Repository navigation
feat(db): add dormant R2-B2-A capture preparation - #17
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Add the dormant R2-B2-A SQL boundary between genuine accepted first-capture intent and later financial application. SQL binds P-B/P-C/B1 authority and derives the exact principal, cumulative fee and expected effects; preparation, financial effects, source clearance and terminal capture writes cannot commit before B2-B installs complete validators.
No B2-B/B2-C, monetary-policy change, historical migration edit, runtime writer, scope activation or production installation is included.
Review guide
0015_capture_application_preparation.sql, especiallycapture_preparation_sources,prepare_capture_application, issuance/permit readers and the independent deferred commit guards. Check equivalent bound capture evidence against independent blockers and P-B historical cause recognition.RUN_F01_PENDINGcases remain gated and are not claimed fixed.Task size
T2 / HIGH_RISK — LedgerFlow R2-B2-A.
Preserve the canonical CAPTURE terminal identity, immutable accepted command/proof ownership, exact principal/currency/account/policy/epoch, claim fencing, current source revisions, cumulative fee policy and transaction/backend/session permit. Preparation takes own inbox → configured account SHARE → canonical advisory/scope → payment NO KEY UPDATE → ordered attempts. It reuses P-B's protected claim witness and restricted owner.
Only a bounded nonterminal claim may commit separately. Preparation is inspect-and-ROLLBACK only: financial consumers refuse CAPTURE, and independent deferred guards reject preparation COMMIT even when all application/effect groups are omitted. B2-B owns complete atomic financial application; B2-C owns acknowledgment/recovery.
Checks
Local execution is separate from hosted CI.
pnpm lintpnpm testpnpm buildpnpm typechecknode scripts/sync-agent-skills.mjs --checknode scripts/check-engineering-workflow.mjspnpm test:verificationnode scripts/check-migration-history.mjs origin/main HEADnode scripts/check-pr-review-signals.mjs origin/main HEADpnpm test:integration:dockergit diff --checkand source-content bridged5d7e518e67b828779b649a77a019cafd5ff348c: both Node jobs passed all checks; PostgreSQL 17 passed 1,325 / failed 0 / 6 existing gated skips; migration-history and review-signal jobs passedUnverified boundaries
No actual Stripe/test-mode entitlement, RabbitMQ/Redis runtime, mixed-version writer floor, production credential/session fence, deployment, installation or activation was exercised. Subsequent shared-PI captures, capture failure authority, acknowledgment/recovery and runtime finality remain closed. F01/F04/F05/F06 closure is not claimed.
Review
The human accepted the original independent implementation review, native security review and verification evidence, then separately authorized this commit/push/PR. Original full-source fingerprint:
6a32d1f2fca10f50f1b5ea48bff6c9a3bad67de7b9ea5ee564be186d739bb4c9./root/b2a_code_review: REVIEW_APPROVED; no P0/P1 or acceptance-blocking P2./root/b2a_security_review: no blocking security findings. Native review was explicitly selected by the human; no Claude/external review is claimed./root/b2a_publication_review: REVIEW_APPROVED; no P0/P1/P2 findings ond5d7e518e67b828779b649a77a019cafd5ff348c. Independently reconstructed the original accepted fingerprint using the current actual source bytes/modes and original Git metadata; it matches exactly.Engineering workflow
r2-b2-areached HUMAN_APPROVAL with a READY guard before the human-authorized commit. Accepted evidence is preserved unchanged. Git metadata necessarily changes on commit; the separate content-only hash across all 588 source files remains0e5d594e727b5fdce11a461e62a42e5f3d48e2004187e047321fd9e4a8e4e2a3.Docs and temporary files
Updated existing owners:
docs/database-design.md,docs/payment-lifecycle.md,docs/concurrency.md. Consulted approved accounting contract §16, H01–H12/D01 and accepted R2 design/capture preflight.Keep ignored
.tmp/agent-workflows/r2-b2-a/state, plan, immutable reviews, verification/final-check evidence and finalization handoff until merge/finalization. Preserve the original design artifacts and PR draft under the task's ignored directory. The initial failed exploratory Docker-run evidence remains per runner policy; the successful run and local PostgreSQL 18 resources were cleaned up. No permanent audit report is added.Human review required. Do not auto-merge or activate financial writers.