feat!: apply the built-in taxon allowlist to every fullmap build

[SkyeAv]

The 18.1.0 top-100 experimental-taxon filter is no longer opt-in: tablassert build-fullmap applies the checked-in src/tablassert/data/experimental_taxa.yaml allowlist unconditionally, and --taxon-allowlist is removed. Every database the command installs — prebuilt extract, source build, or reused file — now carries the matching META.taxon_allowlist identity.

Always-on filter

• CLI: build_fullmap loads the built-in list on every invocation and passes it to fetch_prebuilt_fullmap and build_fullmap_pipeline; parsing --taxon-allowlist / --no-taxon-allowlist now fails as an unknown option (lock test in tests/test_cover_cli.py).
• Identity-gated reuse: a database already present at --output is reused only when its recorded identity equals the one the built-in list would record (src/tablassert/cli.py::fullmap_matches_allowlist); an unfiltered or unreadable leftover warns and falls through to rebuild instead of being trusted as-is.
• Lower-level seams unchanged: build_fullmap_pipeline, fetch_prebuilt_fullmap, and Rust build_fullmap_db keep taxon_allowlist=None as an explicitly-unfiltered option; only the CLI is unconditional.

Rust identity contract

• Prebuilt requirement: rs.extract_prebuilt_fullmap gained taxon_allowlist; extract_validate_rename checks the extracted primary's recorded identity BEFORE any rename, so a published unfiltered archive can never land — it surfaces as the existing PrebuiltFullmapUnavailable fallback to a filtered source build, with expected/recorded identities named in the message.
• Shared encoding: allowlist_set normalizes the ID list once for the build path, the extract requirement, and both probes, so the recorded identity and the compared identity cannot drift (non-positive IDs are ignored everywhere).
• New pyfunctions: taxon_allowlist_identity(ids) and fullmap_taxon_allowlist_identity(db) (best-effort None for absent/foreign/outdated/unreadable files — a rebuild trigger, not an error); registered in rust/src/lib.rs and typed in src/tablassert/rs.pyi.

Design

• The prebuilt download path is kept, not deleted: archives published per Tablassert version are built by that version's own defaults, and the identity check is the tripwire when they are not. Accepted caveat: until a filtered archive is published for a version, the default invocation downloads that version's unfiltered archive once, fails the check, then performs the full BABEL download + build (documented in docs/fullmap.md).
• Deferred: the reuse gate checks only the primary's identity; a matching primary with deleted sibling shards still short-circuits (pre-existing blind spot, unchanged).

Tests and documentation

• Coverage: real-seam Python tests (unfiltered archive rejected end-to-end, matching filtered archive installed and lookup-equal, reuse probe against real databases, flag-removal parser lock, allowlist threading through every seam) and three Rust integration tests (unfiltered rejected, differently-filtered rejected, matching installed with order/duplicate-insensitive identity); build_golden pins that both probes agree with the recorded META.
• Documentation: docs/cli.md (flag row and example removed, always-on prose, identity-gated reuse), docs/fullmap.md (build-command block, reuse-path bullets, meta table row), CHANGELOG.md (Unreleased, BREAKING), experimental_taxa.yaml header.

Testing

• uv run pytest → 1338 passed, 43 skipped
• uv run pyright → 0 errors, 0 warnings
• uv run ruff check . and uv run ruff format --check . → passed
• cargo test --manifest-path rust/Cargo.toml → 112 + 11 + 17 passed, 0 failed
• cargo clippy --all-targets -- -D warnings → passed
• cargo fmt --check → passed

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 3f0f302d-67fa-4753-b816-bc43abbc4fab

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}