wyndham-ARR/arr_processing

ARR2 deterministic processing

The active ARR2 path uses two modules:

• policy.py loads the frozen processor version and rule-set SHA-256 from arr-opera-daily-ingest.
• local.py runs process_daily.py in an isolated directory with a bounded timeout, requires process exit status to agree with both JSON artifacts, and permits only basename-confined declared XLSX outputs.

The caller stores the success/failure artifacts and passes a canonical DeliveryEnvelope to arr_ingestion. Processor stdout/stderr, temporary paths and source bytes never enter the public response or database.

Older remote-run, signature and callback modules remain as ARR1 compatibility/audit code. The ARR2 Web entrypoint does not import them, root requirements do not install their HTTP client, and Compose exposes no corresponding service.