# ARR2 deterministic processing

The active ARR2 path uses two modules:

- `policy.py` loads the frozen processor version and rule-set SHA-256 from `arr-opera-daily-ingest`.
- `local.py` runs `process_daily.py` in an isolated directory with a bounded timeout, requires process exit status to
  agree with both JSON artifacts, and permits only basename-confined declared XLSX outputs.

The caller stores the success/failure artifacts and passes a canonical `DeliveryEnvelope` to `arr_ingestion`. Processor
stdout/stderr, temporary paths and source bytes never enter the public response or database.

Older remote-run, signature and callback modules remain as ARR1 compatibility/audit code. The ARR2 Web entrypoint does
not import them, root requirements do not install their HTTP client, and Compose exposes no corresponding service.
When that retired path is composed for audit or a historical callback, it uses its frozen v3 success/failure projection;
it cannot enter `review_required` or accept an artificial price.
