Move agent_import.rs read-back verification into agent_import_verification.rs

[lamemustafa]

Outcome

src-tauri/src/agent_import.rs loses its import read-back verification family: parse_import_vouchers through render_proof_markdown, 18 functions, 606 lines. They now live in src-tauri/src/agent_import_verification.rs, declared as agent_import::verification. No behaviour change.

This family decides whether an imported voucher is reported posted_verified. It parses the verification collection, corroborates the window, attributes vouchers by narration marker or fingerprint, finds duplicates and renders the proof. Before #482, 11 of the 14 commits touching agent_import.rs never touched it (a crude hunk-header measure).

The move is regenerated by script on 2481ed0, not rebased. It supersedes the reviewed but never-PR'd branch refactor/agent-import-verification (3d9fc91, old base 07fc1f7). Master had since changed the moved code (#482: effective-date verification). Because the cut is by function name, that code moves with the rest.

What changed in the moved code

• pub(super) on the 17 functions reached from outside the module. effective_date_not_observed (added by Verify the effective date Bridge writes on Payment, Receipt and Contra #482), VerificationCandidates and VerificationFingerprint stay private.
• Its two super:: paths (parse_import_verification_rows, validate_agent_envelope, both in agent scope) become super::super::.
• Nothing else. With those two edits undone and both sides run through rustfmt, the block is byte-identical to master's. Unformatted, the only other difference is rustfmt rewrapping parse_import_vouchers and verify_batch, whose signatures the prefix pushed past 100 columns.

The parent imports explicitly, with no glob, following the owner's idiom:

• 13 reached from production code, counted from call sites (not word-grep):
  • 8 from Server methods in agent_import.rs: build_import_xml, verify_import_with_dispatch, persist_import_verification and pre_import_mark.
  • 4 of those 8 are also called by the posting path, agent_import_post.rs.
  • 5 from the amendment compare-and-swap, agent_import_amend.rs.
• 4 test-only, under #[cfg(test)]: batch_duplicate_sets, duplicates, observed_fingerprint and observed_voucher_identity. Word-grep put observed_fingerprint in the production list because a struct field shares its name. Clippy's unused-import error corrected it.

Scope, reuse, and impact

• Scope: one pure move plus the pin. Excluded: extracting steps from verify_batch (187 lines), whose steps share about a dozen mutable locals (see docs/rust-module-conventions.md).
• Deleted: nothing. Every moved function has a caller.
• Net LOC across the two files: +636/−606 (+30: module doc header, explicit import lists, and rustfmt rewraps of two signatures). Tests 0. Generated: surface and matrix. Cap reason and value in lib.rs: +6/−1.
• Compatibility surface: 267 → 268 pins. The only pin added is the new file, and MAX_SURFACE_FILES is 268 with a named reason. Digests changed for agent_import.rs and tools/bridge-tally-compatibility/src/lib.rs. Every other production collaborator (agent_import_post.rs, _amend.rs, _ledger.rs, _cash_bank.rs, _identity.rs, _persistence.rs) was already pinned. _schema.rs stays exempt, as already recorded.
• Migration or rollback: none needed. Revert the squash commit.
• Security impact for Tally, credentials, endpoints or customer data: none. No Tally dispatch lives in the moved code, and no live Tally was used.

Validation and evidence

• Exact candidate SHA: d0d62313
• cargo fmt and cargo clippy --locked -p bridge --lib --tests -- -D warnings -A clippy::pedantic: clean, on rustc 1.96.0.
• cargo test --locked --lib: 982 passed, 0 failed, 6 ignored.
• Test names: cargo test --lib -- --list gives 988 names, identical on 2481ed0 and on the candidate (sorted diff empty).
• node --test scripts/*.test.mjs: 250/250 pass.
• cargo test -p bridge-tally-compatibility: pass.
• scripts/reseal.sh --pins-changed, then --verify: current. An independent check found every pinned file's sha256 equal to its surface entry, matrix compatibility_surface_sha256 == surface manifest_sha256, pins added vs master = only the new file, and cap == 268 == pin count.
• Text readers: no include_str!/readFile of agent_import.rs in .rs/.mjs/.ts, and no script names a moved function. docs/agent/GOAL* briefs cite historical agent_import.rs:<line> locations and are left as history.
• Independent review (Sonnet, read-only): clean, no P1/P2/P3. It re-derived purity, name resolution for the two super::super:: paths (no glob shadowing), the 18/17/13/4 and 8/4/5 counts, and the surface delta. Its one wording note ("byte-identical" needs "after rustfmt") is fixed in the commit message and above.
• Native Windows/macOS validation: not applicable to a behaviour-free module move. CI runs the native workspace tests.

Conventions checklist (docs/rust-module-conventions.md), measured

1. Deletion first? No. All 18 functions are reached.
2. Pinned? Yes. The new file is pinned with a named reason, and its collaborators are pinned or already exempted.
3. Ranked by code lines, inline tests separated? Yes. Tests were already in agent_import_*_tests.rs.
4. Many small things or one huge function? Many small things: 111 top-level items, median fn 11 lines. This PR moves one family.
5. Read the boundary? Yes. The family's only outbound dependencies are the import row types, narration_markers and the two agent-scope parsers above.
6. Layer or wrapper? Neither. It is a subject: read-back verification.
7. Deep? Yes. 13 production entry points hide the candidate attribution, duplicate classification and proof rendering.
8. Change coupling? Before Verify the effective date Bridge writes on Payment, Receipt and Contra #482, 11 of the 14 commits touching agent_import.rs never touched the family (crude hunk-header measure). Verify the effective date Bridge writes on Payment, Receipt and Contra #482 touched both.
9. Façade? The parent keeps the Server tools and admission. It is not a pure façade, and not meant to be.
10. One named group, reviewable as a move? Yes. Use git diff --color-moved.
11. Test names match; fmt and clippy clean? Yes (988 identical).
12. Resealed in order; git status clean? Yes.

Coordination: announced in the merge queue. It takes over the parked slot of a thread that is no longer reachable, and the queue is otherwise empty.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.