Harden TQQQ snapshot owner verification

[Pigbibi]

Scope

• Descriptor-backed root admission and exact-member reads for the existing snapshot owner.
• Bounded member/total bytes, authenticate-before-parse, strict JSON, and a single strict CSV parser.
• Linux/macOS capability gate with fail-closed unsupported-platform behavior.

Validation

• PYTHONPATH=src python3 -m pytest -q tests/test_tqqq_r1_snapshot.py
• PYTHONPATH=src python3 -m pytest -q
• python3 -m ruff check src/us_equity_snapshot_pipelines/tqqq_r1_snapshot.py tests/test_tqqq_r1_snapshot.py
• PYTHONPATH=src python3 -m compileall -q src

Exact changed paths: src/us_equity_snapshot_pipelines/tqqq_r1_snapshot.py, tests/test_tqqq_r1_snapshot.py.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c649c430f4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Read regular files until the expected size is exhausted

When a regular-file read is interrupted after transferring some data, or a filesystem otherwise returns a legal short read, os.read() may return fewer bytes than requested even though the file is unchanged. This single read then makes the length check report snapshot member changed during read, so a valid snapshot can fail verification nondeterministically; accumulate reads until before.st_size + 1 bytes or EOF before performing the stability checks.

Useful? React with 👍 / 👎.

[Pigbibi]

Fail-closed evidence-only closure for exact head c649c430f46c980852699b5b4b6f885417e68804: required CI run 30511668490 succeeded, but the automatic exact-head Codex review has one current unresolved P2 (PRRT_kwDOR_7pX86U-lt8, legal short-read handling). Under the immutable-head zero-remediation contract, this PR is closed unmerged. No patch, thread mutation, review request, rerun, or merge was performed. Any successor requires a separate bounded authority.