refactor(bundle): derive ledger plans from canonical selection

[lamemustafa]

Summary

Derive single-period bundle ledger plans from the existing canonical artifact-selection helper. Refs #115; this draft does not close the issue or claim authenticated runtime qualification.

Root Cause / Decision Record

• artifactPlanForScope restated the artifact expansion already owned by concreteFiledReturnsArtifactTypesForSelection.
• The issue correctly notes that the helpers differ for single-artifact inputs in isolation. At base 214aabdf77dd3884a44db62878bab4345a2da970, however, every live call is guarded: creation checks isSupportedBundleScope before both plan uses; parsedArtifactPlan is called only after the same parser guard; reservation also rejects unsupported scopes before reading storage. The guard admits only normalized PDF_AND_EXCEL, where the old and canonical rules produce identical ordered plans.
• The smallest change replaces those calls and deletes the private duplicate. It leaves the supported-scope guard and the legacy GSTR-2B PDF/EXCEL parsing exception unchanged. No single-artifact bundle behavior is introduced.
• Authenticated live validation is prohibited by this session's objective and was not attempted. Repository runtime-validation requirements therefore remain an explicit gap; local synthetic gates are not evidence of live qualification. fix(bundle): reconcile artifactPlanForScope with the canonical artifact selection #115 stays open.

Scope

• Runtime: derive creation and current-plan parsing from the existing canonical helper in src/background/filed-returns-single-period-bundle-ledger.ts; compute the creation plan once.
• Tests: five regressions in the matching test file cover creation rejection, reservation rejection before storage access, non-destructive malformed stored single-artifact plans, canonical composite persist/restore order, and preservation of the legacy GSTR-2B pair.
• Docs/governance: none.
• Explicitly out of scope: supported-scope expansion, storage shape or fields, target/identity guards, portal behavior, manifest/permissions/CSP, dependencies, public claims, live portal runs, release or Store actions.

Pack Workflow Preflight

• pnpm workflow:preflight was run before editing/push, or the skip reason is documented.
• This PR was opened from a Pack branch, not master.
• I checked latest master Pack AGENTS guidance or recorded the stale-guidance warning.
• PR body keeps the required Pack privacy/review/verification checklist visible.

Branch: tapish-codex/canonical-bundle-plan-20260826. Pre-edit preflight exited 0: Pack workflow preflight passed for tapish-codex/canonical-bundle-plan-20260826 against master.

Sanchika Adoption Gate

• If this PR consumes @sanchika/* packages or copied Sanchika guidance, I
  read sanchika/docs/adoption-pack.md in the coordinated parent worktree.
• If this PR consumes Sanchika, it links ComplyEaze and Axal completion evidence
  and records the Sanchika commit or copied guidance used.
• This PR does not import ../sanchika, sanchika/packages/*/src, or parent
  source paths.

The two conditional Sanchika-consumption items are not applicable: no package or copied guidance is consumed.

Privacy And Data-Flow Impact

• No new browser permissions.
• No new host permissions.
• No new network calls.
• No analytics, telemetry, ads, or session replay.
• No credential, OTP, CAPTCHA, cookie, token, GST file, or taxpayer-data capture.
• Public copy and privacy declarations are updated if behaviour changed.

No public behavior claim is changed. Storage keys, schema, scopes, and writes remain unchanged; fixtures are synthetic.

Sensitive Surface Review

• Current tab / portal target binding is preserved or intentionally changed.
• Download completion remains evidence-backed and fail-closed.
• Ambiguous side-effect delivery cannot be reported as confirmed success.
• Service-worker durability impact is understood and documented.
• Real taxpayer data, local paths, raw URLs/referrers, and portal HTML are absent from the diff.

No download correlation, acquisition, completion, or persistence boundary is altered. Independent security and privacy reviewers inspected the diff at b8f402a7066150d01857f12d5ec9d57a097765a1 and reported no blocking findings; the parent reviewer also inspected the diff. These source reviews do not replace authenticated validation.

Chrome Web Store Impact

• This PR does not expand beyond the existing Chrome Web Store V0 listing unless every gate in docs/PUBLICATION_READINESS.md is checked.
• Full fiscal year ships in the one binary but stays out of Store-advertised scope until its evidence gates are recorded.
• Store copy, README status, Privacy QA, and reviewer instructions were reviewed if user-facing behavior changed.
• CI ZIP creation, provenance, and protected publishing are treated as release evidence, not manual store-submission sign-off.
• PR title uses Conventional Commits so Release Please can bump Pack after merge.

Store-related conditional review is not applicable to this behavior-preserving refactor. No Store, release-readiness, or live-validation claim is made.

Verification

• pnpm install --frozen-lockfile
• pnpm audit --audit-level high
• pnpm exec wxt prepare
• pnpm exec prettier --check .
• pnpm exec eslint . --max-warnings 0
• pnpm exec tsc --noEmit
• pnpm exec vitest run
• pnpm exec wxt build
• node scripts/verify-extension-package.mjs .output/chrome-mv3
• pnpm exec wxt zip
• node scripts/verify-extension-zip.mjs
• node scripts/write-release-provenance.mjs
• node scripts/verify-github-release-assets.mjs --tag <tag> --zip <zip> --checksum <sha256> --provenance <json> when release assets exist
• node scripts/publish-chrome-web-store.mjs --zip .output/<zip> --provenance .output/pack-release-provenance.v1.json --publisher-id <id> --dry-run true
• git diff --check
• pnpm review:gate -- --strict-head-review --wait-head-review-ms 180000 before merge/readiness claim; a missing Codex review blocks readiness:

All checked commands exited 0 on the code/test snapshot at head b8f402a7066150d01857f12d5ec9d57a097765a1. Audit ran through node scripts/run-dependency-audit.mjs, which reported No known vulnerabilities found. Full suite was the first run, with JSON and default reporters enabled; no retry-until-green or timeout changes. The focused matching file passed 20 tests. The full suite included the source-graph unreferenced-module guard.

Full suite: 125 test files passed. Verbatim test-summary tail:

      Tests  2122 passed (2122)
   Start at  07:44:50
   Duration  166.68s (transform 1.94s, setup 0ms, import 13.68s, tests 136.85s, environment 8ms)

Each new test was mutation-proven: the exact source mutation was confirmed before running the whole matching file. Every mutation produced exit 1 with exactly its intended test failing and 19 neighbors passing; all mutations were restored before final validation.

Confirmed mutation	Intended failing regression	Result
Remove only the creation scope guard	rejects single-artifact scopes before creating a bundle plan	1 failed, 19 passed
Remove only the reservation scope guard	rejects single-artifact reservations before reading or replacing an existing bundle	1 failed, 19 passed
Remove only the parser scope guard	keeps stored single-artifact plans malformed without deleting or rewriting them	1 failed, 19 passed
Reject the canonical GSTR-2B triplet in the parser	persists and restores the canonical composite plans without changing their order	1 failed, 19 passed
Remove only the legacy pair fallback	restores a legacy GSTR-2B composite pair without adding a pending JSON artifact	1 failed, 19 passed

ZIP, provenance, release-asset, and Store commands were not run locally: this is not a release action. Hosted CI subsequently built and verified its ZIP. The strict designated-author gate exited 1 with No review was found for current head b8f402a7066150d01857f12d5ec9d57a097765a1. The connector posted a clean exact-head comment but no formal review object; no PR readiness claim is made. Graphify was unavailable because the fresh worktree had no graph, and the documented refresh script is absent on this base. Exact-symbol source tracing was used; the canonical helper comes from a module already imported by the ledger, so no new module edge was introduced.

Artifact Evidence

• CI run: Pack CI 32924337797, succeeded on b8f402a7066150d01857f12d5ec9d57a097765a1; all seven reported PR checks passed at this snapshot.
• ZIP artifact: CI verified complyeazepack-0.5.1-chrome.zip; none produced locally, no release or Store submission.
• ZIP SHA-256: aa2cbf0a92b6919595085515031822f548682c00205c4f6d4dca6b7a974e0709, emitted by CI exact-ZIP verification and checksum steps.
• Clean source/tag or head SHA: b8f402a7066150d01857f12d5ec9d57a097765a1, clean tracked tree after two logical commits. Runtime: 30240669fffc472fac06be41242fe0dccaeb2451; tests: b8f402a7066150d01857f12d5ec9d57a097765a1.

PR Review Follow-Up

• GitHub Actions completed.
• Autogenerated Codex/bot review comments inspected after checks completed for the latest head SHA.
• Inline review threads are resolved, outdated, or answered with evidence.
• No commits were pushed after the last required human/bot review without re-review.
• Any follow-up PRs or issues are listed here instead of being left implicit.

The exact-head Codex comment reported no major issues. A post-CI GraphQL check returned zero review threads with no additional page, and zero formal review objects. No commits followed the reviewed head. The missing formal review remains a strict-gate audit gap, separate from the clean comment and passing hosted findings gate. This draft remains unqualified for live runtime use; #115 records the outstanding authenticated-validation requirement.

Thread/comment	Disposition	Commit or evidence
#115 isolated single-artifact helper divergence	rejected-with-evidence as a reachable behavior difference on this base; underlying duplicate consolidated	Guard trace above; five mutation-proven regressions at b8f402a7066150d01857f12d5ec9d57a097765a1
Authenticated runtime validation	accepted-follow-up-with-named-blocker: prohibited in this session; #115 remains open	No live run attempted; synthetic proof only

Screenshots

Not applicable: no visual change. Test fixtures are synthetic.

[lamemustafa]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: b8f402a706

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cec7b59f8a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lamemustafa]

Merging with the same recorded audit gap as #234, stated rather than glossed.

Gap: no chatgpt-codex-connector review exists at the current head 8f21a6d; the last connector review is at 45b61a6.

Mitigation: unlike #234, I validated 8f21a6d itself — the exact commit being merged, after update-branch brought in #234. No inference from a neighbouring head is involved.

Independent validation at 8f21a6d (own worktree, not the primary checkout):

• pnpm exec vitest run → exit 0, Test Files 127 passed (127), Tests 2137 passed (2137)
• pnpm exec tsc --noEmit → exit 0
• pnpm exec eslint . --max-warnings 0 → exit 0
• pnpm exec prettier --check . → All matched files use Prettier code style!
• pnpm exec wxt build → exit 0
• node scripts/verify-extension-package.mjs .output/chrome-mv3 → Pack WXT extension package verification passed.

The 2137 count reconciles exactly against #234 at merge: 2132 there, plus this branch's 5. Neither branch silently dropped a test.

Mutation-pinned on the merged content, not on the pre-merge head: removed isSupportedBundleScope(scope) from the line 106 guard, leaving if (!isCanonicalSinglePeriodLedgerId(ledgerId)) return null;. Result: 1 failed / 19 passed in filed-returns-single-period-bundle-ledger.test.ts — its own test, not a neighbour. The scope guard is still load-bearing after absorbing #234.

Not run: pnpm workflow:preflight, which fails with current checkout is detached — an artifact of validating from a detached verify worktree, not a property of this branch.