner.