M3/E5/#16 — ISSDC-PRADAN adapter

[Rexy-5097]

Canonical identifier: Milestone M3 · Epic E5 · Issue #16 — ISSDC-PRADAN adapter
Dependencies: #15 ✔ (1d65c63)
Selection: eligibility from origin/main:docs/tis/TIS-v1.0.md §15 — complete {1…15}, eligible {#16, #17, #22, #23, #25, #26, #27, #39}; lowest Order selects #16.

The first acquisition channel. Aditya-L1 SoLEXS daily archives, registered with latency class ~33d and granularity daily-archive (E5 §18).

What acquisition actually is for this channel

PRADAN is not an API. ISSDC's own published download script states the procedure — "Login to Pradan in your browser, select data of your interest and download script for the session" — and warns that "There are session download limits, request rate limit and session timeouts in place… Violations may lead to blocking."

So the network step is performed by a person, outside this system, and what it leaves behind is an extracted archive tree. acquire is the step that brings that tree into the platform: locate the day, have the kernel digest every product, stamp the moment the system learned of it, return provenance for all of it. ADR-0023 already describes the result correctly — Tier 0, referenced not stored, an evictable cache that is never the system of record.

No HTTP is performed, and none is simulated. Writing a fetch against a portal that requires an interactive login would mean inventing a transport this channel does not have, and inventing responses to go with it. When a day's products are not on disk the adapter raises UnavailableResource — the true statement, that the data has not been retrieved. A test asserts the module imports nothing that could make a request.

No retry loop and no timeout. E5 §15 makes retry policy adapter-local, and there is no network call here to retry; a loop around a filesystem read would be fabricated behaviour.

This adapter holds no credential

It cannot leak a secret because it has none — authentication is a browser login that happens before and outside this code. Its descriptor records requires_credentials=True because re-acquiring needs a session, which is what a future reader must know (ADR-0023). test_the_adapter_holds_no_credential asserts vars() is exactly {archive_root, _store}. That is a stronger form of STD-19 than confinement: there is nothing here to confine.

The STD-12 trap, found in this archive for a second reason

E5 §16 requires real-data guards to test for the products, not a directory, citing the legacy isdir guard that silently disabled 188 tests. The same trap exists here for a different reason, verified: the five v1.1 archives carry a tracked quicklook PNG, so AL1_SLX_L1_20241001_v1.1/ exists in every clean checkout while its .gz products do not.

Guards test for .gz products. products() raises UnavailableResource naming STD-12 when a directory is present and empty, and a test reproduces exactly that condition.

Archive identity is a rollup, not an opaque digest

One line per product — digest, size, relative path — sorted, digested by the kernel. Same reasoning as DatasetRelease rolling per-table digests to a release digest (ADR-0006): a changed byte anywhere changes the archive identity and stays locatable to the product that changed. A digest over concatenated content would detect the change and lose its address.

Sorted, because the identity is computed over the sequence — filesystem ordering must not reach it, or two machines produce two identities for the same bytes. AppleDouble sidecars and the v1.1 quicklook PNG are excluded: neither is what ISSDC published, and including either would make the digest depend on which computer looked at the data.

The product bytes are not registered with the store. Only the listing is. Registering them would copy Tier 0 into the store, which ADR-0023 forbids.

Verified against the real corpus

2024-05-14 — the X8.7 flare SALVAGE-001 records v1 reproducing to the minute from GOES, now the Aditya-L1 side of the same day entering the platform with provenance:

4 products, 13,302,792 bytes
SDD1 gti only; SDD2 gti + lc + pi     exactly SPEC-parsers r6 §1.1
436 archives, 436 unique dates         re-measured, matching the spec

Both real-corpus tests skip rather than fail where the archive is absent (E5 §17) — demonstrated in the clean export below.

Feature-level integration

Every acquisition in the integration suite goes through #15's verify_conformance rather than calling acquire and inspecting the result — the difference between an adapter that happens to produce the right shape and one the platform has accepted. A near-identical adapter breaking exactly one rule is refused by the same call that admits this one.

Across all six components: #10 every digest re-derived with the kernel's own functions · #11 the Observation validates against its contract · #12 the domain holds the digest and both times · #13 the shipped import rule binds, with a deliberate cross-context violation · #14 the acquisition becomes a valid Tier 0 manifest, and cannot be recorded as deposited · #15 conformance is what admits it.

Verification

unit (kernel + domain + contexts)  405 passed   (+33)
tests/architecture                 562 passed
tests/integration                  114 passed   (+17)
research/tests/v2                  188 passed
links / imports / contracts gates  clean

clean export (git archive HEAD, archive absent):
  unit 403 passed, 2 skipped · integration 88 passed, 2 skipped
  + 24 pre-existing errors (IMPL-012)
  → real-data tests SKIP, never fail: E5 §17 satisfied

⚠ Pre-existing security finding — reported, not repaired

Investigating how PRADAN acquisition actually works surfaced live-format ISSDC session cookies committed to this public repository, in 8 tracked files on origin/main (research/legacy/*.sh, research/data_pipeline/config.yaml, hel1os_downloader.py, downloader/recovery.py, and two report files), and also at tag v1-surya-final.

STD-19: "No secret is committed." This predates #16 and is outside its ownership, so per the defect protocol it is reported rather than silently repaired — and deletion from HEAD would not help, since the values remain in history and at the tag. The only effective remedy is invalidating the sessions at ISSDC. Details in the completion report.

CI impact

No workflow change. contexts is already a unit-job root (added by #15) and tests/integration already runs. Still eight required contexts.

🤖 Generated with Claude Code