P18.4 phase D: Data Layer v2.2.3 release candidate (rc13, 481fd67)

.env.example

@@ -39,7 +39,8 @@ BINANCE_WS_BATCH_SIZE=100
 BINANCE_WS_QUEUE_MAXSIZE=10000
 DATA_LAYER_BINANCE_SOURCES=binance_futures_trade,binance_futures_kline
 DATA_LAYER_DNSE_STREAM_ENABLED=true
-DATA_LAYER_VNSTOCK_POLLER_ENABLED=true
+# vnstock SDK is excluded from KN images; true there fails startup (VNSTOCK_UNAVAILABLE).
+DATA_LAYER_VNSTOCK_POLLER_ENABLED=false
 DATA_LAYER_PRELOAD_WATCHDOG_ENABLED=true
 BINANCE_WS_MAX_CONNS_PER_SOURCE=0
 STREAM_STALE_SECONDS=180

.github/workflows/ci.yml

@@ -7,6 +7,79 @@ on:
     branches: ["dev"]
 
 jobs:
+  consolidated-source-preflight:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout exact CI revision with prerequisite history
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: "3.12"
+
+      - name: Portable consolidated recipe unit tests
+        run: python -B -m unittest tests.test_p184_consolidated_build -v
+
+      - name: Verify exact committed source and expected HOLD
+        run: |
+          python -B - <<'PY'
+          import json
+          import os
+          import re
+          import subprocess
+          import sys
+          from scripts.p184_consolidated_build import CONTRACTS, PREREQUISITES
+
+          sha = os.environ["GITHUB_SHA"]
+          assert re.fullmatch(r"[0-9a-f]{40}", sha), "Expected full CI commit SHA"
+          head = subprocess.check_output(["git", "rev-parse", "HEAD"], text=True).strip()
+          assert head == sha, "Checkout differs from exact CI source"
+          result = subprocess.run(
+              [sys.executable, "-B", "scripts/p184_consolidated_build.py",
+               "--repo", ".", "--source-commit", sha, "--release", "v2.2.3"],
+              capture_output=True, text=True, check=False,
+          )
+          assert result.returncode == 2, (result.returncode, result.stderr)
+          assert not result.stderr, result.stderr
+          recipe = json.loads(result.stdout)
+          assert recipe["schema"] == "qdl.p184.consolidated-build-recipe.v1"
+          assert recipe["source_commit"] == sha
+          assert recipe["status"] == "HOLD"
+          assert recipe["build_script"] is None
+          assert recipe["build_script_sha256"] is None
+          assert recipe["prerequisites"] == PREREQUISITES
+          assert recipe["gates"] == {
+              "ts_tests": "pending", "ts_tests_scope": "MARKET_DATA_INTEGRATION_ONLY",
+              "ts_source_commit": None,
+              "ts_receipt_sha256": None, "dl_ci": "pending",
+              "dl_ci_source_commit": sha, "dl_ci_receipt_sha256": None,
+              "build_approval": "pending",
+          }
+          assert recipe["holds"] == [
+              "TS market-data integration regressions must pass; Paper/OR feature completion is not required",
+              "DL CI must pass for the exact source commit",
+              "explicit build approval required",
+          ]
+          blobs = recipe["source_git_blobs"]
+          assert set(blobs) == set(CONTRACTS)
+          assert all(re.fullmatch(r"[0-9a-f]{40}", value) for value in blobs.values())
+          images = recipe["images"]
+          assert {(image["name"], image["dockerfile"]) for image in images} == {
+              ("qdl-v2-python", "Dockerfile"),
+              ("qdl-v2-rust", "Dockerfile.qdl-rust-runtime"),
+          }
+          assert len(images) == 2
+          assert all(image["source_commit"] == sha for image in images)
+          assert all(image["tag"] == f'{image["name"]}:v2.2.3-{sha}' for image in images)
+          print(f"Committed-source preflight PASS: {sha}; build remains HOLD")
+          PY
+
   contract-tests:
     runs-on: ubuntu-latest
     steps:

CERTIFICATION_LEDGER.md

@@ -2102,3 +2102,73 @@ Published with `scripts/publish_github_release.py` against a fine-grained token
 held in a 0600 file outside the repository; the token was never printed and the
 tool refused to replace an existing release. `gh` is not installed on this host,
 which is why the script exists.
+
+
+## P18.4 DL closure candidate - 2026-10-07 (not certified)
+
+Status: SOURCE_CANDIDATE_READY_MEASUREMENT_PENDING. This entry does not replace
+previous immutable certificates or certify a runtime rollout. Published v2.2.2
+provenance is in upgrade/evidence/releases/v2.2.2/ and the Unified Plan publication
+closure; historical entries above are not a current runtime inventory.
+
+Candidate source 43bbcf0209f49e9cc1af6802af8f8a207a53ee3c, branch
+fix/p184-dl-closure. Rust 69e3b2b214331...; Python 77682eea5054...; exact
+digests/roles/rollback in [Phase C packet](upgrade/evidence/p184-dl-phase-c-packet.md).
+D2 SDK 2.1.0 response tolerance and IDR-062 top-change materialization are locally
+tested. Rust 102 PASS/1 existing ignored isolated-Redis test; SDK suites 28 and
+91 PASS; tools 8 PASS; packaged Python 29 PASS (overlapping source checks).
+Read-only BAR diagnostic: 20 retained 15m/30m windows, 214752 rows, zero gaps; not
+a proof beyond retained bounds. No shared mutation or latency improvement claim.
+
+External evidence: ~/.local/state/qdl-v2/p184-phaseb-20261007/evidence/phase-b-receipt.json.
+Inherited Phase A 4eb08dc, no catalogue/C2 rerun. Release waits for real/capture
+candidate resource/coherence evidence, TS DR01-DR08 and broker delta, and owner
+approval of the actual 12-role packet (handoff listed 13). D1/D3 remain deferred.
+Only source/docs, two candidate images and scoped test cleanup completed.
+
+
+### P18.4 IDR-062 offline pair and held core-first packet - 2026-10-07
+
+Status: PAIRED_OFFLINE_MEASURED_NOT_RUNTIME_CERTIFIED. Does not supersede any release
+certificate. [Paired result](upgrade/evidence/p184-idr062-offline-pair.md): identical
+ETH Binance/OKX public capture and configs on deployed 658a9570 / rc2 69e3b2b2;
+no shared changes. Top-change -> next snapshot p95 922/900 ms -> same-event 0 ms
+(provider timeline, NOT zero consumer latency). 44/41 actual top changes, exact
+delta parity; CPU observed .0600->.0627 vCPU and RSS HWM 19324->19612 KiB for one
+core/two bindings. 17 measurement/capture tests PASS. Capture hashed/deleted;
+test network/containers/keys cleaned; no new images or broad cache cleanup.
+[Phase C](upgrade/evidence/p184-dl-phase-c-packet.md): cores first, then Claude's
+post-rollout >=117/120 per-venue coherence receipt plus CPU/lag gates, then other
+roles. Prior pre-rollout coherence wording is superseded. Runtime remains HELD,
+TS DR01-DR08/broker delta and runtime approval still required. No release/push/merge.
+
+### 2026-10-07 - Read-only release-readiness audit (not promotion)
+
+Application rc2 remains43bbcf0, undeployed. See
+[readiness report](upgrade/evidence/p184-dl-release-readiness.md) and
+[active pair/capacity](upgrade/evidence/p184-idr062-capacity-envelope.md).
+Active pair PASS at135/156top-changes/minute; current whole-stack5vCPU gate FAIL
+(mean5.9618, n60intervals/307.156s). TS snapshot119/120usable; one strict LAST refusal.
+Stream overflow+4 and TS cache lag require DR07 attribution. Exact delivery lag/
+Redis-ACK/alpha cache latency NOT_MEASURED. Phase C HOLD, not authorized/deployed.
+Only TS DR01-DR08 includingDR07 +broker delta are release dependencies; no Paper
+feature construction added. Prior certificates kept immutable and scoped, no
+freshness/quota/resource threshold change. No required endpoint replacement identified.
+
+
+### 2026-10-08 - Bar edge inherited; v2.2.3 preparation only
+
+Owner-approved bar edge51450612 (sourced6d2637) replacedf7351c3b at02:17:33UTC.
+No other role changed in this Codex continuation. Existing658a9570 cores retained;
+coherence uses owner-approved TS IDR076 productpath. Failed0d8da150 excluded.
+[Prepared v2.2.3](upgrade/evidence/releases/v2.2.3/RELEASE_NOTES.md) names17runtime
+images and rollback; NOT certificate/tag. Busywindowmean4.882532vCPU,n30/299.992s
+meets frozen300smean<=5; p955.564052/max5.870669 exceed5. Canonical/raw952.48/
+826.28offsets/s exceed threebaselines, markersincluded, not3000payload/sproof.
+Streamoverflow+2/replay+15901: TSPaperBTC TRADEqueueclosures bothvenues, followed
+byBinance replayOUT_OF_RANGE remain affectedrecoveryfindings. No evidence erased.
+IDR075prepared/tested: DL25/TS28PASS, realpublicpacket validatedbothsides. Target
+manifest/JWT11,bindingV3r23/64products; runtime10/r22. Fourinversefeeds addedonly
+topreparedartifacts, linearINDEX alreadyexists. Pairedruntimepreflight, DR01-08/
+brokerreceipts, releaseattestation/CI and approvedrollout remain gates. No new
+build/push/merge/tag or further runtime mutation. See mainplan for cleanup.