# ADR-004: ARR owns deterministic processing and terminal ingestion

## Status

Accepted

## Date

2026-07-30

## Context

The remote Agent successfully fetched the exact XML and ran the deterministic processor, but model-mediated MCP
arguments reduced a valid 135-record result to 20 records. Prompt changes could guide tool use but could not guarantee
lossless transport of a large structured payload. The user authorized a separate ARR2.0 workspace whose production XML
path has no Agent involvement.

## Decision

ARR2.0 runs the frozen `process_daily.py` itself after upload. It stores source and output artifacts as private immutable
objects, validates a canonical `DeliveryEnvelope` with the existing independent validator, and commits through
`PostgresIngestionRepository` in one transaction. The upload request waits for a terminal success or failure result.

The active runtime does not call SuperAgent, expose MCP, issue submission/read grants, use prompts or require a public
source URL. Existing 009/010 database tables remain for historical compatibility but are not used by this path.

## Rationale

This keeps deterministic business logic, source/artifact identity checks, independent validation, version activation,
idempotent delivery replay and atomic Finance writes while removing the unreliable model-serialization boundary.

## Consequences

- Upload latency now includes processing, validation and database commit.
- Controlled processor failures are persisted through the normal failed-delivery contract; infrastructure failures use
  explicit run/attempt terminal transitions and an outbox event.
- Fresh user uploads create fresh jobs and follow existing business-date versioning; replay of the same delivery remains
  idempotent.
- All ARR-managed object ACLs are private even when the bucket itself is public-read.
- The original `/Users/chillishark/ARR项目0727` workspace remains unchanged as the ARR1 rollback baseline.

## Supersedes

- ADR-002 for the ARR2.0 production XML path only.
- ADR-003 for the ARR2.0 production XML path only.

## Related

- `arr_web/programmatic.py`
- `arr_processing/local.py`
- `arr_web/processing_runtime.py`
- `tests/test_arr_programmatic.py`