feat(integration): add durable plugin delivery control lifecycle

[seonghobae]

Current exact authority — 2026-09-19

Current #256 exact is db235ac88a751a50844e4e377a02d4d933dc2138, open/Draft/mergeable on workflow-free parent #255@76eb8c89e1b507d73f50199243ca2c4b6bab63ad.

#255 parent adoption is present through ordinary non-force ancestry. The first current-parent verification exact 9e4e514427616f13ee8facb25c71cf78c376fa2a / run 35399863025 failed before product evidence because the focused formatting step sent SQL migrations through Prettier. Verifier-only repair exact cbb31e223e22d858b8d56b7b0815386a8004b66c removed only that unsupported SQL/Prettier coupling while retaining git diff --check and real-PostgreSQL acceptance.

Verify Plugin Delivery Control Restack run 35420326325 is now exact-head GREEN. Ubuntu 24.04/PostgreSQL 16 initialization, exact checkout, Node 24, frozen install, Plugin SDK build, focused TypeScript formatting, diff hygiene, adopted outcome acceptance, control lifecycle/chronology acceptance, Integration typecheck and the complete Integration service suite all completed successfully. Current descendant db235ac... removes only the now-purpose-complete restack verifier; production migrations, control application/repository code and retained regressions are unchanged.

#257 has therefore moved to the adoption phase rather than inheriting the old GREEN by assertion. Its historical tree first adopted db235ac... by ordinary non-force ancestry, and a corrective descendant restored the verified #256 parent tree while preserving only #257-owned execution-fence files. A fresh #257 restack verifier now reacquires child evidence on that combined tree before any further descendant transition.

Buyer gap and durable boundary

This PR advances #130 after #255 with the LifeOS-owned pause/resume/dead-letter authority before provider execution. It remains Integration-owned and does not grant outbound HTTPS, provider credentials, destination authority, or a second persistence owner.

Accepted control transitions increment monotonic durable control_sequence and append one sanitized life-os.plugin-delivery-attempt-control.v1 row in the same PostgreSQL update transaction. Sequence chronology is non-decreasing in durable time. The ledger contains only opaque delivery/workspace/requester identity, control sequence/code/status and lifecycle instants. Provider payload/body, credentials, origin copy, claim token/digest, network destination and outbound authority are excluded. Direct forged inserts and UPDATE/DELETE/TRUNCATE mutation of accepted control evidence fail closed.

Earlier hosted RED→GREEN evidence established pause/resume/dead-letter acceptance, active-claim refusal, terminal-exhaustion dead-lettering, source-bound append-only evidence and a separate backdated-control chronology guard. Those child-owned contracts remain retained; current exact db235ac... is the workflow-free parent proven after current #255 ancestry adoption.

Keep Draft. No self-approval, bypass merge, force push, destructive rebase, source copy, cross-service SQL, mutable dependency or gate weakening.

Refs #130 #252 #253 #254 #255 #257.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current exact authority override — 2026-09-19

#255 settled its parent-adoption verifier at 98c7add7599cdfd42a37a8ede5e078f52007418b / run 35366646703 GREEN, then retired only that purpose verifier at workflow-free 76eb8c89e1b507d73f50199243ca2c4b6bab63ad.

#291 normally merged that current #255 lineage into this branch without force push or rebase. The adoption merge is 35d5fb934a90cc0e143999c4b41ea19782747d09; child-owned control-lifecycle migrations 0010/0011 and control application/repository/regressions remain owned here.

Current exact is 9e4e514427616f13ee8facb25c71cf78c376fa2a, which adds only the bounded Verify Plugin Delivery Control Restack evidence workflow after the ancestry move. Authority run 35399863025 is non-terminal. It rechecks inherited outcome acceptance, control lifecycle/chronology acceptance, Integration typecheck, and the complete Integration suite. Do not transfer predecessor #256 GREEN across the parent movement or retire this verifier until that exact run is terminal GREEN. Keep Draft.

[seonghobae]

RCA for predecessor exact 9e4e514427616f13ee8facb25c71cf78c376fa2a: run 35399863025 was not a control-lifecycle product RED. PostgreSQL, exact checkout, Node 24, frozen install and Plugin SDK build passed; the verifier stopped at formatting because Prettier 3.9.6 cannot infer a parser for the two .sql migrations, so every acceptance/typecheck/full-suite step was skipped. Current exact cbb31e223e22d858b8d56b7b0815386a8004b66c repairs only that verifier defect: Prettier remains exact over the TypeScript outcome/control surface, the existing repository-wide git diff --check HEAD^ still covers whitespace hygiene, and the PostgreSQL acceptance steps remain responsible for migration syntax/behavior. No production source, migration, fixture, threshold or acceptance assertion changed. Do not transfer GREEN from any predecessor; reacquire the unchanged adopted-outcome/control/typecheck/full-suite evidence on this exact before verifier retirement or #257 restack.