# ARR2 deterministic processing

The active ARR2 path uses two modules:

- `policy.py` loads the frozen processor version and rule-set SHA-256 from `arr-opera-daily-ingest`.
- `local.py` runs `process_daily.py` in an isolated directory with a bounded timeout, requires process exit status to
  agree with both JSON artifacts, and permits only basename-confined declared XLSX outputs.

The caller stores the success/failure artifacts and passes a canonical `DeliveryEnvelope` to `arr_ingestion`. Processor
stdout/stderr, temporary paths and source bytes never enter the public response or database.

Older remote-run, signature and callback modules remain as ARR1 compatibility/audit code. The ARR2 Web entrypoint does
not import them, root requirements do not install their HTTP client, and Compose exposes no corresponding service.