fix: accept redacted IBKR reconciliation artifacts

Co-Authored-By: Codex <noreply@openai.com>

Author: Pigbibi

docs/ibkr_reconciliation_baseline_enrollment.zh-CN.md

@@ -97,6 +97,10 @@ Scheduler 任务，再由既有的最小权限 Scheduler 身份调用冻结服
 成功或失败时删除该一次性任务。它不调用 `/run`、不修改 GitHub 变量、不发布状态账本，也
 不发送任何订单。
 
+工作流 artifact 的外层是 `ibkr_reconciliation_artifact.v1`，内部仅保留同一份
+`broker_reconciliation` 摘要；`build_reconciliation_baseline_candidate.py` 可直接消费它。
+这样基线审核不必下载包含其他运行诊断的完整私有报告。
+
 同一目标至少应在相隔一分钟的两次手动运行中得到候选，才能交给
 `build_reconciliation_baseline_candidate.py`。工作流的成功只说明读取和收据格式正常；
 候选仍可能因为未配置预期摘要或账本差异而正确保持阻断。

scripts/build_reconciliation_baseline_candidate.py

@@ -33,6 +33,12 @@ def extract_reconciliation_evidence(payload: Mapping[str, Any]) -> BrokerReconci
         nested = diagnostics.get("broker_reconciliation")
         if isinstance(nested, Mapping):
             candidate = nested
+    # The manual evidence workflow stores only this safe candidate beneath a
+    # small artifact envelope.  Accept that envelope too, so enrollment never
+    # needs the broader private execution report as an input.
+    reconciliation = payload.get("reconciliation")
+    if isinstance(reconciliation, Mapping):
+        candidate = reconciliation
     evidence = candidate.get("evidence") if isinstance(candidate, Mapping) else None
     if not isinstance(evidence, Mapping):
         raise ValueError("receipt does not contain broker_reconciliation evidence")

tests/test_reconciliation_baseline_candidate_script.py

@@ -85,6 +85,19 @@ def test_accepts_persisted_runtime_report_shape() -> None:
     assert evidence.platform_id == "ibkr"
 
 
+def test_accepts_redacted_workflow_artifact_shape() -> None:
+    start = datetime(2026, 8, 30, 8, 0, tzinfo=timezone.utc)
+    payload = {
+        "schema_version": "ibkr_reconciliation_artifact.v1",
+        "strategy_profile": "soxl_soxx_trend_income",
+        "reconciliation": _payload(observed_at=start),
+    }
+
+    evidence = extract_reconciliation_evidence(payload)
+
+    assert evidence.platform_id == "ibkr"
+
+
 def test_missing_redacted_evidence_is_rejected() -> None:
     with pytest.raises(ValueError, match="does not contain"):
         extract_reconciliation_evidence({"diagnostics": {}})