feat: add public h5 dashboard and publish traceability

tests/test_company_reports_publishing.py

@@ -53,6 +53,22 @@ def empty_report():
     )
 
 
+def synthetic_built_workbook(
+    work_dir: Path,
+    filename: str,
+    content: bytes,
+    semantic_sha256: str,
+) -> BuiltWorkbook:
+    path = work_dir / filename
+    path.write_bytes(content)
+    return BuiltWorkbook(
+        path=path,
+        sha256=sha256_file(path),
+        byte_size=path.stat().st_size,
+        summary={"semantic_sha256": semantic_sha256},
+    )
+
+
 class CompanyReportPublishingTests(unittest.TestCase):
     def test_publish_archives_prior_current_and_activates_new_version(self):
         with tempfile.TemporaryDirectory(prefix="company-report-publish-test-") as temp_dir:
@@ -135,6 +151,135 @@ class CompanyReportPublishingTests(unittest.TestCase):
             self.assertEqual(repository.failed[0], reservation)
             self.assertEqual(repository.failed[1], ErrorCode.PUBLISH_FAILED)
 
+    def test_same_semantic_retry_reuses_first_publication_when_binary_changes(self):
+        with tempfile.TemporaryDirectory(prefix="company-report-publish-test-") as temp_dir:
+            project_root = Path(temp_dir) / "project"
+            output_root = project_root / "outputs" / "company_reports"
+            work_dir = project_root / "staging"
+            project_root.mkdir(parents=True)
+            work_dir.mkdir()
+            report = empty_report()
+            semantic_sha256 = "a" * 64
+            reservation = ReservedReport(46, 4, report.company)
+            repository = FakeRepository()
+            publisher = AtomicReportPublisher(project_root, output_root)
+
+            first_built = synthetic_built_workbook(
+                work_dir,
+                report.filename,
+                b"synthetic-first-workbook",
+                semantic_sha256,
+            )
+            first = publisher.publish(
+                report, reservation, first_built, repository, work_dir
+            )
+            archive_before = first.archive_path.read_bytes()
+            result_before = first.result_path.read_bytes()
+            current_before = first.current_path.read_bytes()
+
+            second_built = synthetic_built_workbook(
+                work_dir,
+                report.filename,
+                b"synthetic-rebuilt-workbook-with-different-bytes",
+                semantic_sha256,
+            )
+            self.assertNotEqual(first_built.sha256, second_built.sha256)
+            second = publisher.publish(
+                report, reservation, second_built, repository, work_dir
+            )
+
+            self.assertEqual(second.archive_path.read_bytes(), archive_before)
+            self.assertEqual(second.result_path.read_bytes(), result_before)
+            self.assertEqual(second.current_path.read_bytes(), current_before)
+            self.assertEqual(second.artifact.sha256, first.artifact.sha256)
+            self.assertEqual(second.result_json.sha256, first.result_json.sha256)
+            self.assertEqual(repository.activated[1].sha256, first.artifact.sha256)
+            self.assertIsNone(repository.failed)
+
+    def test_semantic_mismatch_does_not_replace_existing_publication(self):
+        with tempfile.TemporaryDirectory(prefix="company-report-publish-test-") as temp_dir:
+            project_root = Path(temp_dir) / "project"
+            output_root = project_root / "outputs" / "company_reports"
+            work_dir = project_root / "staging"
+            project_root.mkdir(parents=True)
+            work_dir.mkdir()
+            report = empty_report()
+            reservation = ReservedReport(47, 5, report.company)
+            repository = FakeRepository()
+            publisher = AtomicReportPublisher(project_root, output_root)
+
+            first_built = synthetic_built_workbook(
+                work_dir, report.filename, b"synthetic-first-workbook", "a" * 64
+            )
+            first = publisher.publish(
+                report, reservation, first_built, repository, work_dir
+            )
+            archive_before = first.archive_path.read_bytes()
+            result_before = first.result_path.read_bytes()
+            current_before = first.current_path.read_bytes()
+
+            second_built = synthetic_built_workbook(
+                work_dir, report.filename, b"synthetic-conflicting-workbook", "b" * 64
+            )
+            with self.assertRaises(PublicationError) as caught:
+                publisher.publish(report, reservation, second_built, repository, work_dir)
+
+            self.assertEqual(caught.exception.code, ErrorCode.PUBLISH_FAILED)
+            self.assertEqual(first.archive_path.read_bytes(), archive_before)
+            self.assertEqual(first.result_path.read_bytes(), result_before)
+            self.assertEqual(first.current_path.read_bytes(), current_before)
+            self.assertEqual(repository.failed[0], reservation)
+            self.assertEqual(repository.failed[1], ErrorCode.PUBLISH_FAILED)
+
+    def test_partial_existing_publication_fails_closed(self):
+        with tempfile.TemporaryDirectory(prefix="company-report-publish-test-") as temp_dir:
+            project_root = Path(temp_dir) / "project"
+            output_root = project_root / "outputs" / "company_reports"
+            work_dir = project_root / "staging"
+            project_root.mkdir(parents=True)
+            work_dir.mkdir()
+            report = empty_report()
+            reservation = ReservedReport(48, 6, report.company)
+            repository = FakeRepository()
+            publisher = AtomicReportPublisher(project_root, output_root)
+            built = synthetic_built_workbook(
+                work_dir, report.filename, b"synthetic-first-workbook", "c" * 64
+            )
+            first = publisher.publish(report, reservation, built, repository, work_dir)
+            first.result_path.unlink()
+
+            with self.assertRaises(PublicationError) as caught:
+                publisher.publish(report, reservation, built, repository, work_dir)
+
+            self.assertEqual(caught.exception.code, ErrorCode.PUBLISH_FAILED)
+            self.assertTrue(first.archive_path.is_file())
+            self.assertFalse(first.result_path.exists())
+            self.assertEqual(repository.failed[0], reservation)
+
+    def test_corrupt_existing_archive_fails_closed(self):
+        with tempfile.TemporaryDirectory(prefix="company-report-publish-test-") as temp_dir:
+            project_root = Path(temp_dir) / "project"
+            output_root = project_root / "outputs" / "company_reports"
+            work_dir = project_root / "staging"
+            project_root.mkdir(parents=True)
+            work_dir.mkdir()
+            report = empty_report()
+            reservation = ReservedReport(49, 7, report.company)
+            repository = FakeRepository()
+            publisher = AtomicReportPublisher(project_root, output_root)
+            built = synthetic_built_workbook(
+                work_dir, report.filename, b"synthetic-first-workbook", "d" * 64
+            )
+            first = publisher.publish(report, reservation, built, repository, work_dir)
+            first.archive_path.write_bytes(b"corrupted-archive")
+
+            with self.assertRaises(PublicationError) as caught:
+                publisher.publish(report, reservation, built, repository, work_dir)
+
+            self.assertEqual(caught.exception.code, ErrorCode.PUBLISH_FAILED)
+            self.assertEqual(first.current_path.read_bytes(), b"synthetic-first-workbook")
+            self.assertEqual(repository.failed[0], reservation)
+
 
 if __name__ == "__main__":
     unittest.main()