feat: add deterministic OpenMetadata admission preview receipts

[seonghobae]

Buyer problem

A normalized projection alone is not enough for reliable cross-product admission. Operators and downstream consumers need to prove which source installation, exact verified compatibility profile, submitted snapshot, and safe projection produced a candidate—without copying sample rows, SQL, DDL, transformation text, or other omitted source values into a general receipt.

Bounded successor

This PR is stacked on #96 and owns only the deterministic, non-mutating admission-preview contract.

• No database row is written.
• No raw payload is retained.
• No OpenMetadata API is called.
• No credential or egress path is added.
• No catalog asset becomes authoritative or published.
• No mutable context-graph-contracts PR head is consumed.

RED contract

Commit 14d4151913c5c2a466a59a7fd5d9e517e96f5876 was written before production code. It requires:

• canonical JSON hashing independent of object insertion order;
• identical receipt identity for 2.0.1 and 2.0.1-release;
• installation-scoped replay identity;
• separate source-snapshot and safe-projection digests;
• omitted secret values to affect source identity without entering the receipt;
• fail-closed rejection of NaN/non-canonical JSON;
• timezone-qualified observation time;
• typed POST /integrations/openmetadata/v1/table-snapshots:admission-preview;
• explicit non-persistence and non-mutation evidence.

Focused RED verification fails at import because preview_openmetadata_table_admission does not exist. Production implementation follows on this branch.

Intended receipt

source installation + exact compatibility profile + canonical source digest
    -> verified safe projection
    -> canonical projection digest
    -> deterministic replay key and receipt ID

The receipt will be suitable as the input contract for the next 3NF persistence slice, but it is not itself a durable admission or source-origin attestation.

Merge discipline

• feat: add OpenMetadata 2.x read-only normalization boundary #96 must integrate first or this PR must be non-force restacked onto its protected merge result.
• Full exact-head tests, coverage, docstrings, fuzz/SAST/security, review, and independent approval are required after the production implementation is complete.
• No predecessor evidence transfers and no bypass merge is requested.

Part of #95.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}