fix(deploy): admit isolated INDEX-52 runtime candidate

[fermatmind]

What changed

• pins an isolated INDEX-52 production candidate whose parent is the exact active production revision
• limits the candidate to the public comparison controller and DB-authoritative cross-comparison read model
• binds the candidate SHA, active SHA, successful staged-main SHA/run, patch SHA256, exact path set, and staged/main blob identities
• preserves the generic cumulative code_only deny rules and the existing Runtime-46 isolated lane
• adds deployment SRE contracts for the new fail-closed composite evidence path

Why

The exact staged main SHA contains content repair assets and unrelated runtime commits, so the generic code_only classifier correctly refuses its cumulative production delta. A standard deployment is not acceptable because it invokes migration, seed, and CMS baseline-import tasks. The isolated candidate composes only the already-staged read-model blobs onto the exact active production parent and continues to use deploy:code-only, which omits application-data and authority mutations.

Validation

• php backend/vendor/bin/phpunit --configuration backend/phpunit.xml backend/tests/Sre/DeployStorageAndDatabaseConfigTest.php backend/tests/Sre/ProductionDeploymentStatusTruthTest.php — 42 tests, 886 assertions passed
• php backend/vendor/bin/phpunit --configuration backend/phpunit.xml backend/tests/Feature/V0_5/MbtiCrossTypeComparisonAuthorityReadModelTest.php backend/tests/Feature/V0_5/PersonalityPublicApiTest.php — 59 tests, 4089 assertions passed on the staged-main source blobs
• php -l on both isolated candidate runtime files — passed
• exact parent/path/blob/patch hash candidate verifier — passed
• git diff --check — passed
• actionlint .github/workflows/deploy-production.yml — no new diagnostics; the same pre-existing ShellCheck diagnostics remain with line offsets only

Intentionally deferred

• production activation remains gated by a new exact candidate SHA/release operator authorization
• production revision/API readback remains deferred until that activation
• INDEX-52 two-run 55-URL acceptance remains in PR style(iq): format report contract test #1816

Repository rule impact

This is a one-candidate deployment-control exception, not a general policy relaxation. It does not change CMS/runtime authority ownership, publication/indexability, sitemap/llms, or search submission behavior.

Production/CMS/SEO runtime impact

No production action is performed by this PR. The eventual candidate uses only deploy:code-only; it cannot invoke migration, seed, CMS baseline import, or the INDEX-52 repair command.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b14dc888d5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject the unapproved INDEX-52 divergence

When this candidate is not an ancestor of current main, this branch deliberately admits it as a second divergence exception using a staging run for a different SHA. The repository contract requires candidate reachability and exact-SHA staging, and identifies Runtime 46 as the sole audited divergence exception, so an INDEX-52 code-only deployment through this path bypasses the production release boundary; integrate and stage the candidate on main instead.

AGENTS.md reference: AGENTS.md:L114-L116

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Hash a canonical full-index patch

When the runner's Git abbreviation setting or fetched object population differs from the environment that produced this constant, git diff --binary can emit different abbreviated blob IDs in textual index lines and therefore a different SHA-256 for the same two file changes. git diff -h documents --full-index as “show full object name on index lines”; add that option, or hash a canonical name/status-plus-blob representation, so the pinned candidate is not spuriously rejected.

Useful? React with 👍 / 👎.