feat(reporting): persist authorized frozen reporting feeds

.github/workflows/ci.yml

@@ -10,6 +10,7 @@ on:
       - conductor/reporting-status-notifications-1168c
       - conductor/1167b1-materializer-contracts
       - conductor/1167b2-durable-managed-reporting
+      - conductor/reporting-receipt-ingress-b22
 
 # Default @adcp/sdk runner alias for storyboard jobs. Tracks the current
 # stable @adcp/sdk release via the ``latest`` npm dist-tag.
@@ -197,6 +198,7 @@ jobs:
                      --ignore=tests/conformance/reporting/test_reporting_materializer_migration.py \
                      --ignore=tests/conformance/reporting/test_reporting_materializer_installed_pg.py \
                      --ignore-glob='tests/conformance/reporting/test_reporting_receipt_*.py' \
+                     --ignore-glob='tests/conformance/reporting/test_reporting_feed_*.py' \
                      -v -ra
               ;;
             process)
@@ -213,7 +215,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions: {}
-    needs: [pg-conformance, pg-reporting-status, pg-reporting-materializer, pg-reporting-receipts, pg-reporting-receipt-compatibility]
+    needs: [pg-conformance, pg-reporting-status, pg-reporting-materializer, pg-reporting-receipts, pg-reporting-receipt-compatibility, pg-reporting-feed, pg-reporting-feed-compatibility, pg-reporting-feed-installed]
     if: ${{ always() }}
     steps:
       - name: Require every Postgres conformance lane
@@ -223,13 +225,19 @@ jobs:
           MATERIALIZER_RESULT: ${{ needs.pg-reporting-materializer.result }}
           RECEIPTS_RESULT: ${{ needs.pg-reporting-receipts.result }}
           RECEIPT_COMPATIBILITY_RESULT: ${{ needs.pg-reporting-receipt-compatibility.result }}
+          FEED_RESULT: ${{ needs.pg-reporting-feed.result }}
+          FEED_COMPATIBILITY_RESULT: ${{ needs.pg-reporting-feed-compatibility.result }}
+          FEED_INSTALLED_RESULT: ${{ needs.pg-reporting-feed-installed.result }}
         run: |
-          if [ "$PG_RESULT" != "success" ] || [ "$STATUS_RESULT" != "success" ] || [ "$MATERIALIZER_RESULT" != "success" ] || [ "$RECEIPTS_RESULT" != "success" ] || [ "$RECEIPT_COMPATIBILITY_RESULT" != "success" ]; then
+          if [ "$PG_RESULT" != "success" ] || [ "$STATUS_RESULT" != "success" ] || [ "$MATERIALIZER_RESULT" != "success" ] || [ "$RECEIPTS_RESULT" != "success" ] || [ "$RECEIPT_COMPATIBILITY_RESULT" != "success" ] || [ "$FEED_RESULT" != "success" ] || [ "$FEED_COMPATIBILITY_RESULT" != "success" ] || [ "$FEED_INSTALLED_RESULT" != "success" ]; then
             echo "Postgres conformance matrix result: $PG_RESULT"
             echo "Reporting status conformance result: $STATUS_RESULT"
             echo "Durable materializer conformance result: $MATERIALIZER_RESULT"
             echo "Authenticated receipt conformance result: $RECEIPTS_RESULT"
             echo "Receipt rolling compatibility result: $RECEIPT_COMPATIBILITY_RESULT"
+            echo "Frozen feed conformance result: $FEED_RESULT"
+            echo "Feed rolling compatibility result: $FEED_COMPATIBILITY_RESULT"
+            echo "Installed frozen feed result: $FEED_INSTALLED_RESULT"
             exit 1
           fi
           echo "All Postgres conformance lanes passed"
@@ -474,6 +482,177 @@ jobs:
           path: pg-reporting-receipt-compatibility-evidence.log
           if-no-files-found: error
 
+  pg-reporting-feed:
+    name: Frozen authorized feed and mounted isolation (Postgres 16)
+    runs-on: ubuntu-latest
+    # Crash processes and shared memory/SQL vectors have their own database
+    # and bounded suite; setup and cleanup have five minutes of headroom.
+    timeout-minutes: 25
+    permissions:
+      contents: read
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_HOST_AUTH_METHOD: trust
+          POSTGRES_DB: adcp_feed_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - name: Install test dependencies
+        run: pip install -e ".[dev,pg]"
+      - name: Run frozen feeds, checkpoints, mounts, transaction faults and migrations
+        shell: bash
+        timeout-minutes: 20
+        env:
+          ADCP_PG_TEST_URL: postgresql://postgres@localhost:5432/adcp_feed_test
+        run: |
+          # Filter before pytest receives explicit paths; --ignore cannot do this.
+          shopt -s nullglob
+          feed_tests=()
+          for test_file in tests/conformance/reporting/test_reporting_feed_*.py; do
+            case "$test_file" in
+              tests/conformance/reporting/test_reporting_feed_rolling.py|tests/conformance/reporting/test_reporting_feed_packaging.py|tests/conformance/reporting/test_reporting_feed_installed_pg.py) ;;
+              *) feed_tests+=("$test_file") ;;
+            esac
+          done
+          if (( ${#feed_tests[@]} == 0 )); then
+            echo "No native feed test files selected" >&2
+            exit 1
+          fi
+          python scripts/reporting_test_harness.py pytest \
+            "${feed_tests[@]}" \
+            -v -s -ra | tee pg-reporting-feed-evidence.log
+      - name: Preserve exact public, private, restart and fault evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: pg-reporting-feed-evidence-${{ github.run_attempt }}
+          path: pg-reporting-feed-evidence.log
+          if-no-files-found: error
+
+  pg-reporting-feed-compatibility:
+    name: Feed rolling compatibility (nine actual artifacts)
+    runs-on: ubuntu-latest
+    # Actual B2.1 produces the artifact and actual B2.2 mounts receipts on
+    # both sides of migration for every historical reader/writer cell.
+    timeout-minutes: 50
+    permissions:
+      contents: read
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_HOST_AUTH_METHOD: trust
+          POSTGRES_DB: adcp_feed_rolling_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    steps:
+      - uses: actions/checkout@v6
+      - name: Fetch all nine exact approved historical artifacts
+        timeout-minutes: 2
+        run: |
+          git fetch --no-tags --depth=1 origin \
+            3e76aa54623529a3dda01cd690b8a5c287c75641 \
+            3c405a21f978ed9d3208611bb4a7a8434a056933 \
+            037de4ac822ecefb2f95d32c15c297fb4c45d683 \
+            17ee407ae3978c8a2bb54437287afbf9dafb8130 \
+            0f34c666ac1961e9832fce43ef0ef6937b3c1dde \
+            967b6e286301d7e5d089aea6fdbb90bea8ee5a16 \
+            5487f2bdef23c5102118b305be9e868228f6ce61 \
+            3fd62121c96a074e3ea458c30c5224d6a586f169 \
+            09fd87f79a746665d828dea66b3a1dd9d1fc189e
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - name: Install test dependencies
+        run: pip install -e ".[dev,pg]"
+      - name: Run historical binaries before and after the isolated feed migration
+        shell: bash
+        timeout-minutes: 45
+        env:
+          ADCP_PG_TEST_URL: postgresql://postgres@localhost:5432/adcp_feed_rolling_test
+        run: |
+          python scripts/reporting_test_harness.py pytest \
+            tests/conformance/reporting/test_reporting_feed_rolling.py \
+            -v -s -ra | tee pg-reporting-feed-compatibility-evidence.log
+      - name: Preserve exact artifact origins, catalogs and original replay responses
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: pg-reporting-feed-compatibility-evidence-${{ github.run_attempt }}
+          path: pg-reporting-feed-compatibility-evidence.log
+          if-no-files-found: error
+
+  pg-reporting-feed-installed:
+    name: Installed frozen feed (Python 3.10 VCS and sdist)
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    permissions:
+      contents: read
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_HOST_AUTH_METHOD: trust
+          POSTGRES_DB: adcp_feed_installed_test
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-python@v6
+        id: feed-python310
+        with:
+          python-version: "3.10"
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: pyproject.toml
+      - name: Install test dependencies
+        run: pip install -e ".[dev,pg]"
+      - name: Run installed base and PostgreSQL restart cells
+        shell: bash
+        timeout-minutes: 20
+        env:
+          ADCP_PG_TEST_URL: postgresql://postgres@localhost:5432/adcp_feed_installed_test
+          ADCP_PYTHON310: ${{ steps.feed-python310.outputs.python-path }}
+        run: |
+          python scripts/reporting_test_harness.py pytest \
+            tests/conformance/reporting/test_reporting_feed_packaging.py \
+            tests/conformance/reporting/test_reporting_feed_installed_pg.py \
+            -v -s -ra | tee pg-reporting-feed-installed-evidence.log
+      - name: Preserve installed origins, SQL, strict adopter and cold page evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: pg-reporting-feed-installed-evidence-${{ github.run_attempt }}
+          path: pg-reporting-feed-installed-evidence.log
+          if-no-files-found: error
+
   conventional-commits:
     name: Validate conventional commit format
     runs-on: ubuntu-latest

.github/workflows/pr-title-check.yml

@@ -3,7 +3,7 @@ name: PR Title Check
 on:
   pull_request:
     types: [opened, edited, synchronize, reopened]
-    branches: [main, conductor/1167b2-durable-managed-reporting]
+    branches: [main, conductor/1167b2-durable-managed-reporting, conductor/reporting-receipt-ingress-b22]
 
 permissions:
   contents: read