feat(audit): persist append-only checkpoint acceptance trail

[seonghobae]

Linearized replacement for #62

This Draft replays the exact checkpoint-audit feature delta onto replacement predecessor #78 exact head 64eea7edb28e391634a5d13c83495d20c6388c81 without force-pushing or conflict-side selection.

RCA and replacement boundary

Old observability PR #61 diverged after its predecessor moved and was replaced by #78. Before replay, every #62-modified file that also exists in the predecessor (.github/workflows/ci.yml, AGENTS.md, ARCHITECTURE.md, CHANGELOG.md, CLAUDE.md, docker/postgres/Dockerfile, pg_llm_batch/__init__.py, and tests/test_dependency_refresh_contract.py) was verified byte-identical between old #62 base d23fc6eade6959fa19e22b39337c14dc65b21ab5 and replacement predecessor 64eea7edb28e391634a5d13c83495d20c6388c81.

Replacement head e99c99b081cd5d85f67faf1a0f46944110efbef3 is exactly one commit ahead and zero behind exact predecessor #78 and changes exactly the same 19 audit feature files as old #62: tenant-isolated accepted-save evidence, append-only PostgreSQL audit storage, same-transaction persistence, least-privilege live-role tests, migration/rollback protections, bounded reads, public API/export contracts, and authoritative docs.

Old #62 is closed unmerged as superseded. No predecessor-head check, review, or approval transfers.

Current staged evidence

• Head: e99c99b081cd5d85f67faf1a0f46944110efbef3.
• Exact current base tip: 64eea7edb28e391634a5d13c83495d20c6388c81 (feat(observability): instrument durable checkpoint operations #78).
• Ancestry: one commit ahead, zero behind; merge base equals the exact base tip.
• CI 31285817835: completed / success on the exact replacement source head.
• Release Acceptance 31285817861: completed / success on the exact replacement source head.
• Formal reviews: none at the latest inspection.
• Unresolved inline review threads: zero.

This is current stacked-stage evidence only. Default-branch-only organization/security/review gates are not inferred as passing while this PR is stacked.

Merge boundary

Required order remains .github#790 -> pg-llm-batch#53 -> #55 -> #56 -> #57 -> #58 -> #59 -> #60 -> #78 -> this PR -> #80.

Keep Draft while earlier prerequisites remain unintegrated. After every prerequisite safely reaches protected main, reconcile or retarget this slice onto the actual integrated base and regenerate all required exact-head/exact-base CI, live PostgreSQL, migration/rollback, security, dependency, SBOM/provenance, packaging, automated-review, branch-protection, repository-policy, and Release Acceptance gates. Merge only with zero unresolved valid findings and a qualifying independent non-author GitHub APPROVED review on the unchanged final head. Queued, pending, failed, cancelled, skipped-required, neutral-required, absent, stale-head/base, predecessor, status-only, author-only, or synthetic-only evidence is never acceptance.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 70edf6b3-e0b1-4b55-9a7e-294166d60428

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by #94. Fresh comparison shows #94 is the linearized replacement on current predecessor #92, with the same 19 changed paths and the same aggregate 2,294 additions / 16 deletions while preserving #60's later DSN boundary on the predecessor. No checks, reviews, approvals, or old-base evidence transfer to #94; final acceptance must be reacquired there.