feat(planning): add durable Today synchronization

.github/workflows/ci.yml

@@ -47,6 +47,48 @@ jobs:
             jq -e '(.streams | type) == "number" and (.consumers | type) == "number"' \
               >/dev/null
 
+  today-concurrency:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      PLANNING_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/life_os_test
+    services:
+      postgres:
+        image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
+        env:
+          POSTGRES_DB: life_os_test
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres -d life_os_test"
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - name: Checkout exact contributor head
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Install reproducible dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run Today concurrency regression
+        run: >-
+          pnpm --filter @life-os/planning-service exec vitest run
+          tests/postgres-today-lock-order.integration.test.ts
+
   validate:
     needs: compose_runtime
     runs-on: ubuntu-latest
@@ -128,3 +170,29 @@ jobs:
 
       - name: Validate Compose
         run: docker compose config --quiet
+
+  browser-acceptance:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Install reproducible dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Install Chromium for Playwright
+        run: pnpm --filter @life-os/web exec playwright install --with-deps chromium
+
+      - name: Run browser journey acceptance
+        run: pnpm --filter @life-os/web test:e2e

CHANGELOG.md

@@ -6,6 +6,8 @@ All notable changes to LifeOS are documented in this file.
 
 ### Added
 
+- A durable PostgreSQL data-rights request ledger with workspace-scoped idempotency, immutable request and terminal receipt digests, one-way completion state, and real integration evidence that erasure receipts survive removal of the source workspace and user.
+- Migration `0006_data_rights_request_ledger.sql` for the service-owned identity ledger, retaining only bounded opaque authority references and digest/status/timestamp evidence rather than exported personal payloads.
 - An hourly and manually dispatchable NVIDIA NIM live-conformance harness that pins contextual-orchestrator to an exact reviewed commit, compares strong single-route reasoning with bounded conducted workflows, and retains only validated credential-free quality, safety, orchestration, usage, and ablation evidence.
 - A versioned, immutable AI proposal quality evaluator that separates production validity, semantic operation conformance, evidence grounding, benign utility, forbidden-text leakage, and prompt-injection resistance across realistic English, Korean, temporal, empty-context, completed-item, and adversarial fixtures.
 - An explicit `contextual-orchestrator` proposal-model mode with bounded OpenAI-compatible transport, strict structured output, model provenance, and an independent local rule-based default.
@@ -23,6 +25,7 @@ All notable changes to LifeOS are documented in this file.
 
 ### Fixed
 
+- Data-rights request-ID and idempotency collisions now resolve through stable credential-free domain conflicts instead of exposing raw PostgreSQL uniqueness errors, including ambiguous dual-collision evidence.
 - The OpenCode development loop now prevents project settings from overriding its pinned offline NVIDIA model, records catalog failures accurately, parses the accepted candidate's exact Compose file outside the model account, and requires digest-pinned PostgreSQL queries plus NATS JetStream probes in pull-request CI.
 - Live contextual-orchestrator responses now classify successful empty bodies as evaluation failures, emit exactly one terminal observation, canonicalize retained timestamps safely, and preserve null metric denominators instead of fabricating deltas.
 - Stale AI proposal revision conflicts now belong to the technology-independent audit domain while the PostgreSQL adapter preserves its compatibility export.
@@ -33,6 +36,7 @@ All notable changes to LifeOS are documented in this file.
 
 ### Security
 
+- The data-rights request ledger keeps personal export payloads out of durable audit rows and normalizes primary-key/idempotency collisions before dependency errors can escape the service boundary.
 - The commercial-development model account no longer performs Docker commands, never receives Docker-socket authority, and cannot trigger provider-wide model discovery through the credential bridge.
 - The scheduled live-model harness uses only `NVIDIA_NIM_API_KEY`, seeds it through the encrypted contextual-orchestrator credential registry, installs hash-locked dependencies from an exact commit, confines LifeOS traffic to loopback, allowlists NVIDIA NIM egress, and excludes provider credentials, prompts, responses, traces, and hidden reasoning from retained artifacts.
 - Proposal quality reports now discard nested model failures and response bodies, normalize labeled sentinel checks, expose no provider credential or mutation dependency, and measure prompt-injection resistance together with benign utility instead of rewarding blanket refusal.

apps/identity-service/migrations/0006_data_rights_request_ledger.sql

@@ -0,0 +1,59 @@
+CREATE TABLE identity.data_rights_requests (
+  request_id uuid PRIMARY KEY,
+  -- Deliberately not a foreign key: completed request evidence must survive
+  -- source-workspace erasure for bounded audit and reconciliation retention.
+  workspace_id uuid NOT NULL,
+  -- Deliberately not a foreign key: erasing the identity source record must
+  -- neither delete this receipt nor make user erasure impossible.
+  requested_by_user_id uuid NOT NULL,
+  request_kind text NOT NULL,
+  idempotency_key uuid NOT NULL,
+  request_digest character(64) NOT NULL,
+  request_status text NOT NULL DEFAULT 'pending',
+  receipt_digest character(64),
+  requested_at timestamptz NOT NULL,
+  completed_at timestamptz,
+  CONSTRAINT data_rights_request_kind_valid
+    CHECK (request_kind IN ('export', 'erasure')),
+  CONSTRAINT data_rights_request_digest_valid
+    CHECK (request_digest ~ '^[0-9a-f]{64}$'),
+  CONSTRAINT data_rights_request_status_valid
+    CHECK (request_status IN ('pending', 'completed')),
+  CONSTRAINT data_rights_receipt_digest_valid
+    CHECK (receipt_digest IS NULL OR receipt_digest ~ '^[0-9a-f]{64}$'),
+  CONSTRAINT data_rights_request_completion_consistent
+    CHECK (
+      (request_status = 'pending' AND receipt_digest IS NULL AND completed_at IS NULL)
+      OR
+      (request_status = 'completed' AND receipt_digest IS NOT NULL AND completed_at IS NOT NULL)
+    ),
+  CONSTRAINT data_rights_request_time_order
+    CHECK (completed_at IS NULL OR completed_at >= requested_at),
+  CONSTRAINT data_rights_workspace_idempotency_unique
+    UNIQUE (workspace_id, idempotency_key)
+);
+
+CREATE FUNCTION identity.preserve_completed_data_rights_receipt()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  IF OLD.request_status = 'completed'
+     AND (
+       NEW.request_status IS DISTINCT FROM OLD.request_status
+       OR NEW.receipt_digest IS DISTINCT FROM OLD.receipt_digest
+       OR NEW.completed_at IS DISTINCT FROM OLD.completed_at
+     ) THEN
+    RETURN NULL;
+  END IF;
+  RETURN NEW;
+END;
+$$;
+
+CREATE TRIGGER data_rights_receipt_immutable_guard
+  BEFORE UPDATE ON identity.data_rights_requests
+  FOR EACH ROW
+  EXECUTE FUNCTION identity.preserve_completed_data_rights_receipt();
+
+CREATE INDEX data_rights_requests_workspace_time_idx
+  ON identity.data_rights_requests (workspace_id, requested_at DESC);

apps/identity-service/src/data-rights-authenticated-application.test.ts

@@ -0,0 +1,82 @@
+import { describe, expect, it } from 'vitest';
+
+const SESSION_BODY = Object.freeze({
+  sessionId: '11111111-1111-4111-8111-111111111111',
+  userId: '22222222-2222-4222-8222-222222222222',
+  workspaceId: '33333333-3333-4333-8333-333333333333',
+  authenticatedAt: '2026-08-09T17:55:00.000Z',
+  createdAt: '2026-08-09T17:56:00.000Z',
+  expiresAt: '2026-08-10T17:56:00.000Z',
+});
+
+interface AuthenticatedApplicationConstructor {
+  new (
+    sessions: {
+      introspectSession(cookieHeader: string | undefined): Promise<{
+        statusCode: 200;
+        body: typeof SESSION_BODY;
+      }>;
+    },
+    dataRights: {
+      exportWorkspace(context: {
+        readonly workspaceId: string;
+        readonly actorUserId: string;
+      }): Promise<unknown>;
+    },
+    options: {
+      readonly now: () => Date;
+      readonly maximumAgeMs: number;
+    },
+  ): {
+    exportWorkspace(cookieHeader: string | undefined): Promise<unknown>;
+  };
+}
+
+async function applicationConstructor(): Promise<AuthenticatedApplicationConstructor> {
+  const modulePath = './data-rights-authenticated-application';
+  const module = (await import(modulePath).catch(() => ({}))) as Readonly<
+    Record<string, unknown>
+  >;
+  expect(typeof module.AuthenticatedDataRightsApplication).toBe('function');
+  return module.AuthenticatedDataRightsApplication as AuthenticatedApplicationConstructor;
+}
+
+describe('AuthenticatedDataRightsApplication', () => {
+  it('derives export ownership only from the authenticated recent session', async () => {
+    const AuthenticatedDataRightsApplication = await applicationConstructor();
+    const contexts: unknown[] = [];
+    const sessions = {
+      async introspectSession(cookieHeader: string | undefined) {
+        expect(cookieHeader).toBe('life_os_session=opaque-session');
+        return { statusCode: 200 as const, body: SESSION_BODY };
+      },
+    };
+    const dataRights = {
+      async exportWorkspace(context: {
+        readonly workspaceId: string;
+        readonly actorUserId: string;
+      }) {
+        contexts.push(context);
+        return { schemaVersion: 'life-os.data-export.v1' };
+      },
+    };
+    const application = new AuthenticatedDataRightsApplication(
+      sessions,
+      dataRights,
+      {
+        now: () => new Date('2026-08-09T18:00:00.000Z'),
+        maximumAgeMs: 10 * 60 * 1000,
+      },
+    );
+
+    await expect(
+      application.exportWorkspace('life_os_session=opaque-session'),
+    ).resolves.toEqual({ schemaVersion: 'life-os.data-export.v1' });
+    expect(contexts).toEqual([
+      {
+        workspaceId: SESSION_BODY.workspaceId,
+        actorUserId: SESSION_BODY.userId,
+      },
+    ]);
+  });
+});

apps/identity-service/src/data-rights-authenticated-application.ts

@@ -0,0 +1,58 @@
+import type { DataRightsWorkspaceContext } from './data-rights';
+import { requireRecentAuthentication } from './oauth-http-boundary';
+
+interface SessionView {
+  readonly userId: string;
+  readonly workspaceId: string;
+  readonly authenticatedAt: string;
+}
+
+interface SessionIntrospectionApplication {
+  introspectSession(cookieHeader: string | undefined): Promise<{
+    readonly statusCode: number;
+    readonly body: SessionView;
+  }>;
+}
+
+interface DataRightsExportApplication {
+  exportWorkspace(context: DataRightsWorkspaceContext): Promise<unknown>;
+}
+
+interface RecentAuthenticationOptions {
+  readonly now: () => Date;
+  readonly maximumAgeMs: number;
+}
+
+/**
+ * Establishes the authenticated application boundary for data-rights exports.
+ * Workspace and actor ownership are derived exclusively from the opaque session,
+ * and the request is rejected before data-rights work when authentication is stale.
+ */
+export class AuthenticatedDataRightsApplication {
+  constructor(
+    private readonly sessions: SessionIntrospectionApplication,
+    private readonly dataRights: DataRightsExportApplication,
+    private readonly options: RecentAuthenticationOptions,
+  ) {}
+
+  /**
+   * Exports the session-owned workspace after enforcing the configured recent-authentication window.
+   */
+  async exportWorkspace(cookieHeader: string | undefined): Promise<unknown> {
+    const session = await this.sessions.introspectSession(cookieHeader);
+    if (session.statusCode !== 200) {
+      throw new Error('Authentication is required');
+    }
+    requireRecentAuthentication({
+      authenticatedAt: session.body.authenticatedAt,
+      now: this.options.now(),
+      maximumAgeMs: this.options.maximumAgeMs,
+    });
+    return this.dataRights.exportWorkspace(
+      Object.freeze({
+        workspaceId: session.body.workspaceId,
+        actorUserId: session.body.userId,
+      }),
+    );
+  }
+}

apps/identity-service/src/data-rights-recent-auth.test.ts

@@ -0,0 +1,75 @@
+import { describe, expect, it } from 'vitest';
+import * as oauthBoundary from './oauth-http-boundary';
+
+type RecentAuthenticationGate = (input: {
+  readonly authenticatedAt: string;
+  readonly now: Date;
+  readonly maximumAgeMs: number;
+}) => string;
+
+function recentAuthenticationGate(): RecentAuthenticationGate {
+  const candidate = (
+    oauthBoundary as unknown as Readonly<Record<string, unknown>>
+  ).requireRecentAuthentication;
+  expect(typeof candidate).toBe('function');
+  return candidate as RecentAuthenticationGate;
+}
+
+describe('data-rights recent authentication gate', () => {
+  it('accepts an authentication instant at the exact maximum age boundary', () => {
+    const requireRecentAuthentication = recentAuthenticationGate();
+
+    expect(
+      requireRecentAuthentication({
+        authenticatedAt: '2026-08-09T17:50:00.000Z',
+        now: new Date('2026-08-09T18:00:00.000Z'),
+        maximumAgeMs: 10 * 60 * 1000,
+      }),
+    ).toBe('2026-08-09T17:50:00.000Z');
+  });
+
+  it('rejects a stale authentication instant even when the session itself is still valid', () => {
+    const requireRecentAuthentication = recentAuthenticationGate();
+
+    expect(() =>
+      requireRecentAuthentication({
+        authenticatedAt: '2026-08-09T17:49:59.999Z',
+        now: new Date('2026-08-09T18:00:00.000Z'),
+        maximumAgeMs: 10 * 60 * 1000,
+      }),
+    ).toThrow('Recent authentication is required');
+  });
+
+  it('fails closed on future, malformed, or invalid policy timestamps', () => {
+    const requireRecentAuthentication = recentAuthenticationGate();
+
+    expect(() =>
+      requireRecentAuthentication({
+        authenticatedAt: '2026-08-09T18:00:00.001Z',
+        now: new Date('2026-08-09T18:00:00.000Z'),
+        maximumAgeMs: 10 * 60 * 1000,
+      }),
+    ).toThrow('Authentication provenance is invalid');
+    expect(() =>
+      requireRecentAuthentication({
+        authenticatedAt: 'not-an-instant',
+        now: new Date('2026-08-09T18:00:00.000Z'),
+        maximumAgeMs: 10 * 60 * 1000,
+      }),
+    ).toThrow('Authentication provenance is invalid');
+    expect(() =>
+      requireRecentAuthentication({
+        authenticatedAt: '2026-08-09T17:55:00.000Z',
+        now: new Date('invalid'),
+        maximumAgeMs: 10 * 60 * 1000,
+      }),
+    ).toThrow('Recent authentication policy is invalid');
+    expect(() =>
+      requireRecentAuthentication({
+        authenticatedAt: '2026-08-09T17:55:00.000Z',
+        now: new Date('2026-08-09T18:00:00.000Z'),
+        maximumAgeMs: 0,
+      }),
+    ).toThrow('Recent authentication policy is invalid');
+  });
+});