feat(audit): add bounded stable export pages

[seonghobae]

Linearized replacement for #64

This draft is intentionally stacked after PR #63 exact base c213fc549dbf024da43b459df29c0616cd741c96 on agent/checkpoint-migration-operator. It supersedes and replaces now-closed sibling-stack PR #64, preventing competing writers, overlapping integration paths, and duplicate ADR 0010 numbering.

Strict RED → GREEN → REFACTOR evidence

RED was established on this branch before production changes at exact head b623b8fc9b1ee21af9f1a5ba72f1e045dcf5711b. Exact-source-head CI run 31154004207 failed in Python 3.10/3.12/3.14 and coverage during test collection because the new tests imported intentionally absent MAX_CHECKPOINT_AUDIT_EVENT_ID, CheckpointAuditPage, and cursor/page APIs. Container and live checkpoint-audit PostgreSQL jobs remained green, and Release Acceptance 31154004206 completed successfully; the failing CI is retained only as RED evidence and is not success evidence.

Production now enforces signed PostgreSQL BIGINT audit identity compatibility, immutable strictly descending CheckpointAuditPage values, strict non-coercive keyset cursor validation, tenant/consumer/endpoint/batch row-key revalidation, one-row bounded lookahead, checkpoint_audit_event_id < before_audit_event_id continuation, fail-closed malformed/overrun driver output, and package-owned reads without an explicit commit. Existing list_audit_events() remains unchanged.

The live least-privilege PostgreSQL regression reads page one, commits a newer accepted-save event in a separate transaction, then proves page two continues strictly toward older identities without duplicating page-one rows or admitting the newer row. Package-owned multi-page traversal deliberately does not claim one historic snapshot; hosts requiring that guarantee must start a caller-owned PostgreSQL REPEATABLE READ or stricter transaction before the first query and reuse list_audit_event_page_in_transaction().

Authoritative contracts are synchronized in AGENTS.md, CLAUDE.md, ARCHITECTURE.md, CHANGELOG.md, docs/checkpoint-audit.md, ADR 0011, and docs/doctoring/checkpoint-audit-export-pagination.md. Doctoring records APA 7 references to NIST SP 800-53 Rev. 5 Release 5.2.0 / AU-9 and PostgreSQL 18 transaction-isolation/concurrency documentation. The cursor is explicitly navigation state, not completeness, chronology, authenticity, delivery, non-repudiation, or release evidence. External immutable/WORM retention, receipts, manifests, reconciliation, legal hold, and disposal remain host/operator controls.

No schema migration, release version, provider credential, LLM key, network exporter, scheduled writer, temporary repair workflow, generated coverage database, cache, or build artifact is introduced. Standalone operation remains intact and the page primitive can be embedded into CWL MSA workflows without requiring contextual-orchestrator or naruon.

Exact-head gate boundary

Current exact head is 6a1ee16b551aa960a6f3eaee2162d90af95dfe7f against exact stacked base c213fc549dbf024da43b459df29c0616cd741c96.

• CI 31157889802: completed / success on this exact source head. Python 3.10, 3.12, and 3.14 unit jobs all succeeded; container/Compose builds succeeded; and live checkpoint-audit plus migration-operator PostgreSQL integration succeeded with 3 passed.
• Coverage/docstrings/lint/package job 92801332616: completed / success on the exact source head. Ruff passed; public-docstring coverage is 100%; production coverage is 2576 statements, 656 branches, 0 missed, 0 partial, 100.00% with 668 passed, 8 deselected; uv lock --check passed; and source/wheel builds completed successfully.
• Release Acceptance 31157889756: completed / success on this exact source head, including exact-source checkout, two clean exact-head builds, and reproducible wheel/sdist identity evidence.
• CodeRabbit commit-status context: success on this exact source head, but the latest explicit exact-head review request was rate-limited; no fresh review verdict is inferred from that rate-limited request.
• Formal reviews on this PR: none yet. Unresolved inline review threads: zero.
• Branch-protection/ruleset state and any required security/check surface not exposed by the current GitHub connector remain unproven rather than assumed satisfied.

Any newer commit invalidates this exact-head evidence and requires fresh verification.

Required merge order remains .github#790 -> #53 -> #55 -> #56 -> #57 -> #58 -> #59 -> #60 -> #61 -> #62 -> #63 -> this PR. This PR remains draft and must not merge until all prerequisites integrate, it is reconciled onto protected main, branch protection/repository policy/security gates and every required exact-head check succeed, unresolved valid findings are zero, and a qualifying independent non-author GitHub APPROVED review exists. Queued, pending, cancelled, skipped-required, absent, stale-head, stale-base, predecessor, rate-limited-review, status-only, unproven-gate, or synthetic-merge-only evidence is never success.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e0461e59-561a-4a9a-bfe6-3de8cc28bf30

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

@opencode-agent @cwl-noema-review review only; do not write the branch, create a repair workflow, mark ready, or merge. Review exact source head 5b16376f7fdb1613e6075f8bb14467d451b17d61 against exact stacked base c213fc549dbf024da43b459df29c0616cd741c96. Independently verify strict PostgreSQL BIGINT identity bounds, immutable page invariants, bounded limit + 1 keyset SQL, no OFFSET, strict < continuation, trusted row-key/order revalidation, no package commit, live concurrent-insert pagination semantics, standalone/MSA compatibility, ADR 0011/doctoring claims, generated-artifact hygiene, 100% production statement/branch/public-docstring evidence, and exact-source-head checkout. Treat draft status, prerequisite stack, absent/pending gates, stale-head evidence, and missing qualifying independent approval as blockers.

[coderabbitai]

@seonghobae I will review PR #65 only. I will use source head 5b16376f7fdb1613e6075f8bb14467d451b17d61 and stacked base c213fc549dbf024da43b459df29c0616cd741c96. I will not modify the branch, create a repair workflow, change draft status, or merge.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

@opencode-agent @cwl-noema-review review only; do not write the branch, create a repair workflow, mark ready, or merge. Review exact source head 6a1ee16b551aa960a6f3eaee2162d90af95dfe7f against exact stacked base c213fc549dbf024da43b459df29c0616cd741c96. Independently verify strict PostgreSQL BIGINT identity bounds, immutable page invariants, bounded limit + 1 keyset SQL, no OFFSET, strict < continuation, trusted row-key/order revalidation, no explicit package commit, live concurrent-insert pagination semantics, standalone/MSA compatibility, ADR 0011 and doctoring claims including current NIST/PostgreSQL references, generated-artifact hygiene, 100% production statement/branch/public-docstring evidence, and exact-source-head checkout. Treat draft status, prerequisite stack, absent/pending gates, stale-head evidence, and missing qualifying independent approval as blockers.

[coderabbitai]

@seonghobae I will review PR #65 only.

I will review source head 6a1ee16b551aa960a6f3eaee2162d90af95dfe7f against stacked base c213fc549dbf024da43b459df29c0616cd741c96.

I will not modify the branch, create a repair workflow, change draft status, mark the PR ready, or merge. I will treat the specified gate and approval conditions as blockers.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

@coderabbitai review

Please review exact source head 6a1ee16b551aa960a6f3eaee2162d90af95dfe7f against exact stacked base c213fc549dbf024da43b459df29c0616cd741c96. CI 31157889802 and Release Acceptance 31157889756 are now both completed/success on this exact source head. Review only; do not write the branch, create workflows, mark ready, or merge.

[coderabbitai]

@seonghobae I will review PR #65 against source head 6a1ee16b551aa960a6f3eaee2162d90af95dfe7f and stacked base c213fc549dbf024da43b459df29c0616cd741c96.

I will only review the changes. I will not modify the branch, create workflows, change draft status, mark the PR ready, or merge it.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Current exact-head/base audit after dependency-order ancestry reconciliation:

• source head: 4589fe07abd8a3c151bc98c5cfabfe9328d5f992
• exact stacked base: f7f187c261f74d5b96022a17e7670d8db5db9f2c
• ancestry: 37 ahead / 0 behind
• tree identity check: prior feature head 9b1d80266831ed6347ce41157bc76305549a657f → current head is ahead-only with files=[]; reconciliation changed ancestry only and used non-force fast-forwards after no-file candidate comparisons
• CI 31166790258: completed / success on this exact source head; exact-source checkout assertions, Python 3.10/3.12/3.14, 100%-gated coverage/docstrings/lint/package, container builds, and live checkpoint storage/audit PostgreSQL integration all succeeded
• Release Acceptance 31166790277: completed / success on this exact source head
• CodeRabbit commit status: success
• unresolved inline review threads: 0; formal reviews remain absent, so there is no qualifying independent non-author APPROVED review

Older 6a1e..., 9b1d..., predecessor-base, rate-limited review attempts, and synthetic merge evidence are stale/supporting evidence only. Branch protection, organization rulesets, security scanning, and any required-check surfaces unavailable through the connector remain unproven; this replacement draft is not merge-authorized.

[seonghobae]

Closing as superseded by #83. Exact #65 head remains 4589fe07abd8a3c151bc98c5cfabfe9328d5f992 on superseded #63 history. Replacement #83 is open/mergeable at exact head 0d3366de78c6b1373588d682560d3d50a6ee8a9a directly on #80 exact head 3cac073cc791b78fafa0005b820e0206fe168a63, one commit ahead and zero behind. The replacement reproduces exactly the same 12-file delta and per-file statistics. Fresh exact-head CI 31286717072 and Release Acceptance 31286717075 both completed successfully. Direct mergeability probes #81/#82 proved the old branch could not be reconciled non-destructively. No checks, reviews, or approvals from this PR transfer to #83.