wyndham-ARR/arr_processing

ARR2 deterministic processing

The active ARR2 path uses two modules:

• policy.py loads the frozen processor version and rule-set SHA-256 from arr-opera-daily-ingest.
• local.py runs process_daily.py in an isolated directory with a bounded timeout, requires process exit status to agree with both JSON artifacts, and permits only basename-confined declared XLSX outputs.

The caller stores the success/failure artifacts and passes a canonical DeliveryEnvelope to arr_ingestion. Processor stdout/stderr, temporary paths and source bytes never enter the public response or database.

Older remote-run, signature and callback modules remain as ARR1 compatibility/audit code. The ARR2 Web entrypoint does not import them, root requirements do not install their HTTP client, and Compose exposes no corresponding service. When that retired path is composed for audit or a historical callback, it uses its frozen v3 success/failure projection; it cannot enter review_required or accept an artificial price.