Review distribution controls and prepare the agreed first Conda route

Start from the referenced central receipt (devguide/rollouts/dockingmt_distribution_controls_45_20261007.json) and devtools/tests/test_distribution_contract.py, plus the linked governance issues uibcdf/molsyssuite#45 and #109, to map what is already delivered versus what remains. The payload names many hashes, CI run IDs and guarded inventory paths but never states a concrete first edit a newcomer could make; most remaining work (release plan, credentials, public dependency closure, installed cells) is explicitly owner-gated. Done would mean a smaller, separately scoped issue pointing at one named file or test.

DockingMT independent receiving — 2026-10-09

CI and distribution remain partial. Current source a2b282a4ea1afa4524e92cbb4a444c0c6fe1dad8 passes all seven CI jobs, policy and Conda controls. All four Linux Python 3.11–3.14 suites execute; 3.14 has 1037 passed.

Actual daily recovery 37794015785, at older source edc7ce1d8c6b8e216454d28eaf6de65cb24b8226, detects one skipped commit and passes all six configured full cells (Linux 3.11–3.14 and macOS arm64 3.13/3.14; both 3.14 cells: 1000 passed). Daily 37943924984 observes zero skips and intentionally omits tests. Probe 37844141027 detects two skips but does not run science or clear debt. These observations are source-scoped, not current-head recovery evidence.

Historical internal LMMV PR uibcdf/dockingmt#20 passes four jobs, including then-supported Linux 3.11–3.13 (3.13: 103 passed). Requested head ac91b224 actually tests synthetic integration 5a21a4f47e484f96ec51d399b45c929a0ffd380f. Current four-minor/preflight PR execution and an external actor are not inferred. Protection retains five strict quality/Linux checks, explicit PR integration and the authorized admin exemption.

Thirteen accepted recovery/publication inputs remain byte-identical; 59 mandatory payload paths are retained. uibcdf/molsyssuite#110 is delivered at 948d0267de8fa43c542ab7eba28b9f8b7fbf095e, but its accepted handoff requires a real installed candidate before adopting the pin/removing the installed-only workaround. There is no real release plan: version selection, exact candidate gates, all eight installed cells and same-byte public receiving remain uibcdf/dockingmt#47; public platform/admission review remains uibcdf/dockingmt#30. Coverage uibcdf/dockingmt#22 is already closed.

Immutable receiving receipt. Local: six tests and offline guard passed. Exact central commit validation, attempt 1: 447 tests, governance, publisher controls, retained XML and coverage upload passed. No component files, scientific assertions, versions, pins or publication operations changed. Global private-OpenCASTp audits remain a separate uibcdf/molsyssuite#102 access limitation.

Previous issue context (retained)

What — Prepare DockingMT's first additional guarded noarch: python Conda route and current source-installation controls under uibcdf/molsyssuite#45. The principal maintainer authorized this preparation; the real version, release plan and publication stay with the component developer.

Accepted source — 50f0abbdf14a08b77d26b293d1b670d6dfc204a0. Source-context SDK 738fe8dd731abb99dac421b0bb2acc8564110180 is independently accepted under uibcdf/molsyssuite#109 (416 central native tests); publication SDK remains 2d32048457c6d37093ae509f5626d00a5cda121b. Initial source 1d67d3838bb1fd18a59fad8800c317767f7683a6 and its failed context preflights are retained separately in the receipt.

Delivered — One noarch recipe preserves Python >=3.11,<3.15 and all six core dependencies. Vina/Viewer stay optional. The inventory guards 58 tracked core/addon payload paths plus the generated version (59), nine routes, four original immutable directory-source records and four Python-minor contexts. Original scientific checkout/install/test commands, pins, environment bytes, matrix/triggers and recovery remain unchanged. New administrative preflights qualify the actual installed clone origins and versions rather than representing source fallback as public dependency closure.

Candidate/publication controls — Immutable build/upload, installed-test and promotion wrappers are prepared. The example plan requires fourteen executed candidate jobs; the installed descriptor requires eight Linux/macOS arm64 × Python 3.11–3.14 cells, with all four mandatory steps. No real release plan exists. Expected ANACONDA_UIBCDF_TOKEN mapping is documented, but credential access is unknown and no secret was created/read/changed.

Executed evidence — Nineteen distribution guards plus the existing reporting test pass locally; declaration preflight, conformance, Ruff/format, actionlint and scoped adapter typing pass. Exact-head policy 37596656137 and Conda governance 37596656314 verify successful jobs/steps. Routine source CI 37596655381 independently verifies exactly six successful jobs: quality, distribution controls and all four Linux Python 3.11–3.14 science jobs, including actual installed-context, ordinary installed-package and pytest-receptor steps. This does not qualify the separate full matrix or a staged/installed/public release archive.

Correction — Original ArgDigest checkout input 1bea27fab5f5b15ee4c16ca2402cd0cfa1614d2e is an annotated tag object, pointing to actual source HEAD 57447cc4ec1f7ce85078f8a939892efd075bc919. The inventory now requires the actual commit and retains the original input as owner-only checkout_ref, guarded against workflow drift. The pin/commands are unchanged; a real annotated-tag regression rejects the old expectation and accepts its target.

Installed receiving control — The descriptor explicitly clears inherited source pytest pythonpath with -o pythonpath=. A test exercises the actual shared installed runner with installed primary/source addon shadows, failing the original path behavior and passing the override. The broader reusable multiple-import-root need remains uibcdf/molsyssuite#110; this documented receiving control stays until a reviewed shared replacement. It is synthetic regression evidence, not an installed scientific archive qualification.

Remaining / owner — Whole adoption and CI/recipe remain partial, access unknown. DockingMT owns real public production/development dependency closure, complete exact-candidate gates, reviewed release plan/access, original staged archive, all eight installed cells and same-byte authorized promotion plus independent public receiving. Python admission stays uibcdf/dockingmt#30, native molecular integration uibcdf/dockingmt#33 and coverage uibcdf/dockingmt#22. Scientific failures/design remain component-owned.

Record — Local devguide report and devtools/tests/test_distribution_contract.py are committed with the source. Central immutable receipt: https://github.com/uibcdf/molsyssuite/blob/92356363d6f6651f09dc1a2a73853bf3c60fa7e4/devguide/rollouts/dockingmt_distribution_controls_45_20261007.json . The original inspection receipt remains separate. No package build/upload/promotion/tag, real environment update, release-version selection or additional scientific dispatch occurred in this governance work.