fix(portfolio): preserve prior security authorization across metadata upgrade

[saagpatel]

What

Adds a bounded compatibility validator for the immediately preceding PortfolioTruth metadata envelope and routes prior security cohort loading through it.

Why

The current publisher correctly requires prior security evidence to authorize cohort transitions, but the checkout-collision and workspace-discovery metadata upgrade made a valid prior snapshot unreadable. That blocked publication before DecisionQueueV2 could be generated.

Review Of What Was Built

• Current-format truth still uses the ordinary strict validator.
• Only snapshots missing checkout-collision summary and carrying workspace_discovery.v2 may enter the compatibility path.
• Legacy summary facts and warnings are reconstructed and compared exactly.
• Checkout authority without its summary is rejected.
• The migrated in-memory envelope runs the complete current validator, retaining repository identity, provider, receipt binding, producer, and timestamp checks.

Cleanup Review

No live evidence was edited and no scheduler state was changed. The compatibility transform exists only in memory while reading prior security authorization.

Verification Summary

• 3462 tests passed, 2 skipped.
• Repository-wide Ruff passed.
• Scoped CI mypy passed for 15 source files.
• Six focused regressions passed, including duplicate repository, broken receipt binding, provider tampering, future receipt, and current-format failure cases.
• The live legacy snapshot authorized its exact 11-repository prior cohort through the new loader.

Shipped Summary

The publisher can safely cross this one metadata transition without weakening security cohort authorization.

Next Phase

Merge, repin the automation runtime, and rely on the untouched 01:30 and 02:00 calendar runs for authoritative security and DecisionQueueV2 publication proof.

Remaining Roadmap

Read back the natural digest through Personal Ops and Portfolio Command Center, then record only operator-supplied outcomes.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.