feat(integration): bind verified publish receipts to fenced persistence by seonghobae · Pull Request #264 · ContextualWisdomLab/psychometrics-commons

seonghobae · 2026-08-20T11:42:31Z

Why

Protected main now verifies that an outbound publisher acknowledges the exact immutable event it was given (#252). The durable fenced persistence API still accepts outbox identity and delivery outcome as separate caller arguments. A composition layer could therefore verify event A, then accidentally hand event B identity or a different outcome to the persistence adapter.

What

Add an opaque VerifiedIntegrationPublishReceipt that can be minted only after execute_integration_publish accepts the exact publisher acknowledgement.
Expose execute_verified_integration_publish for outbound execution without holding a database transaction open.
Add record_verified_leased_delivery_attempt, which derives source, tenant, event, and outcome from that verified receipt and accepts only attempt evidence plus the current fencing token.
Prove a fence obtained for event A cannot be transferred to a verified receipt for event B; the other outbox remains pending.
Keep the existing publisher seam and fenced PostgreSQL adapter authoritative rather than duplicating retry, quarantine, lease, or persistence logic.

TDD lineage

RED contract: 5d240841d263034e34a0353e3c310b684e972109 introduced the missing verified handoff surface. The following isolation commit restored the pre-existing durable-integration contract file and moved the new RED contract to its own test target without changing the intended failing API requirement.
Test isolation: 5f32d5a68643a927730c5a5f1e4b5ed31b2b7e52 restores the existing integration_delivery_contract byte-for-byte and keeps the new handoff contract separate.
GREEN implementation: 55eea44a2e2013d1542ea4cf7ac489516d37d3f7 adds the verified receipt and persistence composition.
PostgreSQL regression: 841076a3897b9ecbf9dee27a5b77a23d8140f891 exercises the exact fenced durable handoff and cross-event fence rejection.

The PR diff against protected main is additive: the existing durable-integration test file is unchanged.

Boundary

This does not perform network I/O inside a PostgreSQL transaction, change retry/quarantine policy, add a schema, bypass EgressWeave policy, access another service database, or implement psychometric arithmetic. The caller still claims and commits a durable lease first, performs outbound I/O, then records the verified result in a fresh transaction under the current fencing token.

Verification required before merge

Exact-current-head Runtime CI, owned line/branch coverage, rustfmt/clippy/rustdoc, security/SAST/SBOM/provenance, zero valid unresolved findings, and qualifying independent non-author last-push review remain required. Never self-approve or transfer evidence from another head.

coderabbitai · 2026-08-20T11:42:42Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 20e65018-2cce-40bd-bcac-e8798781bdd7

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-08-20T11:44:56Z

@cwl-noema-review

seonghobae · 2026-08-20T11:48:05Z

@opencode-agent

seonghobae · 2026-08-20T11:55:44Z

Exact head moved to c89e1d8b51d9872b37ea7e41fb9af19b1cb2c171 only to replace semantic test identifiers with opaque non-numeric fixtures. Please review this exact head.

@cwl-noema-review

@opencode-agent

seonghobae · 2026-08-20T12:50:37Z

Reconciled the latest exact head from c89e1d8b51d9872b37ea7e41fb9af19b1cb2c171 to ad485cc1 without force-pushing.

Fixed the two current cargo fmt --check failures: missing EOF newline in src/lib.rs and the wrapped PostgreSQL test assertion.
Fixed the current Clippy doc_markdown failure in tests/postgres_verified_integration_delivery.rs.
Added the affected traceability/UML/risk mapping for the verified publisher-to-fenced-persistence boundary; live worker execution remains explicitly Target.
Fresh local evidence on ad485cc1: cargo fmt --all -- --check, git diff --check, focused publisher/verified-handoff/PostgreSQL tests (5 + 2 + 1 passed), documentation contracts (10 + 1 passed), cargo clippy --all-targets -- -D warnings, and TEST_DATABASE_URL=postgresql://seonghobae@localhost/postgres cargo test -q --all-targets all passed.

This is validation evidence, not approval. Please review only exact head ad485cc1 against protected main 5544149c, and do not transfer findings or coverage evidence from superseded heads.

seonghobae · 2026-08-20T12:50:57Z

@opencode-agent Please review only exact head ad485cc1 against protected main 5544149c. The current head contains the minimum formatting/clippy fixes and explicit traceability for the verified publisher-to-fenced-persistence boundary. Use only same-head CI/security/coverage evidence; do not transfer findings or approval conclusions from superseded c89e1d8b.

seonghobae · 2026-08-20T20:40:03Z

@opencode-agent Please review only exact head ad485cc1dbd25e4056da1ac381c4741f1793c896 against protected base 5544149ca5dc55d2bfc3402cc59c03c44830de5f. PR: feat(integration): bind verified publish receipts to fenced persistence. Report actionable findings for this exact head; this request is not an approval.

seonghobae · 2026-08-20T21:29:07Z

@opencode-agent Current-base correction: protected main is exact head 503a4e6. Please review only PR #264 head ad485cc against that current protected main; the PR metadata may still show the older ancestor base 5544149. Do not transfer conclusions from superseded heads or stale-base reviews.

Preserve the verified outbound-publish receipt handoff, fenced PostgreSQL recording contract, and aligned risk/traceability/UML evidence on top of current protected main. The #258 Rust toolchain-refresh paths are disjoint, so this reconciliation retains both change sets without force-pushing or changing delivery semantics beyond the existing PR delta.

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

devin-ai-integration

Devin Review found 1 new potential issue.

devin-ai-integration · 2026-08-22T23:45:29Z

integration_delivery.rs

+pub fn record_verified_leased_delivery_attempt(
+    transaction: &mut Transaction<'_>,
+    verified_receipt: &VerifiedIntegrationPublishReceipt,
+    attempt_ref: &str,
+    occurred_at_unix_ms: u64,
+    cause_code: Option<&str>,
+    fencing_token: u64,
+) -> Result<DeliveryAttemptPersistence, PersistenceError> {
+    record_leased_outbox_delivery_attempt(
+        transaction,
+        OutboxPersistenceIdentity::new(
+            verified_receipt.source_ref(),
+            verified_receipt.tenant_ref(),
+            verified_receipt.event_ref(),
+        ),
+        attempt_ref,
+        verified_receipt.outcome(),
+        occurred_at_unix_ms,
+        cause_code,
+        fencing_token,
+    )
+}


📝 Info: Verified handoff argument order matches target signatures

record_verified_leased_delivery_attempt (integration_delivery.rs) forwards to record_leased_outbox_delivery_attempt, whose signature is (transaction, identity, attempt_ref, outcome, occurred_at_unix_ms, cause_code, fencing_token). The forwarded order and the OutboxPersistenceIdentity::new(source, tenant, event) construction both match the target definitions in src/postgres_integration.rs. The verified-receipt design correctly prevents rebinding by deriving identity/outcome solely from the receipt rather than accepting independent caller arguments. No bug.

Was this helpful? React with 👍 or 👎 to provide feedback.

Resolved conflicts: - CHANGELOG.md: union Added bullets; Active PR #248/#287 rewritten as merged - docs/TRACEABILITY.md: main's module/migration truth plus #224 reload row; fixed mangled tree annotation - docs/adr/0015: unioned references with consistent APA lettering - AS_BUILT_SCHEMA/ERD/UML: main's merged truth (#58/#77/#218/#232/#264) plus Active PR #224 reload evidence - src/postgres_item_delivery.rs: kept exact_reference/stored_sequence/reconstruct_error helpers; unioned doc contract - tests: restored concurrency-test imports

seonghobae added 4 commits August 20, 2026 04:38

test(integration): require verified publisher handoff

5d24084

test(integration): isolate verified publisher handoff contract

5f32d5a

feat(integration): bind verified publisher handoff

55eea44

test(integration): persist verified receipt under exact fence

841076a

test(integration): keep handoff identities opaque

c89e1d8

fix(integration): format verified handoff and trace boundary

ad485cc

seonghobae mentioned this pull request Aug 20, 2026

docs: establish current product technical gap baseline #263

Merged

devin-ai-integration Bot reviewed Aug 20, 2026

View reviewed changes

Merge branch 'main' into agent/verified-publisher-handoff-20260820

49da9f9

devin-ai-integration Bot reviewed Aug 22, 2026

View reviewed changes

seonghobae merged commit 6e418ad into main Aug 25, 2026
34 checks passed

devin-ai-integration Bot mentioned this pull request Sep 2, 2026

docs: refresh product gap baseline and product README #434

Draft

Navigation Menu

feat(integration): bind verified publish receipts to fenced persistence - #264

feat(integration): bind verified publish receipts to fenced persistence#264
seonghobae merged 8 commits into
mainfrom
agent/verified-publisher-handoff-20260820

seonghobae commented Aug 20, 2026 •

edited by devin-ai-integration Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 20, 2026 •

edited

Loading

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

devin-ai-integration Bot Aug 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

seonghobae commented Aug 20, 2026 • edited by devin-ai-integration Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What

TDD lineage

Boundary

Verification required before merge

Uh oh!

coderabbitai Bot commented Aug 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

seonghobae commented Aug 20, 2026

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seonghobae commented Aug 20, 2026 •

edited by devin-ai-integration Bot

Loading

coderabbitai Bot commented Aug 20, 2026 •

edited

Loading