feat(summary): add full-year portal-key CSV

[lamemustafa]

Summary

Add full-year-summary.csv to eligible full-fiscal-year ZIP exports. The summary is derived locally from portal JSON bytes already staged for the current ZIP, keeps portal-owned JSON Pointer keys, and adds one deterministic row per planned period/return/artifact outcome.

Rules are explicit and interpretation-free: arrays become element counts at their own paths; JSON numeric tokens are emitted as apostrophe-prefixed text with their exact source spelling; formula-like strings are apostrophe-prefixed; no tax labels, totals, or statutory meaning are inferred. PDF-only or otherwise non-parseable coverage produces fixed outcome rows. Bounded summary generation failure never blocks a correctly attested artifact ZIP and surfaces only a fixed categorical reason.

Root Cause / Decision Record

• What failed, changed, or was ambiguous? Full-year ZIPs had no deterministic, portal-key-derived summary view, and native JavaScript number parsing could not safely preserve every portal JSON numeric token.
• Why is this the smallest safe fix? It extends the existing offscreen/OPFS ZIP path, reuses the shared CSV utility, and returns only fixed status plus bounded counts. It adds no new capture path, storage key, retention lifetime, permission, host, network call, dependency, or telemetry.
• Which review threads, issues, or release gates does this PR close? Lane B full-year summary-sheet implementation and its local privacy/security review. Authenticated GST Portal evidence remains a follow-up gate.

Scope

• Runtime: derive a bounded CSV from staged JSON during offscreen ZIP assembly; attest artifact/summary entry counts; preserve categorical status through MV3 session recovery; render status/count only in the popup.
• Tests: synthetic portal-shaped JSON with decoys; numeric-token, formula, array, outcome-only, oversize, deep-path, message-binding, persistence/reopen, restart-cleanup, and exact ZIP count coverage.
• Docs/governance: disclose derivation, number/array/formula rules, retention, failure isolation, and the no-interpretation boundary in README and Privacy QA.
• Explicitly out of scope: tax interpretation, portal schema mapping, new portal capture behavior, new storage, new permissions, store-facing full-year claims, release readiness, and authenticated live evidence.

Pack Workflow Preflight

• pnpm workflow:preflight was run before editing/push, or the skip reason is documented.
• This PR was opened from a Pack branch, not master.
• I checked latest master Pack AGENTS guidance or recorded the stale-guidance warning.
• PR body keeps the required Pack privacy/review/verification checklist visible.

Sanchika Adoption Gate

• If this PR consumes @sanchika/* packages or copied Sanchika guidance, I
  read sanchika/docs/adoption-pack.md in the coordinated parent worktree.
• If this PR consumes Sanchika, it links ComplyEaze and Axal completion evidence
  and records the Sanchika commit or copied guidance used.
• This PR does not import ../sanchika, sanchika/packages/*/src, or parent
  source paths.

This PR does not consume Sanchika packages or copied guidance.

Privacy And Data-Flow Impact

• No new browser permissions.
• No new host permissions.
• No new network calls.
• No analytics, telemetry, ads, or session replay.
• No credential, OTP, CAPTCHA, cookie, token, GST file, or taxpayer-data capture. Not asserted: this feature processes values already present in the staged JSON selected for the user's local ZIP.
• No new credential, OTP, CAPTCHA, cookie, token, or GST artifact capture path. Taxpayer values already present in the user-requested staged JSON are processed only to create the local CSV inside the downloaded ZIP.
• Public copy and privacy declarations are updated if behaviour changed.

The derived CSV exists transiently in extension-controlled memory before browser handoff, persists only inside the user-requested downloaded ZIP, and is never separately written to OPFS or extension storage. Raw portal keys and values are not returned to the background or popup; only fixed status and bounded counts cross the offscreen boundary.

Sensitive Surface Review

• Current tab / portal target binding is preserved or intentionally changed.
• Download completion remains evidence-backed and fail-closed.
• Ambiguous side-effect delivery cannot be reported as confirmed success.
• Service-worker durability impact is understood and documented.
• Real taxpayer data, local paths, raw URLs/referrers, and portal HTML are absent from the diff.

Required local privacy and MV3 security re-reviews found no remaining Lane B findings. Final ZIP completion still requires the persisted intent, exact browser download ID, terminal completion, and non-empty evidence.

Chrome Web Store Impact

• This PR does not expand beyond the existing Chrome Web Store V0 listing unless every gate in docs/PUBLICATION_READINESS.md is checked.
• Full fiscal year remains source-build alpha and is not part of the Chrome Web Store V0 listing.
• Store copy, README status, Privacy QA, and reviewer instructions were reviewed if user-facing behavior changed.
• CI ZIP creation, provenance, and protected publishing are treated as release evidence, not manual store-submission sign-off.
• PR title uses Conventional Commits so Release Please can bump Pack after merge.

Verification

• pnpm install --frozen-lockfile
• pnpm audit --audit-level high
• pnpm exec wxt prepare
• pnpm exec prettier --check .
• pnpm exec eslint . --max-warnings 0
• pnpm exec tsc --noEmit
• pnpm exec vitest run
• pnpm exec wxt build
• node scripts/verify-extension-package.mjs .output/chrome-mv3
• pnpm exec wxt zip
• node scripts/verify-extension-zip.mjs
• node scripts/write-release-provenance.mjs — release-only; not run for this feature PR.
• node scripts/verify-github-release-assets.mjs --tag <tag> --zip <zip> --checksum <sha256> --provenance <json> when release assets exist — no release assets in scope.
• node scripts/publish-chrome-web-store.mjs --zip .output/<zip> --provenance .output/pack-release-provenance.v1.json --publisher-id <id> --dry-run true — store submission is out of scope.
• git diff --check
• pnpm review:gate -- --strict-head-review --required-review-author chatgpt-codex-connector --wait-head-review-ms 180000 --allow-missing-head-review before merge/readiness claim, with missing Codex review recorded as an audit gap if reported: pending draft-PR head review; no readiness claim is made.

Local full suite: 106 files and 1,672 tests passed. No authenticated GST Portal run was performed; live qualification remains required before any broader full-year claim.

Artifact Evidence

• CI run: pending after draft PR creation.
• ZIP artifact: local generated ZIP verified; not committed.
• ZIP SHA-256: 5ac5e8bfca14366d56cfe67098d50e7ca5afe802f5314e87f89df24b2e55e56b
• Clean source/tag or head SHA: 90284085b6fd0983db434c4fff98a1c0ddb71299

PR Review Follow-Up

• GitHub Actions completed.
• Autogenerated Codex/bot review comments inspected after checks completed for the latest head SHA.
• Inline review threads are resolved, outdated, or answered with evidence. No PR threads exist yet; local privacy/security findings were fixed and re-reviewed clean.
• No commits were pushed after the last required human/bot review without re-review.
• Any follow-up PRs are listed here instead of being left implicit.

Thread/comment	Disposition	Commit or evidence
Mandatory local privacy review	accepted / fixed	Clean re-review after numeric, retention, durability, and bounded-generation fixes at 9028408
Mandatory local MV3 security review	accepted / fixed	Clean re-review after period, response-count, path-budget, and artifact-count binding fixes at 9028408
Authenticated GST Portal evidence	follow-up	Required before broader full-year qualification; not performed in this PR

Screenshots

Not applicable. No raw summary content is rendered in the popup; it shows fixed status and bounded counts only.

DCO

• Commits include Signed-off-by: trailers.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 90284085b6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Validate the new runtime path with an authenticated run

Before merging this public behavior claim, exercise the new summary generation, offscreen ZIP assembly, browser handoff, and popup result in a live authenticated GST session: the commit's verification record explicitly says no authenticated portal run was performed, so the synthetic fixtures do not satisfy the repository's mandatory validation gate for these runtime, download, and privacy changes. Record the resulting evidence before treating the implementation and these README guarantees as validated.

AGENTS.md reference: AGENTS.md:L75-L77

Useful? React with 👍 / 👎.

[lamemustafa]

This remains the maintainer’s authenticated live-QA gate. No authenticated full-year run was performed in this lane, so it continues to block merge and I am leaving this thread unresolved.