feat: qualify v2.0 multi-provider metadata edge preview

.gitleaksignore

@@ -3,9 +3,10 @@ tests/api/test_comicvine_key.py:generic-api-key:253
 tests/integration/test_security_endpoints.py:generic-api-key:206
 tests/unit/test_secret_validation.py:generic-api-key:103
 tests/fixtures/prowlarr_test_fixtures.json:square-access-token:206168
-tests/unit/test_import_story_arc_staging.py:generic-api-key:456
-tests/unit/test_import_story_arc_staging.py:generic-api-key:468
-tests/unit/test_import_story_arc_staging.py:generic-api-key:480
+# Synthetic folder cohort paths; exact locations shifted with the test's imports.
+tests/unit/test_import_story_arc_staging.py:generic-api-key:457
+tests/unit/test_import_story_arc_staging.py:generic-api-key:469
+tests/unit/test_import_story_arc_staging.py:generic-api-key:481
 # Historical synthetic folder cohort IDs, not credentials. Keep commit/path/line scope.
 ecd22c27eb7607e072ddb98d921738fb213896e4:tests/unit/test_import_scan_pipeline.py:generic-api-key:502
 ecd22c27eb7607e072ddb98d921738fb213896e4:tests/unit/test_import_story_arc_staging.py:generic-api-key:443

.grype.yaml

@@ -21,10 +21,13 @@ ignore:
   # not imported comic XML. Residual upstream-library risk remains until DHI
   # ships fixed packages; all other High findings continue to block.
   #
-  # Keep the existing libc review deadline of 2026-09-30 or the next base
-  # refresh, whichever comes first. Keep the existing Expat review deadline of
-  # 2026-10-07 or the next base refresh, whichever comes first. Remove these
-  # entries as soon as fixed stable packages are available.
+  # Re-reviewed and renewed by Adam Hernandez on 2026-10-01 ONLY for the two
+  # libc6 2.41-12+deb13u4+dhi1 matches below: re-review by 2026-10-04 or the
+  # next base refresh. Debian 13 has no fixed stable packages, and no direct
+  # affected calls were found in Pullbox or its pinned MEGA SDK; dependency
+  # reachability remains unproven. Older libc exceptions are not renewed.
+  # Keep the existing Expat review deadline of 2026-10-07 or the next base
+  # refresh, whichever comes first. Remove entries when fixed packages ship.
   # https://security-tracker.debian.org/tracker/CVE-2026-5435
   # https://security-tracker.debian.org/tracker/CVE-2026-19499
   # https://security-tracker.debian.org/tracker/CVE-2026-66046
@@ -33,14 +36,40 @@ ignore:
   # https://security-tracker.debian.org/tracker/CVE-2026-93990
   - vulnerability: CVE-2026-5435
     package:
-      name: libc6
+      name: '^libc6$'
       version: 2.41-12+deb13u4+dhi1
       type: deb
   - vulnerability: CVE-2026-19499
     package:
-      name: libc6
+      name: '^libc6$'
       version: 2.41-12+deb13u4+dhi1
       type: deb
+
+  # Approved by Adam Hernandez on 2026-10-01 for ONLY these three exact package
+  # matches. Accepted risk, NOT a fix or a claim that all dependencies are safe.
+  # GCC's fix is in the PBDS binary-heap erase_if template header. The runtime
+  # contains no compiler; neither Pullbox's native bridge nor its pinned MEGA
+  # SDK includes PBDS or calls this erase_if path. Third-party reachability and
+  # DHI backport status remain unproven; Debian 13 has no fixed stable package.
+  # Re-review by 2026-10-04 or at the next DHI refresh, whichever comes first.
+  # All other High findings and other package revisions remain blocking.
+  # https://security-tracker.debian.org/tracker/CVE-2026-102010
+  # https://github.com/gcc-mirror/gcc/commit/aaa8351f4d2e636f9680a1f0a8ebc2f0a60611e6
+  - vulnerability: CVE-2026-102010
+    package:
+      name: '^gcc-14-base$'
+      version: 14.2.0-19+dhi3
+      type: deb
+  - vulnerability: CVE-2026-102010
+    package:
+      name: '^libgcc-s1$'
+      version: 14.2.0-19+dhi3
+      type: deb
+  - vulnerability: CVE-2026-102010
+    package:
+      name: '^libstdc\+\+6$'
+      version: 14.2.0-19+dhi3
+      type: deb
   - vulnerability: CVE-2026-66046
     package:
       name: libexpat1

CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Added opt-in Metron API and read-only GCD Local series search, provider linking,
+  and reviewed metadata refresh alongside the existing ComicVine sources.
+- Added explicit existing-CBZ metadata review and coordinated ComicInfo.xml and
+  MetronInfo.xml output, including source choices for conflicting descriptive
+  values. Identity conflicts, reference-only files, and unsafe archives remain blocked.
+- Added a Series Details preview and approved `series.json` write using the saved
+  reconciled metadata, verified provider links, and field provenance. Safe custom
+  JSON fields are preserved; shared, reference-only, and read-only folders stay
+  unchanged. Split managed folders are reviewed individually.
+
+Automatic import metadata writing, GCD API v2, and LOCG enrichment are not enabled
+by this development preview. This is not the completed v2.0 general release.
+
 ## [1.3.0] - 2026-09-15
 
 Minor release adding Story Arc management, an optional local Comic Vine catalog,

alembic/versions/a8u9v0w1x234_settle_stopped_archive_publications.py

@@ -0,0 +1,39 @@
+"""Retain stopped-owner publication evidence independently of canonical adoption."""
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "a8u9v0w1x234"
+down_revision = "z7t8u9v0w123"
+branch_labels = None
+depends_on = None
+
+
+def _constraints(*, settled: bool) -> None:
+    terminal = "'abandoned','finalized'" + (",'settled'" if settled else "")
+    states = "'intended','published','abandoned','review','finalized'" + (
+        ",'settled'" if settled else ""
+    )
+    with op.batch_alter_table("archive_metadata_publications") as batch:
+        batch.drop_constraint("archive_publication_state", type_="check")
+        batch.drop_constraint("ck_archive_publication_reservation", type_="check")
+        batch.create_check_constraint("archive_publication_state", f"state IN ({states})")
+        batch.create_check_constraint(
+            "ck_archive_publication_reservation",
+            f"(state IN ({terminal}) AND active_file_id IS NULL AND active_path_key IS NULL) OR "
+            f"(state NOT IN ({terminal}) AND active_path_key IS NOT NULL)",
+        )
+
+
+def upgrade() -> None:
+    _constraints(settled=True)
+
+
+def downgrade() -> None:
+    table = sa.table("archive_metadata_publications", sa.column("state"))
+    if op.get_bind().scalar(
+        sa.select(sa.func.count()).select_from(table).where(table.c.state == "settled")
+    ):
+        raise RuntimeError("Cannot downgrade settled archive publication evidence.")
+    _constraints(settled=False)

alembic/versions/b9v0w1x2y345_add_library_conversion_journal.py

@@ -0,0 +1,47 @@
+"""Retain original, output and backup evidence for Library conversion recovery."""
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "b9v0w1x2y345"
+down_revision = "a8u9v0w1x234"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "library_conversions",
+        sa.Column("id", sa.Integer(), primary_key=True, autoincrement=True),
+        sa.Column("operation_id", sa.String(36), nullable=False, unique=True),
+        sa.Column(
+            "library_file_id", sa.Integer(), sa.ForeignKey("library_files.id", ondelete="SET NULL")
+        ),
+        sa.Column("active", sa.Boolean(), nullable=False),
+        sa.Column("state", sa.String(10), nullable=False),
+        sa.Column("plan_json", sa.Text(), nullable=False),
+        sa.Column(
+            "created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False
+        ),
+        sa.Column(
+            "updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False
+        ),
+        sa.CheckConstraint(
+            "state IN ('intended','registered','complete','abandoned','review')",
+            name="ck_library_conversion_state",
+        ),
+        sa.CheckConstraint(
+            "length(plan_json) BETWEEN 2 AND 65536", name="ck_library_conversion_plan_size"
+        ),
+    )
+    op.create_index("ix_library_conversions_active", "library_conversions", ["active"])
+
+
+def downgrade() -> None:
+    table = sa.table("library_conversions", sa.column("state"))
+    if op.get_bind().scalar(
+        sa.select(sa.func.count()).select_from(table).where(table.c.state != "abandoned")
+    ):
+        raise RuntimeError("Resolve retained library conversion evidence before downgrading.")
+    op.drop_table("library_conversions")

alembic/versions/c0w1x2y3z456_add_library_removal_journal.py

@@ -0,0 +1,44 @@
+"""Retain authorization and private staging evidence for library removal."""
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "c0w1x2y3z456"
+down_revision = "b9v0w1x2y345"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "library_removals",
+        sa.Column("id", sa.Integer(), primary_key=True, autoincrement=True),
+        sa.Column("operation_id", sa.String(36), nullable=False, unique=True),
+        sa.Column("active", sa.Boolean(), nullable=False),
+        sa.Column("state", sa.String(10), nullable=False),
+        sa.Column("plan_json", sa.Text(), nullable=False),
+        sa.Column(
+            "created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False
+        ),
+        sa.Column(
+            "updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False
+        ),
+        sa.CheckConstraint(
+            "state IN ('intended','detached','complete','abandoned','review')",
+            name="ck_library_removal_state",
+        ),
+        sa.CheckConstraint(
+            "length(plan_json) BETWEEN 2 AND 65536", name="ck_library_removal_plan_size"
+        ),
+    )
+    op.create_index("ix_library_removals_active", "library_removals", ["active"])
+
+
+def downgrade() -> None:
+    table = sa.table("library_removals", sa.column("state"))
+    if op.get_bind().scalar(
+        sa.select(sa.func.count()).select_from(table).where(table.c.state != "abandoned")
+    ):
+        raise RuntimeError("Resolve retained library removal evidence before downgrading.")
+    op.drop_table("library_removals")

alembic/versions/d1x2y3z4a567_add_removal_cleanup_evidence.py

@@ -0,0 +1,36 @@
+"""Retain bounded backup and cleanup evidence after removal detachment."""
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "d1x2y3z4a567"
+down_revision = "c0w1x2y3z456"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "library_removals",
+        sa.Column(
+            "cleanup_json",
+            sa.Text(),
+            sa.CheckConstraint(
+                "cleanup_json IS NULL OR length(cleanup_json) BETWEEN 2 AND 4096",
+                name="ck_library_removal_cleanup_size",
+            ),
+            nullable=True,
+        ),
+    )
+
+
+def downgrade() -> None:
+    table = sa.table("library_removals", sa.column("cleanup_json"))
+    if op.get_bind().scalar(
+        sa.select(sa.func.count()).select_from(table).where(table.c.cleanup_json.is_not(None))
+    ):
+        raise RuntimeError("Resolve retained removal cleanup evidence before downgrading.")
+    with op.batch_alter_table("library_removals") as batch:
+        batch.drop_constraint("ck_library_removal_cleanup_size", type_="check")
+        batch.drop_column("cleanup_json")

alembic/versions/e2y3z4a5b678_index_removal_trash_receipts.py

@@ -0,0 +1,57 @@
+"""Index retained removal trash receipts for bounded retention lookups."""
+
+import hashlib
+import json
+import os
+from pathlib import Path
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "e2y3z4a5b678"
+down_revision = "d1x2y3z4a567"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column("library_removals", sa.Column("trash_path_key", sa.String(64), nullable=True))
+    table = sa.table(
+        "library_removals", sa.column("id"), sa.column("plan_json"), sa.column("trash_path_key")
+    )
+    connection = op.get_bind()
+    last_id = 0
+    while rows := connection.execute(
+        sa.select(table.c.id, table.c.plan_json)
+        .where(table.c.id > last_id)
+        .order_by(table.c.id)
+        .limit(8)
+    ).all():
+        for row_id, encoded in rows:
+            last_id = row_id
+            if not isinstance(encoded, str) or len(encoded.encode("utf-8")) > 65536:
+                raise RuntimeError("Invalid retained removal evidence; repair before upgrading.")
+            plan = json.loads(encoded)
+            if not isinstance(plan, dict):
+                raise RuntimeError("Invalid retained removal plan; repair before upgrading.")
+            value = plan.get("trash_path")
+            if value is None:
+                continue
+            if (
+                not isinstance(value, str)
+                or not Path(value).is_absolute()
+                or ".." in Path(value).parts
+            ):
+                raise RuntimeError("Invalid retained trash path; repair before upgrading.")
+            connection.execute(
+                table.update()
+                .where(table.c.id == row_id)
+                .values(trash_path_key=hashlib.sha256(os.fsencode(value)).hexdigest())
+            )
+    op.create_index("ix_library_removals_trash_path_key", "library_removals", ["trash_path_key"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_library_removals_trash_path_key", table_name="library_removals")
+    op.drop_column("library_removals", "trash_path_key")

alembic/versions/f3z4a5b6c789_mark_removal_workspace_cleanup.py

@@ -0,0 +1,27 @@
+"""Track terminal removal workspace cleanup without discarding journal evidence."""
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "f3z4a5b6c789"
+down_revision = "e2y3z4a5b678"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "library_removals",
+        sa.Column("workspace_cleaned", sa.Boolean(), nullable=False, server_default=sa.false()),
+    )
+    op.create_index(
+        "ix_library_removal_workspace_pending",
+        "library_removals",
+        ["workspace_cleaned", "active", "id"],
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ix_library_removal_workspace_pending", table_name="library_removals")
+    op.drop_column("library_removals", "workspace_cleaned")

alembic/versions/g4a5b6c7d890_add_series_catalog_exclusions.py

@@ -0,0 +1,34 @@
+"""Retain explicit GCD Add exclusions independently of issue ownership."""
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision = "g4a5b6c7d890"
+down_revision = "f3z4a5b6c789"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "series", sa.Column("catalog_exclusions", sa.JSON(), nullable=False, server_default="[]")
+    )
+
+
+def downgrade() -> None:
+    table = sa.table("series", sa.column("catalog_exclusions", sa.JSON()))
+    if (
+        op.get_bind()
+        .execute(
+            sa.select(table.c.catalog_exclusions)
+            .where(sa.cast(table.c.catalog_exclusions, sa.String()) != "[]")
+            .limit(1)
+        )
+        .first()
+        is not None
+    ):
+        raise RuntimeError(
+            "Retained catalog exclusions prevent downgrade; preserve the review first."
+        )
+    op.drop_column("series", "catalog_exclusions")