[Experimental support] Accept strict normalization manifests

[Wenjie Fan (gggdttt)]

Scope and stack

AB#652973

Experimental common-support integration, not a standalone PR against main. Depends on #911. This branch was created from, and remains directly above, frozen gggdttt-http-knowledge-ab-gate head 0cbb709caaf92fcb2017bcfa0b1c77185d37cbc6. The initial worktree was clean; local HEAD, the GitHub PR head, and the microsoft/BC-Bench remote branch matched that SHA.

No dataset/gold/scorer changes, engine/CLI pins, publication gates, dispatches, model calls, judge calls, or merges. Paid runs still require separate authorization.

Change

Accept optional processes[].normalization from microsoft/BC-ALAgents#80, verified against exact head 4a0885e207cf96617b33d54d0146debbcf7d9841 (schema, writer, and tests), without relaxing ProcessRecord.extra='forbid'.

• ProcessNormalization: raw_report_path, lowercase 64-hex raw_report_sha256, nonempty changes.
• FindingIdNormalization: discriminator kind='finding-id', zero-based finding_index, nonempty original_id and canonical_id.
• LocationRangeNormalization: discriminator kind='location-range', zero-based finding_index, forward-slash file, positive line, and OriginalLocationRange with positive start-line/end-line aliases.
• Every new model is strict, frozen, and forbids extras. Only completed leaf records may carry normalization. Omitted legacy/no-op fields remain omitted on JSON roundtrip; explicit null fails. Duplicate kind/index pairs, unchanged IDs, and ranges violating the engine-emitted start-line < line <= end-line invariant fail. One finding may have both change kinds. No article-ID regex, contiguous-index requirement, or extra ordering restriction is added.

The adapter still validates accepted reports and scores al-code-review-findings.json; it does not reapply normalization. Audit metadata remains intact in the manifest. Manifest loading validates raw path/hash shape, not raw bytes or source-bound contents.

Diagnostics add exactly ${{ env.EVALUATION_RESULTS_DIR }}/**/_review-report.raw.json and ${{ env.EVALUATION_RESULTS_DIR }}/**/_review-source-bounds.json. All existing selectors remain in their original relative order. Raw OTel and broad checkout uploads remain excluded; retention and no-publication behavior are unchanged.

Source-faithful evidence

• Combined smoke: run 37310924454, synthetic__privacy-015, 03-al-privacy-review.
• Verified original handoff SHA256: c313a4ad40d270f4f77821ac36e375baaf107b8944fb8673e1d27d42c1e8b054.
• Verified original raw leaf SHA256: 26aead0958e6ffe60c947f740b95ecf016783116a88d1254e87cea5c54c10107.
• Replayed only extracted pure functions from the exact PR80 source against the original raw bytes and pinned findings schema. The resulting four ID edits followed by four range edits exactly equal the fixture. Anchors/ranges: 25/[23,25], 24/[20,24], 23/[19,23], 23/[18,23]; indices 0..3 for each kind.
• Reproduced the frozen BC-Bench failure (extra_forbidden at processes[0].normalization); the upstream JSON schema and new Pydantic models accept the same payload and preserve it on JSON roundtrip. This replay is not a new smoke or benchmark score.

Validation

• Ruff format/check passed.
• ty check . --ignore=unresolved-import --exclude notebooks/ passed with one pre-existing unused-ignore warning in untouched src/bcbench/redteam.py:150.
• Focused manifest, adapter, metrics, workflow, and code-review suite: 431 passed.
• Final full pytest: 1234 passed, 2 skipped, 1 deselected.
• pre-commit run --all-files: all hooks passed. Windows subprocess propagation required command-local core.fsmonitor=false in place of the equivalent empty value; no repository/global config change or skipped hook.
• git diff --check passed.

Coverage includes legacy omission, ID-only, range-only, combined 4+4, malformed hashes/paths/indices/lines, missing/unknown fields, failed/root/noncompleted lifecycle semantics, JSON roundtrips, loader and accepted-report validation, real adapter/evaluator paths with mocked engine/judge boundaries, unchanged audit bytes, and exact diagnostic selection/exclusion. The adapter tests produce four ordinary matches without changing scoring semantics and stop malformed metadata before review conversion.

Next smoke layer

Create a new app session based on gggdttt-support-normalization-manifests at 646e2802bc89993e048c410a6f146bad3fc8237e, not main and not the older #911 head. Keep that PR based on this support branch. The smoke layer should add only its separately approved immutable engine pin and matching exact test constant; normalization and uploader support are inherited. Reverify the branch/head, clean engine checkout, transitive BCQuality pin, and paid-run authorization before any dispatch.