ADR-004: ARR owns deterministic processing and terminal ingestion

Status

Accepted

Date

2026-07-30

Context

The remote Agent successfully fetched the exact XML and ran the deterministic processor, but model-mediated MCP arguments reduced a valid 135-record result to 20 records. Prompt changes could guide tool use but could not guarantee lossless transport of a large structured payload. The user authorized a separate ARR2.0 workspace whose production XML path has no Agent involvement.

Decision

ARR2.0 runs the frozen process_daily.py itself after upload. It stores source and output artifacts as private immutable objects, validates a canonical DeliveryEnvelope with the existing independent validator, and commits through PostgresIngestionRepository in one transaction. The upload request waits for a terminal success or failure result.

The active runtime does not call SuperAgent, expose MCP, issue submission/read grants, use prompts or require a public source URL. Existing 009/010 database tables remain for historical compatibility but are not used by this path.

Rationale

This keeps deterministic business logic, source/artifact identity checks, independent validation, version activation, idempotent delivery replay and atomic Finance writes while removing the unreliable model-serialization boundary.

Consequences

Upload latency now includes processing, validation and database commit.
Controlled processor failures are persisted through the normal failed-delivery contract; infrastructure failures use explicit run/attempt terminal transitions and an outbox event.
Fresh user uploads create fresh jobs and follow existing business-date versioning; replay of the same delivery remains idempotent.
All ARR-managed object ACLs are private even when the bucket itself is public-read.
The original /Users/chillishark/ARR项目0727 workspace remains unchanged as the ARR1 rollback baseline.

Supersedes

ADR-002 for the ARR2.0 production XML path only.
ADR-003 for the ARR2.0 production XML path only.

arr_web/programmatic.py
arr_processing/local.py
arr_web/processing_runtime.py
tests/test_arr_programmatic.py

2.2 KiB Raw Blame History