run privacy and renderer probes in release gate

docs/research/pre_work_error_ledger.md

@@ -87,6 +87,7 @@ For large architecture or release work, also read:
 | ERR-054 | Candidate-time sensitivity scanning used the legacy `varga` CLI, so D4/D24/D30 could appear unavailable despite being supported by `varga-full`. | resolved 2026-07-13 | Scanner calls `varga-full --divisions D4,D9,D10,D24,D30` once per candidate and reads its canonical `Ascendant.sign` fields. |
 | ERR-055 | The full-reading path called `calc_all_sahams()` without lat/lon/tz, so an otherwise computable Swiss day/night context was silently blocked. | resolved 2026-07-14 | Pass the calculation arguments' lat/lon/tz into the Saham layer; keep Saham formula maturity `partial` until oracle parity exists. |
 | ERR-056 | A WorkBuddy checkout of the same remote diverged substantially from the active source branch and can be mistaken for a mergeable mirror. | active | Read `whole_machine_fragment_sweep_2026_07_14.md`; do not copy or merge it without explicit commit-level review on a separate branch. |
+| ERR-057 | The release quality profile checked untracked files but did not execute the privacy AST scan or the real Chromium report-isolation probe. | mitigated 2026-07-14 | `release_hygiene_check()` now requires `public_release_privacy_scan.py --json` and `report_renderer_isolation_poc.py --strict`; parity manifest validation also runs as a contract check. |
 
 ## Fragment Sweep Command Set
 

scripts/report_renderer_isolation_poc.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import json
+import argparse
 import tempfile
 import threading
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
@@ -78,4 +79,9 @@ def run_poc() -> dict[str, Any]:
 
 
 if __name__ == "__main__":
-    print(json.dumps(run_poc(), ensure_ascii=False, sort_keys=True))
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--strict", action="store_true", help="Return nonzero unless the isolation probe passes.")
+    args = parser.parse_args()
+    result = run_poc()
+    print(json.dumps(result, ensure_ascii=False, sort_keys=True))
+    raise SystemExit(0 if not args.strict or result["status"] == "pass" else 1)

scripts/run_quality_gate.py

@@ -391,6 +391,9 @@ def release_hygiene_check() -> None:
         }
         print(json.dumps(payload, ensure_ascii=False, indent=2), file=sys.stderr)
         raise SystemExit(1)
+    run([PYTHON, "scripts/public_release_privacy_scan.py", "--json"])
+    run([PYTHON, "scripts/report_renderer_isolation_poc.py", "--strict"])
+    run([PYTHON, "scripts/three_engine_parity_replay_validator.py", "references/oracle/three_engine_parity_replay_manifest.json"])
     print("release_hygiene_check ok: no release-critical product files are untracked")
 
 

tests/test_release_hygiene_contract.py

@@ -0,0 +1,8 @@
+from pathlib import Path
+
+
+def test_release_profile_requires_privacy_and_renderer_probes() -> None:
+    source = (Path(__file__).resolve().parents[1] / "scripts" / "run_quality_gate.py").read_text(encoding="utf-8")
+    assert '"scripts/public_release_privacy_scan.py", "--json"' in source
+    assert '"scripts/report_renderer_isolation_poc.py", "--strict"' in source
+    assert '"scripts/three_engine_parity_replay_validator.py"' in source