fix: build versioned XLSM from template and update release checklist

[stranske]

Pre-deployment fixes identified during local deploy readiness review.

Changes

release.py — XLSM built from template, not copied from root

_copy_runner_xlsm (which grabbed the raw developer Runner.xlsm from the repo root) is replaced by _build_runner_xlsm, which calls build_xlsm_artifact to produce a properly versioned counter_risk_runner.xlsm from assets/templates/counter_risk_template.xlsm with version metadata injected into docProps/core.xml. Raises ValueError if the template is missing.

tests/test_release_bundle.py

• _make_minimal_xlsm() helper produces a valid XLSM ZIP for test fixtures
• _write_fake_repo now seeds a valid XLSM ZIP for the template
• Runner XLSM tests updated to exercise _build_runner_xlsm and assert version metadata is present in the output
• Fail-fast test updated to check for missing template (not missing Runner.xlsm)

docs/RELEASE_CHECKLIST.md

• Added Windows prerequisite (PyInstaller must run on Windows for a Windows bundle)
• Added all new bundle artifacts to validation checks and expected contents list
• Added config path update step (operators must update YAML paths before first run)
• Added macro trust confirmation step
• Removed stale explicit xlsm build step from main sequence — it is now internal to the assembler

https://claude.ai/code/session_01D7662TN52iZPqh1HgAFBRQ

[stranske-keepalive]

⚠️ Action Required: Unable to determine source issue for PR #334. The PR title, branch name, or body must contain the issue number (e.g. #123, branch: issue-123, or the hidden marker ).

[Copilot]

Pull request overview

This PR improves release bundle assembly so the operator XLSM is generated from the canonical template with version metadata injected, and expands the bundle/docs to include a remote-trigger workflow.

Changes:

• Build counter_risk_runner.xlsm from assets/templates/counter_risk_template.xlsm during release assembly (injecting version metadata into docProps/core.xml).
• Include/copy remote-trigger scripts (request_*.cmd, process_*.cmd) and accompanying documentation into the release bundle, and update the bundle README.
• Update release-bundle tests and expand the release checklist to reflect the new artifacts and operator steps.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/counter_risk/build/release.py	Adds runner XLSM build step and copies remote-trigger scripts/docs into the assembled bundle; updates README instructions.
tests/test_release_bundle.py	Adds minimal XLSM ZIP fixture + tests for XLSM build behavior and inclusion of remote-trigger artifacts in the bundle/manifest.
scripts/windows/request_counter_risk_remote.cmd	New requester-side script to write .request files for a worker to process.
scripts/windows/process_counter_risk_remote.cmd	New worker-side script to poll for .request files and run the CLI with generated settings.
docs/remote_trigger_testing.md	New documentation describing the shared-folder remote request flow.
docs/RELEASE_CHECKLIST.md	Updates prerequisites, expected artifacts, validation steps, and operator guidance for the new bundle contents.

Comments suppressed due to low confidence (2)

src/counter_risk/build/release.py:135

• _copy_remote_scripts currently logs and skips missing .cmd files, which can silently produce a bundle without the remote trigger entrypoints even though the release checklist expects them. Consider raising an error when either script is missing (or writing a manifest flag that clearly indicates the remote trigger feature is unavailable).

    scripts_src = root / "scripts" / "windows"
    names = ["request_counter_risk_remote.cmd", "process_counter_risk_remote.cmd"]
    copied: list[Path] = []
    for name in names:
        src = scripts_src / name
        if not src.is_file():
            LOGGER.warning("Remote script not found at '%s'; skipping.", src)
            continue

src/counter_risk/build/release.py:121

• _copy_remote_trigger_doc only logs and skips when docs/remote_trigger_testing.md is missing, but the release checklist now treats this file as an expected bundle artifact. To avoid silently producing an incomplete bundle, consider failing fast (raise ValueError) when the doc is missing, or explicitly documenting/encoding that it’s optional (e.g., feature flag / separate artifact group).

    src = root / "docs" / "remote_trigger_testing.md"
    if not src.is_file():
        LOGGER.warning("remote_trigger_testing.md not found at '%s'; skipping.", src)
        return []

[agents-workflows-bot]

🤖 Keepalive Loop Status

PR #334 | Agent: Codex | Iteration 0/5

Current State

Metric	Value
Iteration progress	[----------] 0/5
Action	wait (missing-agent-label)
Disposition	skipped (transient)
Gate	success
Tasks	0/9 complete
Timeout	45 min (default)
Timeout usage	6m elapsed (14%, 39m remaining)
Keepalive	❌ disabled
Autofix	❌ disabled

🔍 Failure Classification

| Error type | infrastructure |
| Error category | resource |
| Suggested recovery | Confirm the referenced resource exists (repo, PR, branch, workflow, or file). |

[agents-workflows-bot]

Keepalive Work Log (click to expand)

#	Time (UTC)	Agent	Action	Result	Files	Tasks	Progress	Commit	Gate
0	2026-03-28 20:59:36	Codex	wait (missing-agent-label-transient)	skipped	—	0	0/9	—	success
0	2026-03-28 21:12:36	Codex	wait (missing-agent-label-transient) retry	skipped	—	0	0/9	—	—
0	2026-03-28 21:16:57	Codex	wait (missing-agent-label-transient)	skipped	—	0	0/9	—	failure
0	2026-03-28 21:22:22	Codex	wait (missing-agent-label-transient)	skipped	—	0	0/9	—	cancelled
0	2026-03-28 21:27:26	Codex	wait (missing-agent-label-transient)	skipped	—	0	0/9	—	success