[WO-CAD-002] Integrate pmix STEP extraction and component review

.gitattributes

@@ -3,3 +3,4 @@ demo_evidence/** -text
 *.md text eol=lf
 *.html text eol=lf
 *.ps1 text eol=crlf
+cad_evidence/** -text

.github/apparmor/pmix-bwrap

@@ -0,0 +1,6 @@
+abi <abi/4.0>,
+include <tunables/global>
+
+/usr/bin/bwrap flags=(unconfined) {
+  userns,
+}

.github/workflows/release-checks.yml

@@ -10,7 +10,8 @@ jobs:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.os == 'ubuntu-latest' && 'ubuntu-24.04' || matrix.os }}
+    timeout-minutes: 15
     defaults:
       run:
         shell: bash
@@ -24,16 +25,78 @@ jobs:
       - name: Install payment adapter dependencies
         run: python -m pip install -r paypal_adapter/requirements.lock
 
+      - name: Prepare verified pmix release and fixtures
+        if: matrix.os == 'ubuntu-latest'
+        run: |
+          (cd vendor/ubuntu-noble && sha256sum -c SHA256SUMS)
+          sudo dpkg --install vendor/ubuntu-noble/bubblewrap_0.9.0-1ubuntu0.3_amd64.deb
+          dpkg-query -W util-linux
+          test "$(id -u)" -ne 0
+          if [ "$(cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns 2>/dev/null || echo 0)" = 1 ]; then
+            sudo apparmor_parser --replace .github/apparmor/pmix-bwrap
+          fi
+          python -B scripts/install_pmix.py vendor/pmix/PAYPAL_CAD_001_RELEASE_20261110.zip
+          command -v prlimit
+          command -v bwrap
+
+      - name: Verify actual pmix sandbox execution
+        if: matrix.os == 'ubuntu-latest'
+        run: |
+          PYTHONPATH=tests python -B -m unittest -v test_pmix_integration.PmixIntegration.test_successful_extraction_and_bom_reconciliation
+
+      - name: Reproduce original experiment and prototype
+        if: matrix.os == 'ubuntu-latest'
+        working-directory: external/cad-experiment
+        run: |
+          python3 run_benchmark.py | tee benchmark-ci.log
+          python3 cad_adapter_prototype.py | tee adapter-ci.log
+
       - name: Rebuild dossiers from raw evidence and audit
         run: python -B scripts/build_and_serve.py --evidence demo_evidence --no-serve
 
-      - name: Release tests (payments, contract binding, Judge facts, economics, negative matrix)
-        run: python -B -m unittest discover -s tests -v
+      - name: All LEGION tests including real Linux pmix integration
+        if: matrix.os == 'ubuntu-latest'
+        run: python -B -m unittest discover -s tests -v |& tee "${RUNNER_TEMP}/legion-tests.log"
+
+      - name: Verify all 860 critical records against source STEP files
+        if: matrix.os == 'ubuntu-latest'
+        run: PYTHONPATH=. python -B scripts/audit_pmix_provenance.py | tee "${RUNNER_TEMP}/pmix-provenance.json"
+
+      - name: Windows LEGION tests (supported release, industrial and demand modules)
+        if: matrix.os == 'windows-latest'
+        run: PYTHONPATH=tests python -B -m unittest -v test_demand_first test_industrial test_release |& tee "${RUNNER_TEMP}/legion-tests.log"
+
+      - uses: actions/setup-node@v4
+        if: matrix.os == 'ubuntu-latest'
+        with:
+          node-version: '22'
+
+      - name: Real browser workflow at 1440px and 390px
+        if: matrix.os == 'ubuntu-latest'
+        env:
+          LEGION_CAD_EVIDENCE: ${{ runner.temp }}/cad-browser
+        run: |
+          npm ci --prefix scripts/pmix-browser --ignore-scripts
+          scripts/pmix-browser/node_modules/.bin/playwright install chromium
+          node scripts/test_pmix_browser.cjs
+
+      - uses: actions/upload-artifact@v4
+        if: always() && matrix.os == 'ubuntu-latest'
+        with:
+          name: cad-browser-and-regressions
+          path: |
+            ${{ runner.temp }}/cad-browser/
+            ${{ runner.temp }}/legion-tests.log
+            ${{ runner.temp }}/pmix-provenance.json
+            external/cad-experiment/benchmark-ci.log
+            external/cad-experiment/adapter-ci.log
+            external/cad-experiment/BENCHMARK_RESULTS.json
+            external/cad-experiment/ADAPTER_RESULTS.json
 
       - name: Payment adapter tests (fake provider, no network; Windows-only adapter)
         if: matrix.os == 'windows-latest'
         working-directory: paypal_adapter
-        run: python -B -m unittest discover -s tests -t .
+        run: python -B -m unittest discover -s tests -t . -v
 
       - name: Payment negative controls (N07, N09, N10, N14; Windows-only adapter)
         if: matrix.os == 'windows-latest'
@@ -74,5 +137,7 @@ jobs:
 
       - name: No secrets, private identifiers or machine paths
         run: |
-          ! grep -rIlE 'nvapi-[A-Za-z0-9]{8}|client_secret["'"'"' ]*[:=] *["'"'"'][A-Za-z0-9]|BEGIN [A-Z ]*PRIVATE KEY|AKIA[0-9A-Z]{16}|RGFNDXFWF988G|Users[\/]+Administrator|ADMINI~1|Dropbox' \
-            --exclude-dir=.git --exclude-dir=.github .
+          result=0
+          grep -rIlE 'nvapi-[A-Za-z0-9]{8}|client_secret["'"'"' ]*[:=] *["'"'"'][A-Za-z0-9]|BEGIN [A-Z ]*PRIVATE KEY|AKIA[0-9A-Z]{16}|RGFNDXFWF988G|Users[\/]+Administrator|ADMINI~1|Dropbox' \
+            --exclude-dir=.git --exclude-dir=.github . || result=$?
+          test "$result" -eq 1

.gitignore

@@ -2,5 +2,6 @@ external/
 __pycache__/
 *.pyc
 .venv/
+node_modules/
 demo_evidence/runs/A2-live-*/
 demo_evidence/negatives-live-*/

NOTICE

@@ -1,6 +1,11 @@
 LEGION Deal Rescue
 Copyright 2026 Veraxis
 
+Optional STEP extraction uses pmix v0.16.1 by Julian Chultarsky,
+https://github.com/jchultarsky101/pmix (MIT; third_party/pmix.LICENSE.md).
+Its binary is not committed here and is separately checksum-pinned.
+Reference STEP fixtures retain NIST/pmix attribution and are not held-out data.
+
 This product is licensed under the Apache License, Version 2.0 (see LICENSE).
 
 paypal_adapter/commerce_adapter/ is byte-identical to veraxis-protocol/LEGION-Commerce commerce_adapter/ at commit

cad_evidence/ADAPTER_RESULTS.json

@@ -0,0 +1,5 @@
+{
+  "tests_passed": 7,
+  "tests_total": 7,
+  "status": "T:read_only_extract,Z:engineering,Z:quote,F:checkout_enabled"
+}