T903: require native readiness and pinned carrier CI

[lukisch]

Scope

Integrates the independently reviewed native readiness and first-copy changes, plus a separate required CI job. Native Carrier remains pinned to public commit d1509e5f25bbd35e6658d2889b9bfb9f1ff9b573; existing requirements and Shared pins stay unchanged.

The new Linux Python 3.12/3.13 job checks the carrier Git HEAD, three LF hashes, actual import paths, SQLite version and real FTS5/table_list/table_xinfo capabilities. It runs all four suites with the normal project conftest and requires at least 71/50/26/3 cases with no skips, failures or errors. Existing jobs remain byte-identical.

Evidence

• Windows Python 3.12: 150 passed, no skips.
• Ubuntu Python 3.12.3: 150 passed, no skips, actual extracted Bash steps.
• Twenty source/capability/JUnit negative gates refused on each platform.
• Python 3.13 remains a required GitHub CI gate.
• Source head 583bf71b777a528aaaa2818480f165b7b8ec4745; final reviewed head 47c55b26bb486e15b50a76a5fcece102befa6cd6, tree 3877614a9deab5dd943ac31e5d134dacbcae7fdc.

No live database, service activation, full parity or host/runtime acceptance is claimed.

Author model: gpt-6.1-sol. Independent reviewer model: gpt-6-astra. Local independent source and workflow review approved; integration remains gated on the exact head and all required checks.

[lukisch]

Independent review: CHANGES_REQUIRED at the integration gate for commit 47c55b26bb486e15b50a76a5fcece102befa6cd6 (tree 3877614a9deab5dd943ac31e5d134dacbcae7fdc). Author: GPT-6.1-Sol; independent reviewer: GPT-6-Astra.

The native source and isolated CI delta were reviewed. The existing workflow prefix and approved source bytes are preserved. Both new native jobs now genuinely pass all 150 cases (71/50/26/3), with zero skips: Python 3.12 in 19.53 s and Python 3.13 in 18.18 s. Their logs confirm native carrier d1509e5f, its three source hashes, actual import origin and SQLite 3.45.1 capabilities.

However, the existing shared-dbsync job fails: 1 failed, 54 passed. test_native_selection_rollback_preserves_shared_artifacts calls DBSyncHandler.handle(None, ...) at system/tests/test_db_sync_shared_adapter.py:350; the new explicit native database binding reads self._canonical_db at system/hub/db_sync.py:904. Its NativeProbe constructor also has the previous no-argument contract. Reconcile this test/caller boundary while retaining the explicit database binding and the unchanged shared-artifact assertions.

Evidence: shared failure, native 3.12, native 3.13.

No merge or rerun is approved by this result. Remaining running checks must complete normally. This review makes no live rollout, credential/host epoch, full wiring or overall parity claim; the register remains 3/9.

[lukisch]

Independent follow-up review: APPROVE for the source and fixture delta at 2ebc4b8eb5787bfaa73dccd88f10bb16800f533c, tree b996991bf16c52682c94ede5dd7ae9e9174ddc79, base 031660bf797abc44dd7bd12af544ef01a7219e2d. Author: GPT-6.1-Sol; independent reviewer: GPT-6-Astra.

The previously reported native-selector fixture mismatch is corrected. The test now constructs a real bound handler with an existing private temporary database and verifies exact db_path propagation into its local probe. All four original assertions and the other 32 functions are AST-identical. Only this test and its local probe change; product code, workflow, guards and public source pins are unchanged.

Independent execution of the changed test with normal project conftest and required pinned sources: 1 passed, zero skips. The unchanged source-verification step passes for Ocean7127/Carrier7648 and their LF hashes; the author's complete 55-case JUnit and prior red result were independently checked. The earlier native source/CI review remains applicable.

This resolves the content finding in the prior review but does not reuse its old CI results. The new tests run is 36763928984, with new CodeQL run 36763935182. Merge remains conditional on every new required check reaching SUCCESS, including shared55, both native150, both safety175, both seal45, the existing pytest job and all CodeQL results, plus unchanged head/base and fresh locks.

No live migration, rollout, host/credential epoch, complete wiring or overall parity acceptance is implied; the register remains 3/9.