feat: recover Irish influence guidance and evidence pipeline

.env.example

@@ -21,6 +21,14 @@ RELEASE_CANARY_HMAC_SECRET=replace-with-32-random-bytes
 # Missing/invalid values fail closed to no contract-3/query-plan-5 emission.
 RELEASE_DEPLOYMENT_PHASE=bridge
 RELEASE_EXPECTED_DATABASE_SCHEMA_VERSION=18
+# v2.5.4 direct editorial exposure uses this separate, mutually exclusive
+# authority namespace. All four values are set on API and both worker lanes
+# only after the signed 0->100 authority and durable rollback warrant verify.
+# They must remain empty whenever RELEASE_PUBLIC_ROLLOUT_* authority is active.
+RELEASE_V254_DIRECT_EXPOSURE_PRECONDITIONS_HASH=
+RELEASE_V254_DIRECT_EXPOSURE_ROLLBACK_PLAN_HASH=
+RELEASE_V254_DIRECT_EXPOSURE_STAGE=
+RELEASE_V254_DIRECT_EXPOSURE_TARGET_CONFIGURATION_HASH=
 
 # Anonymous capability sessions
 CAPABILITY_PEPPER=replace-with-32-random-bytes
@@ -129,11 +137,15 @@ GUIDANCE_CONTRACT_V2_OWNER_CANARY=true
 GUIDANCE_CONTRACT_V3_ENABLED=false
 GUIDANCE_CONTRACT_V3_OWNER_CANARY=false
 GUIDANCE_CONTRACT_V3_REGGAETON_ENABLED=false
-# Dormant until the schema-21/protocol-13 v2.6 activation gates pass.
+# Guidance V5.1 is schema-20/protocol-12 compatible for the v2.5.4
+# editorial-influence recovery. Keep it false in an unassigned local
+# environment; the immutable production release pins it true on every lane.
+# Schema-21/protocol-13 remains a separate v2.6 migration.
 GUIDANCE_V5_ENABLED=false
 PIPELINE_V3_OWNER_CANARY=false
 PIPELINE_V3_OWNER_CANARY_GROUPS=genre_scene
 PIPELINE_V3_OWNER_CANARY_MAX_TRACKS=50
+PIPELINE_V3_EDITORIAL_INFLUENCE_PERCENT=0
 PIPELINE_V3_GENRE_SCENE_PERCENT=0
 PIPELINE_V3_MOOD_ACTIVITY_PERCENT=0
 PIPELINE_V3_SIMILARITY_PERCENT=0

.github/workflows/ci.yml

@@ -182,6 +182,64 @@ jobs:
             test-results/
           if-no-files-found: ignore
 
+  stitched-system:
+    needs: [static]
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    services:
+      postgres:
+        image: postgres:17-alpine@sha256:742f40ea20b9ff2ff31db5458d127452988a2164df9e17441e191f3b72252193
+        env:
+          POSTGRES_DB: needle
+          POSTGRES_USER: needle
+          POSTGRES_PASSWORD: needle
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U needle -d needle"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      DATABASE_URL: postgresql://needle:needle@127.0.0.1:5432/needle
+      APP_ORIGIN: http://localhost:3000
+      RAILWAY_API_BASE: http://127.0.0.1:8788
+      GATEWAY_KEY_ID: ci-system-v1
+      GATEWAY_HMAC_SECRET: 0123456789abcdef0123456789abcdef
+      IP_HASH_SECRET: abcdef0123456789abcdef0123456789
+      CAPABILITY_PEPPER: fedcba9876543210fedcba9876543210
+      CAPABILITY_PEPPER_VERSION: ci-system-capability-v1
+      SESSION_SECRET: 00112233445566778899aabbccddeeff
+      OWNER_EMAIL: owner@example.com
+      OWNER_ALLOWLIST_VERSION: ci-system-owner-allowlist-v1
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          fetch-depth: 0
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        with:
+          version: 11.7.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22.19.0
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm test:database:preflight
+      - run: pnpm db:migrate
+      - name: Install headless Chromium
+        run: pnpm exec playwright install --with-deps chromium-headless-shell
+      - name: Run mandatory stitched API-worker-database-browser suite
+        run: pnpm test:e2e:system
+      - name: Upload stitched-system failure artifacts
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: stitched-system
+          path: |
+            playwright-report/
+            test-results/
+          if-no-files-found: ignore
+
   aggregate-exact-sha:
     name: aggregate exact-SHA gate
     if: always()
@@ -191,6 +249,7 @@ jobs:
       - unit-and-database
       - production-database-compatibility
       - browser
+      - stitched-system
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:

.github/workflows/exact-sha-image.yml

@@ -11,6 +11,10 @@ on:
         description: Stable semantic version embedded in the image
         required: true
         type: string
+      candidate_tag:
+        description: Annotated RC tag bound to the exact merged SHA
+        required: true
+        type: string
 
 concurrency:
   group: exact-sha-image-${{ inputs.source_revision }}
@@ -37,13 +41,16 @@ jobs:
         env:
           SOURCE_REVISION: ${{ inputs.source_revision }}
           RELEASE_VERSION: ${{ inputs.release_version }}
+          CANDIDATE_TAG: ${{ inputs.candidate_tag }}
           RELEASE_VERIFICATION_KEY_SHA256: ${{ vars.RELEASE_VERIFICATION_KEY_SHA256 }}
           RELEASE_PUBLIC_ROLLOUT_INTENT_CANARY_AUTHORITY_POLICY_SHA256: ${{ vars.RELEASE_PUBLIC_ROLLOUT_INTENT_CANARY_AUTHORITY_POLICY_SHA256 }}
         run: |
           [[ "$SOURCE_REVISION" =~ ^[0-9a-f]{40}$ ]] \
             || { echo "source_revision must be a lowercase full SHA-1" >&2; exit 1; }
           [[ "$RELEASE_VERSION" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]] \
             || { echo "release_version must be a stable semantic version" >&2; exit 1; }
+          [[ "$CANDIDATE_TAG" =~ ^v"$RELEASE_VERSION"-rc\.[1-9][0-9]*$ ]] \
+            || { echo "candidate_tag must match the stable release version" >&2; exit 1; }
           [[ "$RELEASE_VERIFICATION_KEY_SHA256" =~ ^[0-9a-f]{64}$ ]] \
             || { echo "RELEASE_VERIFICATION_KEY_SHA256 must pin the rollout verification key" >&2; exit 1; }
           [[ "$RELEASE_PUBLIC_ROLLOUT_INTENT_CANARY_AUTHORITY_POLICY_SHA256" =~ ^[0-9a-f]{64}$ ]] \
@@ -126,13 +133,18 @@ jobs:
         env:
           SOURCE_REVISION: ${{ inputs.source_revision }}
           RELEASE_VERSION: ${{ inputs.release_version }}
+          CANDIDATE_TAG: ${{ inputs.candidate_tag }}
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
           test "$(git rev-parse HEAD)" = "$SOURCE_REVISION"
           git fetch --no-tags origin "$DEFAULT_BRANCH"
           git merge-base --is-ancestor "$SOURCE_REVISION" "origin/$DEFAULT_BRANCH"
           test "$(node -p 'require("./package.json").version')" = "$RELEASE_VERSION"
           test -f Dockerfile.ghcr-recovery
+          git fetch --force origin "+refs/tags/$CANDIDATE_TAG:refs/tags/$CANDIDATE_TAG"
+          TAG_OBJECT="$(git rev-parse "refs/tags/$CANDIDATE_TAG")"
+          test "$(git cat-file -t "$TAG_OBJECT")" = "tag"
+          test "$(git rev-parse "$TAG_OBJECT^{}")" = "$SOURCE_REVISION"
       - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
@@ -219,9 +231,20 @@ jobs:
             echo "- Version: \`$RELEASE_VERSION\`"
             echo "- Image: \`$IMAGE_REFERENCE\`"
           } >> "$GITHUB_STEP_SUMMARY"
+      - name: Produce native v2.5.4 candidate evidence from the exact-SHA receipt
+        env:
+          CANDIDATE_TAG: ${{ inputs.candidate_tag }}
+        run: |
+          node --experimental-transform-types \
+            scripts/native-v254-candidate-evidence.ts \
+            --exact-sha-image-receipt exact-sha-image-receipt.json \
+            --candidate-tag "$CANDIDATE_TAG" \
+            --output native-v254-candidate-evidence.json
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: exact-sha-image-${{ inputs.source_revision }}
-          path: exact-sha-image-receipt.json
+          path: |
+            exact-sha-image-receipt.json
+            native-v254-candidate-evidence.json
           if-no-files-found: error
           retention-days: 30