feat(planning): own atomic task completion transition

apps/planning-service/src/postgres-planning-repository.integration.test.ts

@@ -15,6 +15,7 @@ import {
   createPlanningRuntime,
   type PlanningRuntime,
 } from './planning-runtime';
+import { PostgresTaskCompletionRepository } from './task-completion';
 import {
   TodayIdempotencyConflictError,
   TodayRevisionConflictError,
@@ -37,6 +38,9 @@ async function applyMigrations(pool: Pool): Promise<void> {
     '0001_initial_planning.sql',
     '0002_durable_repository_contract.sql',
     '0003_durable_today_sync.sql',
+    '0004_data_rights_erasure_receipts.sql',
+    '0005_task_completion_chronology.sql',
+    '0006_validate_task_completion_chronology.sql',
   ]) {
     const sql = await readFile(
       resolve(__dirname, '../migrations', migration),
@@ -92,6 +96,7 @@ describeWithPostgres('PostgreSQL Planning repository integration', () => {
       `TRUNCATE
          planning.today_idempotency_records,
          planning.today_aggregates,
+         planning.data_rights_erasure_receipts,
          planning.tasks,
          planning.projects,
          planning.goals`,
@@ -259,6 +264,71 @@ describeWithPostgres('PostgreSQL Planning repository integration', () => {
     ).resolves.toEqual([]);
   });
 
+  it('executes retry-stable task completion chronology in PostgreSQL', async () => {
+    const workspaceId = randomUUID();
+    const runtime = createRuntime();
+    const goal = await runtime.service.createGoal(workspaceId, {
+      title: 'Completion chronology goal',
+    });
+    const project = await runtime.service.createProject(workspaceId, {
+      goalId: goal.id,
+      title: 'Completion chronology project',
+    });
+    const task = await runtime.service.createTask(workspaceId, {
+      projectId: project.id,
+      title: 'Completion chronology task',
+    });
+    const repository = new PostgresTaskCompletionRepository({
+      async query<Row>(text: string, values: readonly unknown[]) {
+        const result = await administrativePool.query(text, [...values]);
+        return { rows: result.rows as Row[] };
+      },
+    });
+    const taskCreatedAt = new Date(task.createdAt);
+    const skewedFirstRequestAt = new Date(
+      taskCreatedAt.getTime() - 60_000,
+    ).toISOString();
+    const retriedAt = new Date(taskCreatedAt.getTime() + 60_000).toISOString();
+    const resumedCompletedAt = new Date(
+      taskCreatedAt.getTime() + 120_000,
+    ).toISOString();
+
+    const first = await repository.transitionTaskCompletion(
+      workspaceId,
+      task.id,
+      { status: 'done', completedAt: skewedFirstRequestAt },
+    );
+    const retry = await repository.transitionTaskCompletion(
+      workspaceId,
+      task.id,
+      { status: 'done', completedAt: retriedAt },
+    );
+    const reopened = await repository.transitionTaskCompletion(
+      workspaceId,
+      task.id,
+      { status: 'todo', completedAt: null },
+    );
+    const recompleted = await repository.transitionTaskCompletion(
+      workspaceId,
+      task.id,
+      { status: 'done', completedAt: resumedCompletedAt },
+    );
+
+    expect(first?.completedAt).toBe(task.createdAt);
+    expect(retry?.completedAt).toBe(task.createdAt);
+    expect(reopened).toMatchObject({ status: 'todo', completedAt: null });
+    expect(recompleted?.completedAt).toBe(resumedCompletedAt);
+
+    await expect(
+      administrativePool.query(
+        `UPDATE planning.tasks
+         SET status = 'todo', completed_at = $2::timestamptz
+         WHERE id = $1`,
+        [task.id, resumedCompletedAt],
+      ),
+    ).rejects.toMatchObject({ code: '23514' });
+  });
+
   it('persists Today across restarts while isolating workspaces', async () => {
     const workspaceId = randomUUID();
     const otherWorkspaceId = randomUUID();

apps/planning-service/src/task-completion-hostile-evidence.test.ts

@@ -0,0 +1,125 @@
+import { describe, expect, it } from 'vitest';
+import {
+  PostgresTaskCompletionRepository,
+  TaskCompletionPersistenceError,
+  type TaskCompletionEvidence,
+  type TaskCompletionRepository,
+  TaskCompletionService,
+  type TaskCompletionSqlClient,
+  type TaskCompletionSqlQueryResult,
+} from './task-completion';
+
+const WORKSPACE_ID = '11111111-1111-4111-8111-111111111111';
+const TASK_ID = '44444444-4444-4444-8444-444444444444';
+const COMPLETED_AT = '2026-09-10T16:00:00.000Z';
+
+function revokedProxy<T extends object>(value: T): T {
+  const { proxy, revoke } = Proxy.revocable(value, {});
+  revoke();
+  return proxy;
+}
+
+async function expectCredentialFreePersistenceFailure(
+  operation: Promise<unknown>,
+): Promise<void> {
+  const error = await operation.catch((caught: unknown) => caught);
+  expect(error).toBeInstanceOf(TaskCompletionPersistenceError);
+  expect(error).toMatchObject({
+    message: 'Persisted task completion data is invalid',
+  });
+}
+
+describe('task completion hostile persistence evidence', () => {
+  it('collapses a rejected repository dependency without reflecting backend detail', async () => {
+    const sentinel = 'password=must-not-escape-task-completion-dependency';
+    const repository: TaskCompletionRepository = {
+      async transitionTaskCompletion() {
+        throw new Error(sentinel);
+      },
+    };
+    const service = new TaskCompletionService(
+      repository,
+      () => new Date(COMPLETED_AT),
+    );
+
+    await expectCredentialFreePersistenceFailure(
+      service.setCompleted(WORKSPACE_ID, TASK_ID, true),
+    );
+  });
+
+  it('collapses revoked producer evidence before reading authority fields', async () => {
+    const repository: TaskCompletionRepository = {
+      async transitionTaskCompletion() {
+        return revokedProxy({
+          workspaceId: WORKSPACE_ID,
+          taskId: TASK_ID,
+          status: 'done' as const,
+          completedAt: COMPLETED_AT,
+        }) as TaskCompletionEvidence;
+      },
+    };
+    const service = new TaskCompletionService(
+      repository,
+      () => new Date(COMPLETED_AT),
+    );
+
+    await expectCredentialFreePersistenceFailure(
+      service.setCompleted(WORKSPACE_ID, TASK_ID, true),
+    );
+  });
+
+  it('collapses a rejected SQL dependency without reflecting backend detail', async () => {
+    const sentinel = 'postgres=must-not-escape-task-completion-dependency';
+    const client: TaskCompletionSqlClient = {
+      async query<Row>(): Promise<TaskCompletionSqlQueryResult<Row>> {
+        throw new Error(sentinel);
+      },
+    };
+    const repository = new PostgresTaskCompletionRepository(client);
+
+    await expectCredentialFreePersistenceFailure(
+      repository.transitionTaskCompletion(WORKSPACE_ID, TASK_ID, {
+        status: 'done',
+        completedAt: COMPLETED_AT,
+      }),
+    );
+  });
+
+  it('collapses revoked SQL result envelopes before reading rows', async () => {
+    const client: TaskCompletionSqlClient = {
+      async query<Row>(): Promise<TaskCompletionSqlQueryResult<Row>> {
+        return revokedProxy({ rows: [] }) as TaskCompletionSqlQueryResult<Row>;
+      },
+    };
+    const repository = new PostgresTaskCompletionRepository(client);
+
+    await expectCredentialFreePersistenceFailure(
+      repository.transitionTaskCompletion(WORKSPACE_ID, TASK_ID, {
+        status: 'done',
+        completedAt: COMPLETED_AT,
+      }),
+    );
+  });
+
+  it('collapses revoked SQL rows before reading durable authority fields', async () => {
+    const row = revokedProxy({
+      workspace_id: WORKSPACE_ID,
+      id: TASK_ID,
+      status: 'done',
+      completed_at: COMPLETED_AT,
+    });
+    const client: TaskCompletionSqlClient = {
+      async query<Row>(): Promise<TaskCompletionSqlQueryResult<Row>> {
+        return { rows: [row as Row] };
+      },
+    };
+    const repository = new PostgresTaskCompletionRepository(client);
+
+    await expectCredentialFreePersistenceFailure(
+      repository.transitionTaskCompletion(WORKSPACE_ID, TASK_ID, {
+        status: 'done',
+        completedAt: COMPLETED_AT,
+      }),
+    );
+  });
+});