Execute an admitted post-publication Registry consumer smoke

[StatPan]

Goal

After an exact published Registry artifact is identified, execute the CLI-owned post-publication consumer smoke and produce one schema-valid observed receipt.

Parent: #165

Scope

• Bind an immutable CLI main revision to one exact published StatPan/datapan-registry Hugging Face Dataset revision and its release assets/digests.
• Use the supported CLI install path and datapan doctor to create an evidence_class:"observed" consumer receipt under the merged contract.
• On failure, record either an exact immutable rollback target or manual_hold with no_safe_target; do not claim rollback completion without the corresponding observed result.

Acceptance Criteria

• Execution begins only after the exact published Hugging Face Dataset revision, release assets, Registry/manifest digests, and immutable CLI main revision are recorded.
• The observed receipt passes the merged schema/admission rules, is redacted, and binds CLI revision, Dataset revision, digests, install result, doctor result, and observation time.
• A compatible result records rollback.state:"not_required"; a failed result records an exact immutable target; a no-safe-target result remains manual_hold.
• The execution receipt and any rollback outcome are independently retained and reviewed.
• Registry never checks out, builds, or executes CLI; fixture data and Registry Journey regression CI are not accepted as completion evidence.

Doctor Impact

This child executes the existing CLI doctor boundary against a named published artifact. Any doctor behavior change requires its own reviewed PR.

Blockers and non-goals

Blocked until exact published Hugging Face revision and release assets are identified and a safe rollback policy can be evaluated. Do not execute external smoke, download/install a Registry artifact, run datapan init, or perform rollback before that condition is met. No Registry workflow/control-plane change is authorized.

Expected Evidence

• Exact CLI and Dataset revision identifiers plus artifact digests.
• Redacted observed receipt validated by schema and caller-owned freshness admission.
• Retained install/doctor result and rollback target or manual-hold outcome.

Expected Delivery

Start only after blocker clearance; record the real execution receipt, not a fixture or CI journey.

base_branch: main
base_source: explicit --base
target: override
work_branch: issue-168-execute-an-admitted-post-publication-registry-consumer-smoke

[StatPan]

Blocker

Blocker — exact published artifact not yet bound

Do not start or execute this ticket. There is no recorded exact published StatPan/datapan-registry Hugging Face Dataset revision, release asset set/digests, immutable CLI main revision, or evaluated rollback target for this run.

Until those inputs are recorded and reviewed, do not download/install a Registry artifact, run datapan init, run datapan doctor as a post-publication smoke, generate evidence_class:"observed", or perform any rollback. Registry checkout/build/CLI execution remains forbidden, and fixture data or Registry Journey CI cannot clear this blocker.

Context:

• Ticket: Execute an admitted post-publication Registry consumer smoke #168
• Status: Blocked
• Linked PR: none
• Blockers: missing_linked_pr
• Next: resolve blockers, then set status:ready before starting work

[StatPan]

Blocker

Blocker cleared — immutable execution inputs bound

This clears only the input/rollback-planning blocker. It does not execute install, datapan init, datapan doctor, download, or rollback.

Bound execution inputs

• CLI main: 72ddfa431cbb866a5ec0139383aab5b5ddeaabe9 (main CI 29926758287: success). Its only delta from the Registry workflow validation consumer e3b2fa44cb0f68d7e58e003fbd71ecde505878de is receipt-contract/docs/schema/test files; it does not change install or doctor behavior.
• Public HF distribution pointer: bb84197fc8b0361355b1362085b1b0d468605f3d.
• Installed payload revision: b81d518b7c2b2b820d38cdf706ec5bd878ef3082.
• Payload manifest.json: SHA-256 98b4a10cce43952d10d07fca5b232a77f1a05f0a305dcfda2dd90519dcf9ddd1 (anonymously re-hashed and matches the pointer).
• Registry asset data/data-go-kr.registry.json: SHA-256 eeda72ee8590f458de8d75703662578e80edf3e61282f0e5e67547c4f6e5f644.

Safe immutable rollback candidate

• Prior public pointer 775043bdb886e5a9389a04c890bb93eea49a0dab binds payload 5a5a55fb10318f9951b6dee4b4a798aea2c6fd4a; its manifest SHA-256 b1b1d18c958fc2fffb5396ade2d1ef13e67c77e5645a289ccdbb11e73e552999 was anonymously re-hashed and matches.
• That payload carries the same Registry SHA-256 and its published consumer-compatibility report marks datapan-cli install/doctor as proven. Because current CLI only adds receipt validation/fixtures, the rollback candidate remains behavior-compatible for this smoke.

Important publication boundary

Registry main is 4458003e1490e70d2efc538df93aeaa3addc90ef; workflow 29924033653 and verification 29924033765 succeeded, but 29924033653 was a push event and its two-phase HF publish/anonymous-verify steps are workflow_dispatch && publish only. It staged a candidate (manifest SHA c42f9f8fa56e31459524ac5684e8b0de05c59102822d0f1289ffe7235eca2217) and did not publish a new HF payload. This task therefore targets the last actually public, immutable payload above; it does not claim that 4458003e is on HF.

Execution and dry-run boundary

1. In an isolated directory, bind the CLI binary/source to 72ddfa... and download only payload b81d...; verify the two recorded SHA-256 values before install.
2. Run the supported install path, then datapan doctor; capture redacted command/result metadata and observation time.
3. Generate and schema/admission-validate the evidence_class:"observed" receipt.
4. If incompatible, attempt only the named 5a5a... rollback candidate, record its observed outcome, and otherwise emit manual_hold/no_safe_target.

No external command has been run under this ticket.

Context:

• Ticket: Execute an admitted post-publication Registry consumer smoke #168
• Status: Blocked
• Linked PR: none
• Blockers: missing_linked_pr
• Next: resolve blockers, then set status:ready before starting work

[StatPan]

Check

Observed post-publication consumer smoke — compatible

Executed only in a disposable isolated directory. No local checkout, Registry workflow, pin, credential, URL, stdout/stderr, or raw Registry rows were retained.

• CLI source/build: 72ddfa431cbb866a5ec0139383aab5b5ddeaabe9; main CI 29926758287 succeeded.
• HF immutable payload: b81d518b7c2b2b820d38cdf706ec5bd878ef3082.
• Independent preflight and CLI-installed provenance agree: manifest SHA-256 98b4a10cce43952d10d07fca5b232a77f1a05f0a305dcfda2dd90519dcf9ddd1 (40,016 bytes), Registry SHA-256 eeda72ee8590f458de8d75703662578e80edf3e61282f0e5e67547c4f6e5f644 (137,735,169 bytes).
• init: completed/succeeded using published Registry only.
• doctor: completed; Registry digest matched, execution allowed, CLI consumer status proven, release readiness true. No credential was supplied; only call readiness is false, which is expected and outside this Registry-only smoke.
• Receipt schema and caller-owned 10-minute admission passed at 90 seconds age.

{
  "schema_version": "datapan.registry-consumer-smoke-receipt.v1",
  "receipt_id": "registry-consumer-smoke-b81d518-20260722",
  "observed_at": "2026-07-22T14:16:16Z",
  "evidence_class": "observed",
  "completion_evidence": true,
  "cli": {"revision": "72ddfa431cbb866a5ec0139383aab5b5ddeaabe9", "version": "0.1.0-dev"},
  "registry": {
    "distribution": "huggingface_dataset",
    "dataset_id": "StatPan/datapan-registry",
    "revision": "b81d518b7c2b2b820d38cdf706ec5bd878ef3082",
    "registry_sha256": "eeda72ee8590f458de8d75703662578e80edf3e61282f0e5e67547c4f6e5f644",
    "manifest_sha256": "98b4a10cce43952d10d07fca5b232a77f1a05f0a305dcfda2dd90519dcf9ddd1"
  },
  "install": {"execution": "completed", "result": "succeeded", "network_access": "published_registry_only", "reason_code": "immutable_digest_verified"},
  "doctor": {"execution": "completed", "result": "compatible", "reason_code": "published_registry_only"},
  "outcome": {"status": "compatible", "reason_code": "immutable_registry_compatible"},
  "rollback": {"state": "not_required"},
  "redaction": {"credentials_removed": true, "query_values_removed": true, "response_rows_removed": true}
}

Result: compatible; rollback state is not_required. This is an observed receipt, not a claim that Registry main 4458003e1490e70d2efc538df93aeaa3addc90ef was newly published to Hugging Face.

Context:

• Ticket: Execute an admitted post-publication Registry consumer smoke #168
• Status: In progress
• Linked PR: none
• Blockers: missing_linked_pr
• Next: gira ticket pr --repo StatPan/datapan-cli --ticket 168 --apply

[StatPan]

Check

Independent review passed: public immutable manifest b81d518b7c2b2b820d38cdf706ec5bd878ef3082 re-fetched at review time, SHA-256 98b4a10cce43952d10d07fca5b232a77f1a05f0a305dcfda2dd90519dcf9ddd1 and 40,016 bytes; its artifact record binds data/data-go-kr.registry.json at 137,735,169 bytes and SHA-256 eeda72ee8590f458de8d75703662578e80edf3e61282f0e5e67547c4f6e5f644. CLI origin/main and main CI 29926758287 both bind 72ddfa4. Reviewed observed receipt has install=succeeded, doctor=compatible, outcome=compatible, rollback=not_required and satisfies the merged state machine. This closes only the currently public payload smoke; it is not publication evidence for Registry main 4458003e1490e70d2efc538df93aeaa3addc90ef. No PR is appropriate because this was an external evidence execution with no source change; retained issue receipt is the completion ledger.

Context:

• Ticket: Execute an admitted post-publication Registry consumer smoke #168
• Status: In progress
• Linked PR: none
• Blockers: missing_linked_pr
• Next: gira ticket pr --repo StatPan/datapan-cli --ticket 168 --apply