[seonghobae]

ACTIVE Draft — bind recovery receipts from immutable inspection snapshots

Refs #227, #233, #244.

Protected main remains 5913c4bad79d6bc29d7cc1c624abb7db2ea6a77c; no direct protected-branch write occurred. This remains an explicit child of #233.

Current exact stack

• base branch: fix/recovery-evidence-weakref-coverage-b84f0c9;
• exact base: 01d231fde23b82e2ced258d7bfcb4721ed75706d (test(recovery): cover stale evidence registry cleanup #233);
• head branch: fix/recovery-binding-snapshot-race-b84f0c9;
• exact head: 00c3535f434762f3090af6de0e449c3f6f9e6418;
• merge base: exact test(recovery): cover stale evidence registry cleanup #233;
• ancestry: 7 ahead / 0 behind;
• effective delta: only pg_llm_batch/postgres_recovery_binding.py and tests/test_postgres_recovery_binding_snapshot.py;
• state: Draft, open, mechanically mergeable;
• formal reviews: none;
• inline review threads: none.

Defect and bounded repair

The binding seam historically validated mutable frozen-dataclass evidence against inspection provenance and then could re-read mutable object fields. object.__setattr__() can replace digest/size fields after validation. The branch captures authoritative schema and backup identity from the inspection registries and constructs the receipt from those snapshots; fabricated or pre-call-mutated evidence continues to fail closed.

The branch had drifted onto historical #233 32469711f9a26a26ebcf4a7efcf20938bfdc94db. Reconciliation commit 00c3535f434762f3090af6de0e449c3f6f9e6418 preserves prior head dad610fe082cc8c19abfdc59d727242b87b5754a as first parent and current #233 as second parent. Its tree starts from the exact current #233 tree and reapplies only the two owner files above. The branch ref advanced non-force; no rebase, force-push, synthetic status, gate weakening, or unrelated workflow ownership was introduced.

No receipt schema, persistence, tenant authority, backup/restore execution, path/credential authority, RPO/RTO, HA/DR, or certification claim is added.

Exact-head evidence

For exact 00c3535f434762f3090af6de0e449c3f6f9e6418:

• CI 34493600261: completed / success;
• Release Acceptance 34493600524: completed / success;
• CI exact-head checkout, Python 3.10/3.12/3.14, coverage/docstring/lint/package and PostgreSQL/container lanes completed successfully;
• formal reviews: none;
• inline review threads: none.

These are branch-candidate results only. They are not protected-main or immutable-release evidence, and predecessor results do not transfer to a future head.

Integration boundary

#233 must integrate first through live governance. Keep this PR Draft until the dependency root reaches protected main and this two-file slice is reconciled onto the resulting protected tip with every then-required exact-final-head quality, security, package/SBOM/provenance/release, review, and thread-resolution gate reacquired. Queued, pending, cancelled, skipped-required, absent, predecessor, status-only, synthetic, author-only, or infrastructure-failed evidence is non-passing.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}