feat(notification): add service-owned data-rights contributor

.env.example

@@ -8,17 +8,22 @@ REVIEW_SERVICE_PORT=4104
 AI_SERVICE_PORT=4105
 CALENDAR_SERVICE_PORT=4106
 INTEGRATION_SERVICE_PORT=4107
-DATABASE_URL=postgresql://lifeos:lifeos@postgres:5432/lifeos
-AI_DATABASE_URL=postgresql://lifeos:lifeos@postgres:5432/lifeos
-AI_TEST_DATABASE_URL=postgresql://lifeos:lifeos@postgres:5432/lifeos_test
+POSTGRES_PASSWORD=replace-with-local-postgres-password
+NOTIFICATION_RUNTIME_DATABASE_PASSWORD=replace-with-distinct-local-runtime-password
+DATABASE_URL=postgresql://lifeos:replace-with-local-postgres-password@postgres:5432/lifeos
+AI_DATABASE_URL=postgresql://lifeos:replace-with-local-postgres-password@postgres:5432/lifeos
+AI_TEST_DATABASE_URL=postgresql://lifeos:replace-with-local-postgres-password@postgres:5432/lifeos_test
 AI_DATABASE_POOL_MAX=10
 AI_DATABASE_CONNECT_TIMEOUT_MS=5000
 AI_DATABASE_IDLE_TIMEOUT_MS=30000
 AI_MODEL_REQUEST_TIMEOUT_MS=10000
 AI_PROPOSAL_MODEL=rule-based
 CONTEXTUAL_ORCHESTRATOR_TOKEN=
 CONTEXTUAL_ORCHESTRATOR_URL=
-NOTIFICATION_DATABASE_URL=postgresql://lifeos:lifeos@postgres:5432/lifeos
+NOTIFICATION_MIGRATION_DATABASE_URL=postgresql://lifeos:replace-with-local-postgres-password@postgres:5432/lifeos
+NOTIFICATION_DATABASE_RUNTIME_ROLE=lifeos_notification
+NOTIFICATION_DATABASE_URL=postgresql://lifeos_notification:replace-with-distinct-local-runtime-password@postgres:5432/lifeos
+NOTIFICATION_DATA_RIGHTS_CONTEXT_SECRET=replace-with-distinct-at-least-32-random-bytes
 NOTIFICATION_DATABASE_POOL_MAX=10
 NOTIFICATION_DATABASE_CONNECT_TIMEOUT_MS=5000
 NOTIFICATION_DATABASE_IDLE_TIMEOUT_MS=30000

.github/workflows/ci.yml

@@ -17,6 +17,9 @@ jobs:
   compose_runtime:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
+    env:
+      POSTGRES_PASSWORD: ci-${{ github.run_id }}-${{ github.run_attempt }}
+      NOTIFICATION_RUNTIME_DATABASE_PASSWORD: notification-ci-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
       - name: Checkout exact contributor head
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
@@ -33,14 +36,15 @@ jobs:
             trap - EXIT
             if [ "$status" -ne 0 ]; then
               docker compose ps --all || true
-              docker compose logs --no-color --timestamps --tail 200 postgres nats || true
+              docker compose logs --no-color --timestamps --tail 200 postgres nats notification-db-provision || true
             fi
             docker compose down --volumes --remove-orphans || true
             exit "$status"
           }
           trap cleanup EXIT
 
-          docker compose up --detach --wait --wait-timeout 90
+          docker compose up --detach --wait --wait-timeout 90 postgres nats
+          docker compose run --rm --no-deps notification-db-provision
           docker compose exec --no-TTY postgres psql -U lifeos -d lifeos -v ON_ERROR_STOP=1 -tAc 'SELECT 1' |
             grep -Fx 1
           curl --fail --silent --show-error --max-time 5 \
@@ -103,6 +107,8 @@ jobs:
       HABIT_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/life_os_test
       NOTIFICATION_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/life_os_test
       PRIVACY_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/life_os_test
+      POSTGRES_PASSWORD: ci-${{ github.run_id }}-${{ github.run_attempt }}
+      NOTIFICATION_RUNTIME_DATABASE_PASSWORD: notification-ci-${{ github.run_id }}-${{ github.run_attempt }}
     services:
       postgres:
         image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777

.github/workflows/deploy.yml

@@ -135,6 +135,8 @@ jobs:
           HABIT_DATABASE_URL: ${{ secrets.HABIT_DATABASE_URL }}
           AI_DATABASE_URL: ${{ secrets.AI_DATABASE_URL }}
           REVIEW_DATABASE_URL: ${{ secrets.REVIEW_DATABASE_URL }}
+          NOTIFICATION_MIGRATION_DATABASE_URL: ${{ secrets.NOTIFICATION_MIGRATION_DATABASE_URL }}
+          NOTIFICATION_DATABASE_RUNTIME_ROLE: ${{ vars.NOTIFICATION_DATABASE_RUNTIME_ROLE }}
         shell: bash
         run: |
           set -Eeuo pipefail

ARCHITECTURE.md

@@ -31,6 +31,7 @@ flowchart LR
     P --> PDB
     H --> HDB
     A --> ADB
+    NO[Notification service] --> NDB
 ```
 
 ### Required invariants
@@ -129,3 +130,31 @@ The pinned OpenCode configuration disables project-local overrides, explicitly r
 8. `CHANGELOG.md` — user-visible unreleased and released changes.
 
 A behavior or boundary change is incomplete until the relevant level is updated and executable tests prove the claim.
+
+## 7. Notification data-rights authority boundary
+
+Notification owns its reminder occurrences, immutable outcome history, in-app inbox messages, and the data-rights evidence needed to erase those records. A data-rights orchestrator may call the private versioned contributor contract, but it does not receive direct SQL authority over `notification_service` tables.
+
+```mermaid
+sequenceDiagram
+    participant O as Data-rights orchestrator
+    participant H as Notification private HTTP boundary
+    participant C as Notification contributor
+    participant DB as Notification PostgreSQL
+
+    O->>H: Signed method/path/workspace/user/request context
+    H->>H: Verify bounded authority and replay evidence
+    H->>C: Normalized contributor request
+    C->>DB: Tenant-scoped export/preflight/erase/verify query
+    DB-->>C: Bounded evidence or owner-controlled erasure receipt
+    C-->>H: Credential-free versioned response
+    H-->>O: Export page / blocker / erasure / verification evidence
+```
+
+The migration authority and Notification runtime identity are deliberately separate. The connection behind `NOTIFICATION_MIGRATION_DATABASE_URL` remains the established owner of the Notification schema and existing objects; later migrations fail closed if that ownership no longer matches. The runtime role owns no schema or erasure-control table and receives only reviewed table privileges plus the explicit erasure function/replay-store permissions needed by the contributor.
+
+Normal Notification inserts and updates take shared workspace advisory locks. Data-rights erasure takes the corresponding exclusive transaction lock, persists a terminal workspace fence before deletion, and uses backend+transaction+workspace-scoped authorization to permit the otherwise append-only outcome deletion. A write racing the erasure therefore either completes before the exclusive lock or observes the terminal fence and fails; it cannot survive after a committed erase.
+
+Export pagination is deterministic and bounded, but its current cursor is a live keyset position rather than a transactionally frozen snapshot. No documentation or API may claim snapshot-consistent multi-page portability until a durable export-session or equivalent versioned snapshot contract exists with concurrency tests.
+
+The repository contains a production-composable Notification server/runtime and Compose path. The current Kubernetes production reference still deploys only the web and gateway workloads; therefore this contributor is not evidence that Notification is deployed in the production reference. A release claiming end-to-end Notification data-rights support must first add and verify the corresponding workload, secret/configuration, network-policy, migration, rollout, and recovery path.

CHANGELOG.md

@@ -10,6 +10,7 @@ All notable changes to LifeOS are documented in this file.
 
 ### Added
 
+- A Notification-owned `life-os.data-rights-contributor.v1` boundary for deterministic tenant export pages, destructive-erasure preflight, atomic workspace erasure, exact replay, and post-erasure verification without exporting claim or raw idempotency material.
 - Durable PostgreSQL plugin-installation authority with opaque UUIDv4 installation/workspace/installer identity, exact manifest digests, normalized explicit grants, bounded conflict replay, and atomic revocation evidence in the service-owned `plugin_integration` schema.
 - An authenticated calendar-connection disconnect application and optional hosted HTTP composition boundary that derives workspace and requesting-user authority only from the signed `life-os.calendar-user.v1` context and returns credential-free local revocation evidence.
 - A durable PostgreSQL data-rights request ledger with workspace-scoped idempotency, immutable request and terminal receipt digests, one-way completion state, and real integration evidence that erasure receipts survive removal of the source workspace and user.
@@ -31,6 +32,7 @@ All notable changes to LifeOS are documented in this file.
 
 ### Fixed
 
+- Notification forward migrations now reject a changed migration owner before later DDL executes instead of attempting an unsupported implicit `OWNER TO CURRENT_USER` handoff against objects owned by the established migration authority.
 - The public Gateway Today endpoint now fails explicitly with bounded `today_composition_unavailable` problem details instead of returning fabricated successful composition data while authenticated Planning/Habit integration is absent; issue #163 remains open for the real composition path.
 - Data-rights request-ID and idempotency collisions now resolve through stable credential-free domain conflicts instead of exposing raw PostgreSQL uniqueness errors, including ambiguous dual-collision evidence.
 - The OpenCode development loop now prevents project settings from overriding its pinned offline NVIDIA model, records catalog failures accurately, parses the accepted candidate's exact Compose file outside the model account, and requires digest-pinned PostgreSQL queries plus NATS JetStream probes in pull-request CI.
@@ -43,6 +45,7 @@ All notable changes to LifeOS are documented in this file.
 
 ### Security
 
+- Notification migration credentials remain the established schema owner while the service runtime uses a separate least-privilege PostgreSQL role; owner-only erasure tables stay unavailable to the runtime and destructive deletion is reachable only through the reviewed function/replay contract.
 - Habit create/list/occurrence/completion routes now reject a bare client-selected `x-workspace-id` authority and require the short-lived signed `life-os.workspace.v1` gateway context before domain access.
 - Plugin installation lookup, conflict replay, and revocation now carry authenticated workspace and installing-user authority through the PostgreSQL boundary; the durable record contains no plaintext plugin secret, token, credential, or password material.
 - Calendar local disconnect never accepts client-selected ownership as authority, never reads provider secret handles, revalidates durable revocation evidence against the signed workspace+user context, and maps absent or differently owned connections to the same public not-found result.

README.md

@@ -57,6 +57,19 @@ docker compose up -d
 pnpm dev
 ```
 
+`POSTGRES_PASSWORD` and `NOTIFICATION_RUNTIME_DATABASE_PASSWORD` are required local credentials. Keep them distinct and replace the example placeholders before Compose startup. New local volumes never fall back to the historical public `lifeos` administrator password.
+
+Existing PostgreSQL volumes created before explicit local credential provisioning may still store the historical `lifeos` administrator password. Do not delete those volumes to upgrade and do not restore the old Compose fallback. Supply the current stored password only through `LEGACY_POSTGRES_PASSWORD`, set a new `POSTGRES_PASSWORD`, keep a distinct `NOTIFICATION_RUNTIME_DATABASE_PASSWORD`, and run the bounded rotation path once:
+
+```bash
+LEGACY_POSTGRES_PASSWORD='<current legacy password>' \
+POSTGRES_PASSWORD='<new local administrator password>' \
+NOTIFICATION_RUNTIME_DATABASE_PASSWORD='<distinct runtime password>' \
+infra/postgres/provision/upgrade-legacy-local.sh
+```
+
+The upgrade script starts the existing volume without changing its stored role, authenticates with the operator-supplied legacy credential, rotates the `lifeos` administrator inside PostgreSQL, verifies the new credential, and then provisions the least-privilege Notification runtime role. After it succeeds, persist the new values in your untracked `.env`; `LEGACY_POSTGRES_PASSWORD` is no longer needed.
+
 Default endpoints:
 
 - Web: `http://localhost:3000`