Verify published Registry compatibility and emit rollback receipts

[StatPan]

Goal

After Registry publication, install the exact published Hugging Face Registry revision, run CLI doctor compatibility checks, and emit a consumer-owned receipt that identifies rollback action on failure.

Why now

Registry goal StatPan/datapan-registry#589 removes CLI checkout and execution from Registry workflows. CLI remains the downstream consumer that can prove real install and doctor compatibility, but that proof must not make Registry build-time behavior depend on CLI source.

Existing evidence

• Registry currently checks out and executes an immutable CLI SHA in release workflows.
• CLI owns local Registry installation, exploration, execution, export, and user credential behavior.
• Published-artifact compatibility is distinct from Registry-native pre-publication integrity and readiness.

Scope

CLI consumes a published Hugging Face payload revision, installs it through the supported client path, runs bounded doctor checks, and emits an immutable compatibility or failure receipt. It does not publish Registry, mutate Registry branches or manifests, or validate unpublished candidate internals.

Acceptance Criteria

• Receipts bind immutable CLI revision, Hugging Face payload revision, Registry source or manifest digest, install result, doctor result, and observation time.
• Success and failure fixtures prove deterministic receipt generation and redaction.
• Failure identifies the exact affected published revision and a resolvable rollback target or explicit no-safe-target state.
• Registry may read or display the receipt but never checks out, builds, or executes CLI.
• The smoke remains post-publication; changing it into a pre-publication hard gate requires a separate business decision.
• One published-revision smoke run and failure-path drill provide independently verifiable evidence.

Doctor Impact

CLI doctor becomes the consumer-side compatibility authority for the exact published Registry artifact. Registry-native pre-publication checks remain separate, and a failed post-publication smoke produces an explicit rollback signal.

Dependencies and non-goals

Contract alignment with StatPan/datapan-registry#589 is required. No Registry publication rights, cross-repository source dependency, user credential migration, or pre-publication hard gate is authorized.

Completion evidence

Merged child PRs, deterministic success and failure receipts, exact revision bindings, one published-artifact smoke receipt, and a verified rollback-path drill. Unit tests alone are not completion evidence.

Planning Notes

1. First safe child: define the CLI-owned, schema-validated post-publication consumer-smoke and rollback-receipt contract, deterministic success/failure fixtures, and offline validators. It must not download an artifact, run datapan init, execute a public smoke, or claim rollback proof.
2. Later child: execute the contract only after an exact published Hugging Face Registry revision and release assets are identified; bind the resulting smoke to that revision and retain a real rollback receipt.
3. Do not turn the smoke into a Registry pre-publication gate or delete Registry checkouts/guards in this goal.

Decomposition

• First safe child: define the CLI-owned, schema-validated post-publication consumer-smoke and rollback-receipt contract, deterministic success/failure fixtures, and offline validators. It must not download an artifact, run datapan init, execute a public smoke, or claim rollback proof.
• Later child: execute the contract only after an exact published Hugging Face Registry revision and release assets are identified; bind the resulting smoke to that revision and retain a real rollback receipt.
• Do not turn the smoke into a Registry pre-publication gate or delete Registry checkouts/guards in this goal.

Stop Conditions

• Stop any real smoke or rollback execution when no exact published Registry revision and release assets are available.
• Stop before any change that makes Registry pre-publication release control depend on CLI execution.

[StatPan]

Handoff

Replanned consumer ownership: #165 remains the post-publication consumer-proof epic. Offline receipt-contract child #166 is Done; historical #168 is rehearsal-only and cannot enter a later release gate. The remaining execution child #173 is correctly Blocked.

CLI must receive from Registry #592 only after explicit publication plus anonymous pointer/payload verification: immutable Dataset revision; Registry and manifest digests; verification timestamp; public CLI release tag/revision; one public installer artifact and SHA-256 per Linux/macOS/Windows; and either an approved incompatible subject with safe prior pointer or authority to record manual_hold when no safe target exists.

CLI #165 never becomes a Registry pre-publication hard gate and Registry never checks out/builds/executes CLI. A compatible observed matrix is consumer evidence; an incompatible path must produce observed rollback-plus-reinstall/doctor evidence or explicit manual_hold. The latter does not unblock Registry #593.

Exact next Gira action now: gira goal status 165 --repo StatPan/datapan-cli --json. Do not start #173 until the #592 handoff and failure-path authority are present; then use gira ticket start 173 --repo StatPan/datapan-cli --dry-run, followed by gira ticket start 173 --repo StatPan/datapan-cli --apply only after Ready status is explicitly restored.

Context:

• Ticket: Verify published Registry compatibility and emit rollback receipts #165
• Status: Ready
• Linked PR: none
• Blockers: missing_linked_pr
• Next: gira ticket start --repo StatPan/datapan-cli --ticket 165 --apply